How to run a regulatory reporting and risk software market scan

The regulatory reporting and risk landscape in numbers

The registry lists 152 regulatory reporting and risk vendors with 368 products, headquartered in 17 countries. 77 name at least one financial institution as a customer. 7 of the products mention an AI capability in their own text (2%).

The largest by named customers

The newest entrants

The full list, with every vendor's flagship product and named customers: Regulatory reporting and risk management software.

How to evaluate regulatory reporting and risk vendors

1. List the returns and the frameworksThe regulatory returns you file, the risk frameworks you run and the controls library you keep; score vendors on those.
2. Test one return end to endFrom source data through lineage to the regulator's format, with a correction and a resubmission.
3. Ask how regulatory change shipsWho tracks the regulator, how a changed return reaches you and how long it took for the last two changes.
4. Read the data lineageEvery figure traceable to its source and its rule; the regulator's reviewer will ask.
5. Check the GRC workflow against your three linesRisk and control self-assessment, incidents, issues and actions, with reporting to the board that your risk team would use.

The method for the scan as a whole, longlist to shortlist, is on the market scan page; the report template gives the headings.

The requirements that separate them

Must-haves in most scans of this category: the register's gates. Each needs evidence named beside it.

• The institution's regulator's returns supported in its formats, with the change history
• Data lineage from source to submitted figure
• Regulatory change tracked and shipped on a stated cadence
• Risk, control, incident and issue workflow across the three lines
• Board and committee reporting the risk team would use as is
• Hosting and access terms that satisfy the regulator's own outsourcing rules

The rules procurement teams ask vendors about

By country, the rules specific to regulatory reporting and risk procurements. Vederca certifies nobody against these: they say what evidence to ask for.

Go further

• Regulatory reporting and risk management softwareEvery regulatory reporting and risk vendor, the largest by named customers, the newest, the table and the questions.
• Regulatory reporting and risk in financial services this weekThe weekly brief: the news in this category, with its sources.
• Fintech Market Scan 2026The whole landscape in numbers.
• Have Vederca run the scanYour requirements to up to 15 regulatory reporting and risk vendors, every response evaluated, a report recommending a shortlist. One fixed fee.