The Use of Supervisory and Regulatory Technology by Authorities and Regulated Institutions Market developments and financial stability implications 9 October 2020 The Financial Stability Board (FSB) coordinates at the international level the work of national financial authorities and international standard-setting bodies in order to develop and promote the implementation of effective regulatory, supervisory and other financial sector policies. Its mandate is set out in the FSB Charter, which governs the policymaking and related activities of the FSB. These activities, including any decisions reached in their context, shall not be binding or give rise to any legal rights or obligations. Contact the Financial Stability Board Sign up for e-mail alerts: fsb/emailalert Follow the FSB on Twitter: FinStbBoard E-mail the FSB at: fsbfsb Copyright 2020 Financial Stability Board. Please refer to the terms and conditions iii Table of Contents Executive summary . 1 1. Introduction . 3 2. Drivers of SupTech and RegTech developments . 4 2.1. Demand drivers . 4 2.2. Supply drivers . 6 3. Benefits, challenges and risks for authorities and regulated entities . 7 3.1. Benefits . 7 3.2. Risks and challenges . 9 4. SupTech and RegTech strategies, market interaction and monitoring developments . 11 5. SupTech resource considerations . 15 6. Data collection, storage, management and analysis . 18 6.1. Data collection . 19 6.2. Data storage . 21 6.3. Data management and processing . 22 6.4. Data analysis and visualisation tools . 23 7. Applications by authorities . 24 8. Applications of new technologies by regulated institutions . 28 9. Considerations for future policy . 31 9.1. Financial stability implications . 31 9.2. Future technology use by the regulator . 32 9.3. Translating rules into machine-readable format and enabling regulatory reporting for regulated institutions . 32 9.4. The ethics of using AI models for supervision . 33 9.5. The impact of cloud-based services on the future of supervision . 34 9.6. Collaboration with regulated institutions and other authorities . 34 10. Considerations for future areas of focus . 35 Annex 1 Case studies and examples . 37 Annex 2 List of survey respondents . 61 Annex 3 Detailed survey results . 62 Annex 4 Glossary . 67 Annex 5 References . 69 iv 1 Executive summary Technology and innovation are transforming the global financial landscape, presenting opportunities, risks and challenges for regulated institutions and authorities alike. A significant area of innovation is the application of new technologies to help authorities to improve their supervisory capabilities known as SupTech - and by institutions to meet their regulatory requirements known as RegTech. The opportunities offered by SupTech and RegTech have been created by a combination of factors that have come to the fore in recent years. These include the substantial increase in availability and granularity of data, and new infrastructure such as cloud computing and application programming interfaces (APIs) which allow large data sets to be collected, stored and analysed more efficiently. Authorities and regulated institutions have both turned to these technologies to help them manage the increased regulatory requirements that were put in place after the 2008 financial crisis. SupTech and RegTech tools could have important benefits for financial stability. For authorities, the use of SupTech could improve oversight, surveillance and analytical capabilities, and generate real time indicators of risk to support forward looking, judgement based, supervision and policymaking. For regulated institutions, the use of RegTech could improve compliance outcomes, enhance risk management capabilities and generate new insights into the business for improved decision-making. For both authorities and regulated institutions, the efficiency and effectiveness gains, and possible improvement in quality arising from automation of previously manual processes, is a significant consideration. Given these benefits, it is not surprising that SupTech is a strategic priority for an increasing number of authorities. Based on a survey of FSB members, the majority of respondents had a SupTech, innovation or data strategy in place, with the use of such strategies growing significantly since 2016. The most common use cases reported by authorities for SupTech tools were in the areas of regulatory reporting and data management. The use of SupTech for misconduct analysis and microprudential supervision has increased in recent years, whereas use cases for market surveillance were reported as having reduced somewhat. Over half of survey respondents reported having a formal development or testing platform for SupTech tools. Artificial intelligence applications were the most commonly deployed SupTech tool and were expected to remain so into the future. FSB members reported that the growth in SupTech strategies could be explained by both supply and demand side drivers. The potential for gains in efficiency and effectiveness of regulatory processes, and the possibility for improved insights into risk and compliance developments were, by a large margin, the most commonly cited demand side drivers for SupTech strategies. On the supply side, the most frequently mentioned drivers were the development of data strategies, increased availability of AI techniques, and emergence of machine-readable data. Despite the opportunities and benefits of SupTech and RegTech, authorities are vigilant to possible risks that could arise from the use of such technologies. Survey responses indicated that the risk reported to be of greatest concern was around resourcing, followed by concerns around cyber risk, reputational risk and data quality issues. Whilst these risks were reported as of most common concern, research indicated a range of possible issues including over reliance 2 on SupTech tools (particularly a risk that over-reliance on methods built on historic data could lead to incorrect inferences about the future) and the potential for limited transparency or explainability in the design and outputs of tools. Authorities also reported a range of challenges in designing and implementing a SupTech strategy. These included, unsurprisingly, issues around skills and resourcing, data quality and considerations around integration of SupTech into internal processes. Governance and accountability over the use of SupTech tools also emerged as an area for focus. Looking to the future, a range of themes emerged as areas which might benefit from further exploration and consideration by authorities as they develop their SupTech and RegTech strategies. These included the importance of senior management buy in, early engagement with users of tools (e.g. supervisors) and collaborations both between authorities, but also with technology vendors and regulated institutions. The potentially catalytic role of data standards and the importance of effective governance frameworks for the use of SupTech and RegTech were also emphasised. Finally, the report contains a variety of case studies giving practical examples of deployment of SupTech and RegTech tools. These include a number of examples related to the COVID-19 experience, which has served both to increase interest in SupTech and RegTech, but also to illustrate where authorities have been able to deploy these solutions to support remote working, crisis response and enhanced surveillance and supervision. 3 1. Introduction Increased adoption of technology is transforming the global financial landscape, raising opportunities and challenges for both authorities and regulated institutions. 1 One important area of innovation is the application of financial technology (FinTech) for regulatory and compliance requirements and reporting by regulated institutions (RegTech), and applications of FinTech used by authorities for regulatory, supervisory and oversight purposes (SupTech). 2,3 This report provides a stocktake of recent SupTech and RegTech developments. It describes demand and supply drivers, as well as barriers and enablers, to the development and deployment of SupTech and RegTech by authorities and regulated institutions. It also examines relevant technologies that have enabled the growth of SupTech and RegTech, such as cloud- based services, artificial intelligence (AI), machine learning (ML) and application programming interfaces (APIs). In addition, the report considers the benefits, risks and challenges of SupTech and RegTech to support authorities and regulated institutions in considering the opportunities and implications of these technologies. It examines how certain authorities might develop their SupTech strategies as well as the resources that might be involved. It looks at how certain tools are changing the way in which authorities go about data collection, storage, management and analysis, and discusses applications of these tools by both authorities and regulated institutions. Finally, it concludes with a review of the policy considerations of using such tools and applications, and future areas of consideration for both authorities and regulated institutions. The report also analyses the potential implications for financial stability of the growing use of SupTech and RegTech tools. On the one hand, these tools could potentially strengthen the resilience of the financial system through new means to facilitate or improve supervision, surveillance, and enforcement by authorities; and reporting and compliance by regulated institutions. Further, the automation of some regulatory and compliance functions through the use of SupTech and RegTech, in areas such as reporting and risk management can reduce the scope for human error, while increasing the potential for real-time monitoring. On the other hand, risks may arise from the overreliance on the use of these new methods. Excessive dependence on SupTech and RegTech could mean sources of risk are overlooked, and there could be a misplaced emphasis on “the risk that can be measured, rather than the risk that matters”. 4 This report, which responds to a request by the Saudi G20 Presidency, was prepared by a workstream of the FSBs Financial Innovation Network (FIN). The work drew on discussions with firms, academic research, and reports by public and private sector institutions to understand the various applications of SupTech and RegTech. The workstream also conducted a survey of FSB Members. 1 For the purpose of this report, the term regulated institutions refers to regulated financial institutions. 2 FSB (2017), Financial Stability Implications from FinTech: Regulatory and Supervisory Issues that Merit Authorities Attention, June; FSB (2017), Artificial Intelligence and Machine Learning in Financial Services: Market Developments and Financial Stability Implications, November. See Annex 3 for a glossary of definitions. 3 The report draws on examples from specific private firms involved in RegTech, and as vendors in SupTech solutions. These examples are not exhaustive and do not constitute an endorsement by the FSB for any firm, product or service. Similarly, they do not imply any conclusion about the status of any product or service described under applicable law. Rather, such examples are included for purposes of illustration of new and emerging business models in the markets studied. 4 Danielsson et al (2017), Artificial Intelligence, financial risk management and systemic risk, Systemic Risk Centre Special Paper No. 13. 4 Alongside the work on this report, the Saudi G20 Presidency and the BIS Innovation Hub Singapore Centre launched the G20 Global TechSprint to examine the potential for new and innovative technologies to respond to operational challenges in the areas of SupTech and RegTech. The goal is that the work will result in insights into practical supervisory tools and policy and serve as a complement to this report. 2. Drivers of SupTech and RegTech developments A confluence of drivers has led to the development and application of SupTech and RegTech tools and methods. They arise from the need to support supervisory processes while ensuring compliance with regulatory requirements. From the demand side, since the 2008 global financial crisis, regulatory requirements have been strengthened and authorities and regulated institutions alike are dealing with increased amounts of regulation and data. This encourages the creation and adoption of digitalised compliance and supervisory tools in response. As for the supply side, advances in technology have propelled increased cost efficiency and data capacity as well as greater computing power. 5 2.1. Demand drivers Enhanced surveillance and compliance: SupTech and RegTech tools might support enhanced supervision, surveillance, and enforcement by authorities while also improving reporting and compliance by regulated institutions, potentially strengthening the resilience of the financial system. Automation of regulatory and compliance functions such as reporting and risk management may also reduce the potential for human error, while increasing the effectiveness of real-time monitoring and supporting proactive and judgement based supervision. The increased complexity and volume of regulations, and the significant consequences of non-compliance, have led to large increases in spending on compliance and risk management programmes by regulated institutions: Examples include increased reporting and compliance obligations implemented pursuant to the Dodd-Frank Act in the US and increased reporting obligations under the Markets in Financial Instruments Directive (MiFID II) and Alternative Investment Fund Manager Directive (AIFMD) in the EU. More efficient, effective and value-added regulatory data: Legacy systems are frequently incompatible with todays digital tools. Digitisation of regulatory data may increase efficiency while strengthening operational resilience and data quality for both authorities and regulated institutions. 6 Indeed, enhancing efficiency was seen as the 5 Some of the drivers are more task-oriented while other seem more important for improving the understanding of the underlying technologies. 6 Digitisation is often defined as the process of changing from analogue to digital form. By contrast, digitalisation is defined as the use of digital technologies to change a business model, or the process of moving to a digital business. See Gartner Glossary, online at (accessed 25 May 2020). 5 primary driver of SupTech adoption in the FSB survey by almost half of the authorities that responded (See Graph 1). More insightful policy and forward-looking supervision: As available data grows and becomes more granular, authorities are working to enhance their supervisory processes. 7 Equipped with the necessary technological tools, the availability of real- time and non-traditional data may allow authorities to be more pro-active in the