The 2008 banking crisis exposed financial misconduct in the industry and resulted in new regulations within the financial sector. McGrath and Walker (2022) indicated that misconduct is a growing issue in the financial sector. This misconduct has increased regulations in the industry, leading to the emergence of regulatory technology (Lynn et al. 2019). The Dodd-Frank Act and Consumer Protection Act were enacted within the United States to protect financial institutions from further crises due to financial misconduct. Though these regulations help minimize risks to financial institutions, implementing these regulations was expensive. Ellis Gutshall, CEO (Chief Executive Officer) of Valley Bank, indicated that it costs banks close to 12% of the operating costs or approximately $50 billion annually to comply with the regulations (Dodd-Frank Act’s Effects on Financial Services Competition 2012). This increase in operational expenses burdens smaller banks, causing smaller banks to have a lesser competitive advantage over larger banks. In a survey conducted by the World Bank, researchers suggested that at least half of the financial institutions surveyed worldwide noted that regulatory and supervisory compliance was one of their top three challenges (Feyen et al. 2022). Regulatory compliance is enforced using RegTech, or regulatory technology, solutions. Supervisory compliance by supervisory authorities is enforced by SupTech, or supervisory technology, which is nothing but RegTech for supervisory authorities.

RegTech and SupTech are software technologies that have emerged to ease regulatory and supervisory compliance by minimizing operation costs. Thakor (2020) indicated that United States banks had paid over $200 billion in fines for financial misconduct post-2009. RegTech helps identify instances of financial misconduct and saves banks the cost of penalties due to financial misconduct (di Castri et al. 2018). Multiple surveys by market research companies indicated that RegTech is on track to show a compound growth rate of over 20% between 2023 – 2027 (RegTech Market—Global Forecast to 2026, 2022). This paper explored the impact of RegTech in addressing compliance risk due to financial misconduct within the US banking system, where risk is defined by the Federal Bank of New York as “the potential for behaviors or business practices that are illegal, unethical, or contrary to a firm’s stated beliefs, values, policies, and procedures” (Chaly et al. 2017, pp. 5).

1 Problem statement

The banking industry in the United States is regulated mainly by prudential or consumer protection regulations. Prudential regulations ensure a financial institution’s financial soundness and stability; consumer protection regulations protect consumers. These regulations are in place to monitor and prevent financial misconduct. Failure to comply with these regulations results in hefty banking fines. Financial misconduct can fall under two broad classifications:

  1. 1.

    Misconduct by consumers which includes money laundering, identity theft, fraud, and finance of terrorism.

  2. 2.

    Misconduct by banks includes monopolizing the market, lack of consumer data protection, discriminatory practices, risk-taking that affects the bank’s stability, and insider trading.

For this study, financial misconduct includes both misconduct by consumers and misconduct by banks. Many laws help curb financial misconduct by consumers and banks within the United States. The fundamental laws are:

  1. 1.

    Dodd-Frank Act – This act monitored the financial stability of major financial institutions whose failure could impact the economy, prevented predatory lending practices, set the Volcker rule which restricted how banks can invest, monitored the issuance of reliable credit ratings, and established a whistleblower program that helps report securities fraud. This law was partially rolled back in 2018 to exempt small banks.

  2. 2.

    Bank Secrecy Act (BSA) (U.S.C 1970) – This act prevents laundering monetary investments, engaging in financial transactions in property derived from unlawful activities, and structuring transactions to evade reporting requirements. According to this act, any transaction over US $10,000 should be reported.

  3. 3.

    Federal Deposit Insurance (FDI) (U.S.C 1950) – The FDI Act deems certain practices like operating with inadequate capital, engaging in hazardous lending and lax collection practices, engaging in speculative investments, failing to maintain controlled accounting practices, having excessive loan losses, or nonearning assets as unsafe and unsound and deems any banking institution that engages in these practices as displaying financial misconduct (FDIC 2023).

  4. 4.

    Basel III (Ferreira et al. 2019) – This global framework sets regulations to enhance the shock-absorbing capabilities of banks by specifying capital adequacy and liquidity ratios and conducting periodic stress tests. These rules were implemented in the US banking industry starting in 2013.

There are several regulatory agencies within the United States to enforce these laws. It is difficult for banks to assess if they comply with these regulations since they would need to sift through massive data, which can be time and resource-consuming, but not doing so may result in hefty fines. RegTech is used to help banks sift through data and manage compliance regulations. RegTech is a software solution that leverages artificial intelligence, machine learning, blockchain, API (Application Programming Interface), or other technologies to monitor for financial misconduct in the following areas: Risk and Compliance Management, Identity Management, Regulatory Reporting, Anti-Money Laundering (AML) and Fraud Management, and Regulatory Intelligence. Earlier identification of misconduct using RegTech solutions saves banks from reputational damages and fines.

RegTech has gained popularity after the 2008 banking crisis with many regulatory agencies and banks using RegTech, however, there is still a high rate of financial misconduct reported, some of which have led to banking failures. So, did RegTech help to reduce financial misconduct? This query motivated the research question: What is the impact of RegTech on compliance risk due to financial misconduct within the US banking industry?

The CIMO (Context, Intervention. Mechanism, Outcome) framework aided in framing the research question, as shown in Table 1, since the framework facilitates a design-oriented research question, which helps offer practical interventions/solutions to issues faced by policymakers, management professionals, and organizations across different contexts (Costa et al. 2018).

Table 1 Framing the research question using the CIMO framework
Full size table

2 Significance of the study

RegTech is an extensively researched topic. However, more studies discuss the potential impacts of RegTech rather than the current or past impact. Also, most systematic reviews in this field evaluate the different RegTech technologies and regulations and discuss possible application areas for RegTech (Tsang and Yang 2018). In recent months, many news articles have reported US banks shutting down due to bank runs (Smolenski 2023). Knowing whether RegTech would have prevented these shutdowns by flagging the banks’ financial misconduct ahead of a solvency issue would provide valuable information to the management of the US banking industry, the regulatory policymakers, and players in the RegTech industry. A few case studies evaluated the impact of RegTech for a particular application like AML or ‘Know Your Customer’ (KYC) in the US banking industry. However, there needed to be a more cumulative evidence-based review of the impact of RegTech across different applications like unified reporting of compliance reports to detect misconduct, risk assessment and monitoring to detect misconduct and enforcement of compliance regulations in the US banking industry. This study fills the literature gap and provides insights to the banking industry regarding the benefits of investments in RegTech, which contribute to a compliant and safe US banking system.

3 Literature landscape

Regulating agencies showed renewed interest in regulatory technology after the 9/11 attacks and the dot.com bubble in 2001 (Arner et al. 2017). Regulating agencies and the banking industry focused on detecting financial misconduct related to terrorist funding, money laundering activities, and rampant speculation in the security market that led to economic instability. This focus led to the initial growth of regulatory technology. Regulating agencies soon realized that financial institutions had no uniform reporting standards and began implementing and mandating eXtensible Business Reporting Language (XBRL).

Between 2001 and 2014, there were several articles related to the implementation of XBRL (eXtensible Business Reporting Language). Some articles discussed XBRL case studies (Chen 2010), and some discussed the impacts of XBRL (Blankespoor et al. 2014; Hao and Kohlbeck 2013). It was only in 2015 that the term RegTech was coined by the United Kingdom’s Financial Conduct Authority (FCA) (Turki et al. 2020).

Between 2015 and 2023, there has been an increase in publications related to RegTech. This spurt coincides with RegTech investments which have octupled from US $1.1 billion in 2015 to US $8.5 billion in 2019 (Howell, 2022). The publications during this time mainly focused on the available RegTech solutions and applications (Drgon et al. 2021; Fletcher et al. 2021; Von Solms 2021), fraud detection (Kurum 2023; Phillips and McDermid 2021; Sater 2020), unified reporting (Mousa and Pinsker 2020; Suwardi and Tohang 2017), and futuristic data collection and processing using artificial intelligence (AI) and Natural Language Processing (NLP) (Marina A. Aksenova 2022; Micheler and Whaley 2020; Soldatos and Kyriazis 2022).

4 Theoretical framework

The agency theory originated in the 1970s and is commonly used in economic and management literature to address governance mechanisms that regulate conflict of interest (Chen et al. 2012). The authorship of the agency theory is contended between two theorists, Stephen Ross and Barry Mitnick (Mitnick 2006). The agency theory attempts to define the relationship between the principal and the agent, where the principal relies on the agent to execute specific tasks. The theory assumes that the principal and the agent operate towards their self-interests which might be conflicting, and that the agent has more access to data and a better capacity to make decisions. The theory also postulates that regulating conflict between the principal and the agent reduces the agency's loss.

Looking at the research question through the lens of the agency theory, the principal can be the regulatory agency when the agent is the financial institution or the principal can be the financial institution when the agent is the consumer (see Fig. 1). The regulating agency is interested in financial stability and improving the nation's security posture and economic stance. The banking industry is interested in maximizing profit at the cost of higher risks leading to financial misconduct (Iqbal et al. 2015) which can potentially destabilize the nation’s economy leading to agency conflict. Consumers driven by their needs also indulge in financial misconduct (Karpoff 2021) which lowers the banking industry’s profit causing a conflict with the financial institution’s goal. Regulatory laws enforced using RegTech manage these conflicts of interest by enforcing compliance to help align the different stakeholders’ interests and reduce agency problems.

Fig. 1
figure 1

The theoretical framework of agency theory

Full size image

In addition to regulating conflicts of interest between regulatory agencies and financial institutions, and consumers and financial institutions, the banking industry uses RegTech to self-regulate. Large amounts of data are accessible to each financial institution and mined for self-regulation (Tuch 2018). Examples are mining consumer complaints to identify discriminatory practices (Siering 2022) and mining consumer data to identify risky consumers (Grassi and Lanfranchi 2022). Regulating agencies receive vast amounts of data from numerous financial institutions. This data helps regulate and address potential conflicts of interest between the regulating agency and the banking industry. Resolution of all disputes results in a compliant banking industry and reduces loss to the banking industry. In contrast, conflicts destabilize the banking industry and possibly the nation's economy.

5 Methodology

This study uses an evidence-based methodology. Rousseau (2006) suggested that using empirical evidence to make management decisions is better than using personal preferences. To address the review question, the approach employed was the rapid evidence assessment (REA) methodology, which relies on solid evidence. Systematic reviews (SR) are effective in synthesizing evidence; however, it typically takes 6–24 months to get results from a systematic review (Moons et al. 2021). The banking industry is dynamic and rapidly changing, so the time to generate systematic reviews impedes making quick evidence-based decisions. Also, systematic reviews introduce bias into the study due to their subjective nature (Crawford et al. 2015). However, the REA takes between 4–8 weeks and provides high-quality evidence providing similar results to systematic reviews, making it a more viable choice to provide rapid evidence (Moons et al. 2021).

Gough et al. (2012) suggested that configurative reviews using thematic synthesis aim at finding patterns that answer the review question fittingly. This study is exploratory; hence, a qualitative, configurative review approach was used along with data triangulation. Data was selected based on its relevance and contribution to the study and synthesized using a thematic approach to arrive at the findings.

6 Search strategy

The author implemented a structured search strategy, as suggested by Gough et al. (2017). The inclusion/exclusion criteria were defined. This study used peer-reviewed, primary research and empirical studies, primarily published in scholarly journals, in English, from 2008—2023. Bustin and Nolan (2016) suggested that peer-reviewed, scholarly journals have high transparency and reliability. The studies selected were from 2008–2023 since the banking regulations changed drastically after the banking crisis in 2008 and caused the spurt of many RegTech companies.

The search query was based on search strings designed using the CIMO framework, as shown in Table 2. Boolean and wildcard operators were used in the search strings to increase the specificity and sensitivity of the search. Increasing the search specificity and sensitivity also prevents bias in research and helps locate relevant studies (Barends et al. 2017; Haynes and Wilczynski 2004). Grewal et al. (2016) suggested that the key to proper research is an extensive data search; therefore, search queries were executed on multiple databases using four search strings. The databases used for the search were Business Source Ultimate, ScienceDirect, Directory of Open Access, Academic Search Ultimate, Emerald Insight, ABI/Inform, Journal Storage (JSTOR), Scopus, Google Scholar, Social Science Research Network (SSRN), and Securities and Exchange Commission (SEC) publications. Building blocks and snowball search techniques were used for more comprehensive results (Goodman et al., 2014).

Table 2 Framing the search strings using the CIMO framework
Full size table

Table 3 displays the search results and provides information about each study’s methodology and geography. A critical appraisal of the twelve articles retrieved from the search resulted in the final sample used for the study. The search strategy was documented with a PRISMA, as shown in Fig. 2. PRISMA is an evidence-based method of reporting study selection to avoid publication bias (Brooks and McNeely 2013).

Table 3 Search databases and result classification
Full size table
Fig. 2
figure 2

PRISMA for search strategy Note. This figure was constructed using a PRISMA flow diagram generator (Haddaway et al. 2022)

Full size image

7 Critical appraisal

Critical appraisal of the studies is a crucial step since Kepes et al. (2014) suggest that establishing the trustworthiness of the evidence yields meaningful results. Multiple tools are available to appraise a study critically. The appraisal tools were evaluated based on the recommendations of Bhattacherjee (2012), Kepes et al. (2014), Rousseau (2006), and Gough (2007) to appraise rigor, transparency, significance, and relevance. Each criterion used a scale of three, with the highest possible score of 12 and the lowest score of zero. The Mixed Methods Appraisal Tool (MMAT) variation tool (Munro et al. 2021) scored low on transparency but high on rigor, significance, and relevance. The TAPUPASM tool (Ryan and Rutty 2019) scored high on transparency. The MMAT variation tool had clearly defined questions evaluating an article. However, since the TAPUPASM tool was subjective, objective questions were framed for the transparency tenet within the TAPUPASM framework based on insights from Ryan and Rutty (2019). Hence, both tools were combined to create a new appraisal tool that keeps the rigor, significance, and relevance elements of the MMAT variation tool and adds the element of transparency to the tool. The combined MMAT and Transparency framework evaluated the initial 12 articles identified.

If the screening questions in the MMAT appraisal tool had a response of “No” or “Can’t tell,” it was deemed that further appraisal was not appropriate (Hong et al. 2018, p. 5). The combined MMAT and Transparency framework assigned a scale of three for each criterion, with the highest possible score of 24 and the lowest score of zero. The study only selected articles that had a score of 12 or higher. Therefore, articles by Siering (2022) and Tuch (2018) were not included, leaving a total of 10 articles selected based on the selection criterion. Table 4 displays the appraisal scores for all 12 articles.

Table 4 Appraisal results
Full size table

A crucial criticism of the rapid evidence methodology is that it lacks transparency and rigor (Varker et al. 2015). Using tools like PRISMA and MMAT to report transparently on the search strategy and critically appraise the evidence ensures the study's high transparency, quality, and rigor (Varker et al. 2015).

8 Data extraction

A data extraction process was used to minimize bias and assess the studies for the relevance of the sample (Munn et al., 2014). The data extracted included the author, title, sample description, methodology, hypothesis, primary findings, and study limitations described by each author. After data extraction, a data descriptor describing the data set was constructed, as shown in Table 5. Hrynaszkiewicz (2014) suggested that data descriptors make the data open, discoverable, and transparent. One of the 10 articles was from grey literature, and the other nine were scholarly publications. Out of the 10 articles, five articles used a quantitative methodology, and the rest used a qualitative methodology. Five articles analyzed the impact of RegTech on banks, and the other five analyzed the impact of RegTech on regulatory agencies. All articles indicated a positive effect of using RegTech, with only four articles warning about the negative impacts of RegTech.

Table 5 Data set descriptor
Full size table

9 Coding

The inductive coding method was used to code the articles since the study is exploratory. Skjott and Korsgaard (2019) stated that inductive coding is most effective in exploratory studies. Five coding cycles were executed on each article's findings and discussion section, as shown in Fig. 3. If the article was a case study, the case details are analyzed through coding to identify any details or concepts not presented in the findings. Atkinson (2002) suggested that coding case study details provide valuable research information. Skjott and Korsgaard (2019) suggested that inductive coding generates much code, so computer-assisted qualitative data analysis software (CAQDAS) should be used to code the data better. ATLAS.ti was chosen as the CAQDAS tool since it is widely used for qualitative data analysis. Though grounded theory inspired its conception, it is used for all approaches, including thematic analysis (Friese et al., 2018).

Fig. 3
figure 3

Combined coding technique

Full size image

A thematic synthesis of the codes extracted indicated that the timeliness, data processing speed, and automation of RegTech solutions impact banks by reducing reporting time and quality by providing quick, high-quality data, detecting fraud early, improving operating costs, and improving the safety and stability of the bank. Table 6 shows the categories that formed each theme.

Table 6 Categories and themes
Full size table

10 Findings

This section discusses this research's findings and answers the research question, ‘What are the impacts of RegTech on detecting financial misconduct in the US banking industry?’ CERQual (Confidence in Evidence from Reviews of Qualitative Methods) was used to assess each of the findings to increase the confidence and transparency of this review. Lewin et al. (2018) suggested that CERQual is an evidence-to-decision framework that is structured and provides transparency to the qualitative review. Findings presented in eight or more good-quality articles are considered high confidence, while those presented in four or more good-quality articles are considered moderate confidence. Any remaining findings are considered low confidence.

The coding process uncovered two positive impacts and one negative impact of RegTech on detecting financial fraud in the US banking industry.

Finding 1: Positive impact: Automated risk assessment and monitoring lead to less compliance risk and hence higher stability in the banking industry by reducing risk due to financial misconduct. (High CERQual confidence).

This finding was supported by nine of the 10 articles reviewed. RegTech provides better assessment and monitoring of risk by providing a means for assessing capital adequacy and liquidity requirements for banks (Anagnostopoulos 2018; Barefoot 2020; McGlosson and Enriquez 2023; Suwardi and Tohang 2017). Sefried and Riepe (2023) implied that the use of RegTech helped assess loan loss provisions better and reduced risk, while Anagnostopoulos (2018) and Rapp (2018) indicated that RegTech could be used to assess and mitigate market risks by detecting fraud.

Researchers elucidated the benefits of RegTech in minimizing risk by facilitating continuous reporting through the provisioning of APIs and automating multiple compliance processes that are critical to detecting and preventing fraud, like automation of Know-Your-Customer (KYC) requirements for AML and terrorist funding (Arner et al. 2017; Barefoot 2020; Jayasuriya et al. 2023; Mousa and Pinsker 2020). McGlosson and Enriquez (2023) indicated that the introduction of RegTech also triggered the hiring of data analysts, mathematicians, and financial economists who help to better regulate and stabilize the industry by better assessing risk. Overall, the consensus was that RegTech solutions have helped financial institutions better assess and mitigate risk, increasing the banking system’s stability.

Finding 2: Positive impact: Higher transparency, intelligent and fast processing, quality, and retention of data to detect fraud leads to less compliance risk and higher profitability in the banking industry (High CERQual confidence).

All 10 articles reviewed supported this finding. RegTech provides better data quality for reporting fraud, which uses automated procedures to validate the data (Anagnostopoulos 2018; Arner et al. 2017; Hao and Kohlbeck 2013; Mousa and Pinsker 2020; Rapp 2018; Suwardi and Tohang 2017). The presence of central data repositories increased the availability of data and facilitated the use of data analytics to correlate data across multiple, voluminous data sources to find financial fraud patterns more efficiently (Anagnostopoulos 2018; Arner et al. 2017; Barefoot 2020; Jayasuriya et al. 2023; McGlosson and Enriquez 2023; Mousa and Pinsker 2020; Rapp 2018).

The ability to correlate across multiple data sources indicated that RegTech facilitates the quick processing of volumes of data each day to detect fraud which is not possible through human effort, thus reducing operating costs and increasing profitability (Hao and Kohlbeck 2013; Jayasuriya et al. 2023; Mousa and Pinsker 2020). The use of RegTech for compliance procedures led to higher data quality and lower operating costs (Anagnostopoulos 2018; Arner et al. 2017; Barefoot 2020; Jayasuriya et al. 2023; Mousa and Pinsker 2020). Also, Hao and Kohlbeck (2013) suggested that using RegTech for compliance boosts investor confidence resulting in higher trading volume and lower compliance fines, which increased profitability. Overall, the consensus was that RegTech provided higher transparency, intelligence, fast processing, quality, and data retention to detect fraud, leading to better compliance and confidence in the banking industry, which resulted in higher profitability.

Finding 3: Negative impact: RegTech usage leads to information privacy risk (Moderate CERQual confidence).

Four of the 10 articles reviewed, provided evidence to support this conclusion. Anagnostopoulos (2018), Arner et al. (2017), and Barefoot (2020) indicated that the transformation of the financial industry into a digitized data-based industry increases the risk of fraud and cyber-attacks while Jayasuriya et al. (2023) suggested that the use of digital footprints by lenders increases discriminatory lending practices. RegTech uses volumes of data, and anytime data is involved, a lack of appropriate security practices can lead to data leaks, facilitating financial fraud. Subsequently, it is essential to be cautious and control this risk when utilizing RegTech solutions.

To validate the findings, the author used the technique of data triangulation. The findings were triangulated with FINRA’s annual reports (FINRA 2018) and FinCEN’s Suspicious Activity Reports (FinCEN 2023). Comparing findings from this rapid evidence review with the conclusions of the FINRA annual reports indicated that they were similar. Also, FinCEN’s Suspicious Activity Reports (SAR) were checked between 2010 and 2023 to strengthen the findings. Figure 4 shows a 200% increase in SAR filings in 2013 when e-filing (RegTech) was mandated for suspicious activity reports. This correlation suggests that RegTech has played a crucial role in higher levels of detecting and reporting financial fraud and increases the validity and reliability of the findings.

Fig. 4
figure 4

SAR charts indicate a 200% rise in suspicious activity reports after the introduction of RegTech

Full size image

11 Conceptual framework including findings

The conceptual framework in Fig. 5 uses the CIMO model and includes study results. The context of the study is the US banking industry which consists of regulations, regulatory agencies, and financial institutions. The intervention applied is the introduction of RegTech. RegTech usage helped increase the profitability and stability of the US banking industry by providing automated risk assessment and data monitoring, high-quality, transparent data retention, and availability.

Fig. 5
figure 5

Conceptual framework including findings

Full size image

12 Conclusions

This research identified that RegTech usage facilitates compliance by banks and consumers leading to higher profitability and stability to the US banking industry by providing better risk assessment and monitoring which helps detect and prevent financial misconduct faster, with lower operating costs and improved compliance with regulations. Vanini et al. (2023) indicated that US banks could lose up to $200 billion in online banking fraud between 2020 and 2024. This loss is in addition to fines of over $200 billion since 2008 for non-compliance with regulations. Identifying weaknesses in compliance with regulations prevents fraud or misconduct from occurring in the future.

Von Solms (2021) suggested that regulatory compliance is critical for financial institutions' market stability and profitability. RegTech plays a crucial role in identifying weaknesses or risks to the banking industry by automating compliance procedures, providing shared databases for reporting, and fast processing of volumes of data to identify patterns indicating fraud. Though RegTech plays a crucial role in detecting financial misconduct and improving the stability and profitability of banks, the regulations were the real drivers of financial stability and profitability.

Regulations without compliance are of no use. Financial institutions would incur significant operating costs to enforce compliance without RegTech (Raghavan, 2007). Enforcement of regulations using RegTech facilitates compliance, thus minimizing the risk of fraud and improving stability and profitability. RegTech usage had positive and negative impacts, but the negative ones were highlighted less.

The significant negative impact of information privacy risk was due to cyber-security issues. In 2014, hackers accessed approximately 83 million accounts in one of the leading financial institutions in the US—J.P. Morgan Chase (Callen-Naviglia and James 2018). In 2019, the accounts of 100 million Capital One customers were accessed (Barrett 2020). These events led to the loss of reputation and hence the profitability and stability of banks and therefore are essential to consider. Also, only one article highlighted discriminatory practices among lenders using digital footprint data, indicating that more research is needed to determine the strength of this concern. Discriminatory practices could lead to discriminatory lawsuits, which again decrease the profitability of financial institutions making discriminatory practices a high priority to investigate and restrict.

13 Practical implications

Three actionable recommendations are suggested based on the evidence presented by this study. These recommendations guide banking industry management, regulatory agencies, and RegTech solution providers.

  1. 1.

    Financial institutions and regulating agencies should use RegTech solutions to:

  2. 2.

    Quickly detect and report fraud patterns (Grassi and Lanfranchi 2022).

  3. 3.

    Assess the risk due to financial misconduct (McGlosson and Enriquez 2023).

  4. 4.

    Automate enforcement of compliance with regulations (Grassi and Lanfranchi 2022).

  5. 5.

    Improve decision times through quick processing and displaying of relevant data. (Anagnostopoulos 2018).

  6. 6.

    Financial institutions and regulating agencies should adhere to the following best practices:

    1. a.

      Validate RegTech solutions for information privacy risk and other cybersecurity issues before adoption (Regtech Adoption Practice Guide 2023).

  7. 7.

    Use solutions that implement MFA (multi-factor authentication).

  8. 8.

    Use solutions that encrypt data in transit.

  9. 9.

    Implement solutions that prevent hacking of central database repositories.

  10. 10.

    Sufficiently mask the information gathered by RegTech/SupTech solutions to avoid discriminatory practices.

    1. 3.

      Evaluate and update RegTech/SupTech solutions based on changing regulations.

  11. 11.

    Organize meetings between RegTech/SupTech providers, regulators, and banks to discuss changing regulations and seek a RegTech solution to check for compliance with the regulation before implementation of the regulation. Bagby and Packin (2021) indicated a lag between the legislation and the implementation and adoption of RegTech solutions, leading to lax monitoring. Regular communication between regulators and RegTech providers can prevent this lag.

  12. 12.

    Test implementation of regulations on sandboxes before adopting them.

  13. 13.

    Test AI solutions on sandboxes before implementing them (Truby et al. 2022).

RegTech has positively and significantly impacted the US banking industry by minimizing financial misconduct and hence improving the profitability and stability of the industry. However, RegTech solutions should evolve with the changing regulations and technology and address information privacy risk concerns to continue the positive impact on the banking industry.

14 Theoretical implications

The agency theory was adapted to explain banking governance using RegTech solutions. The agency theory postulates that a. the agency reduces its loss by resolving the conflict between the agency and the principal b. there is information asymmetry between the principal and agent since the agent has more information than the principal c. there is agency risk since the activities of the agent may not align with the interests of the principal. This study’s findings indicated that resolving the conflict of interests between the regulating agency (principal) and the banking industry (agency) through RegTech solutions reduced financial fraud and operating costs, thus reducing the loss for the banking industry and confirming the agency theory's postulates. The study indicates that RegTech helped resolve conflicts of interest between regulatory authority and financial institutions, and between consumers and financial institutions by minimizing information asymmetry between the agent and the principal. RegTech’s ability to sift through massive data helped align the interests of the principal and agent by highlighting discrepancies in an automated manner.

15 Limitations and future research

There are limitations to this study. The first limitation is that the rapid evidence assessment methodology utilized may require the inclusion of more articles to gain a complete perspective. Multiple databases were queried with different search strings to overcome this limitation. The second limitation is that the study is limited to the US banking industry, governed by a separate set of regulations from other countries; hence, it may not be possible to generalize the study to other countries. The third limitation is that the study looks solely at the impact of regulatory technology and does not consider the impact of regulations and the growth of financial technology on financial misconduct.

Potential areas for future research would be to analyze the impact of AI-based RegTech solutions in detecting fraud and formulating banking regulations, analyze the impact of regulations, RegTech, and FinTech on financial misconduct, and analyze if high data availability leads to discriminatory practices.