Why this dispatch exists
This is the eighth Phase 3 dispatch and the second in the per-pillar deep-dive sub-series. The first per-pillar dispatch covered Chapter VI payments at a depth no individual archetype dispatch achieved. This one covers Chapter XIII RegTech and compliance reporting from the same per-pillar angle. The hook is MiCAR full force from December 2024: the regulation reshaped not only the CASP archetype RegTech procurement directly affected, but also the broader RegTech vendor positioning across all four operator archetypes covered in the synthesis arc. Eventus Validus’s crypto-asset surveillance strength has become broker-relevant for hybrid operators running CFD plus crypto-asset venues. Nasdaq SMARTS has extended chain analytics integration in its supervisory product. Travel Rule infrastructure has matured from operational workaround to standalone procurement category. Cappitech under S&P Global Market Intelligence has new cross-sell paths into MiCAR-adjacent products. Comms surveillance off-channel coverage continues expanding under FCA enforcement pressure that the CySEC dispatch noted.
The procurement reality in 2026 for trade surveillance, transaction reporting, comms surveillance, regulatory horizon scanning, and Travel Rule infrastructure is materially different from the Phase 2 chapter framing produced during the late-2025 and Q1-2026 research window. This dispatch covers the changes, identifies which Phase 2 verdicts hold versus need adjustment, and surfaces three procurement implications for operators reviewing RegTech architecture in 2026.
The RegTech procurement landscape state in 2026
Five forces shape the RegTech procurement landscape through 2026:
MiCAR Title VI market abuse surveillance implementation maturing. The MiCAR Articles 91-95 on market abuse for crypto-assets came into force with the broader MiCAR application in December 2024. Through 2025 and into 2026, ESMA has continued issuing technical standards and supervisory expectations refining what trade surveillance looks like under the MiCAR-supervised crypto venue regime. The procurement implication is that vendors whose product set extends both traditional MAR coverage and MiCAR Title VI coverage are differentially advantaged for operators running hybrid CFD plus crypto-asset operations.
Travel Rule infrastructure (EU TFR) maturation through 2025-2026. The EU Transfer of Funds Regulation came into force alongside MiCAR in December 2024. Through 2025, Travel Rule infrastructure vendors expanded counterparty VASP coverage, interoperability between competing networks improved, and bundled offerings combining KYC plus Travel Rule emerged from existing vendors. The procurement decision shape has matured from “pick a vendor and ship it” (the Phase 2 CASP framing) to “select for counterparty network breadth, evaluate interoperability with the operator’s primary KYC vendor, and budget for parallel TR providers if counterparty coverage gaps exist.”
The continuing comms surveillance off-channel expansion under FCA pressure. FCA enforcement focus on off-channel comms (WhatsApp, Signal, personal email, mobile messaging) has continued through 2025-2026. The procurement question has shifted from “do we have email and Bloomberg covered” to “do we have full mobile and collaboration platform coverage including WhatsApp Business, Microsoft Teams, Slack, and personal device exposure for designated employees.” Both Behavox and Smarsh have continued extending coverage; the procurement-relevant question is depth and breadth rather than vendor identity.
Transaction reporting under MiFIR plus EMIR REFIT continuing operational maturity. The Cappitech acquisition by IHS Markit and onward to S&P Global Market Intelligence is now fully integrated (covered in the vendor refresh dispatch). Kaizen Reporting’s accuracy testing positioning remains the defensive procurement layer the Phase 2 review surfaced. MarketAxess Trax continues as the ARM and APA for MiFID II-scope operators with a fixed-income-heavy positioning that has not materially shifted.
Regulatory horizon scanning expanding to MiCAR-adjacent taxonomies. CUBE and Corlytics have both expanded their regulatory taxonomies to cover MiCAR implementation across EU member states. The procurement implication is that operators with multi-jurisdiction CASP plus CFD broker operations face a more complete regulatory intelligence product than the Phase 2 chapter described.
Trade surveillance: vendor mix shifts since Phase 2
The trade surveillance segment has continued evolving through 2025-2026 in three procurement-relevant ways:
Eventus Validus crypto-asset positioning continues strengthening. Eventus’s Phase 2 SOLID verdict held with cons noting strong crypto-asset coverage as a positive differentiator. Through 2025-2026 that positioning has solidified. The Cboe and NSX client base referenced in Phase 2 has expanded with additional crypto exchange deployments. The procurement-relevant implication is that hybrid operators running CFD plus crypto-asset venues face a Phase 3 procurement question Phase 2 did not anticipate: can a single trade surveillance vendor handle both the FX and CFD surveillance under MAR or CySEC equivalents AND the MiCAR Title VI crypto-asset surveillance? Eventus Validus is the strongest unified-vendor answer to that question. The Phase 2 SOLID verdict may move to STRONG PICK for hybrid and CASP archetypes; the verdict for pure CySEC CFD broker operators holds at SOLID.
Nasdaq SMARTS chain analytics integration extending. Nasdaq SMARTS’s Phase 2 STRONG PICK verdict held on the strength of 25+ regulator deployments and deep historical pattern library. Through 2025-2026 the product has integrated more deeply with on-chain analytics for the crypto-asset surveillance use case, enabling MiCAR Title VI coverage at tier-1 scale. The procurement implication is that Nasdaq SMARTS remains STRONG PICK at tier-1 scale across all four archetypes, with the crypto-asset surveillance extension closing the gap to Eventus Validus for operators with both CFD and crypto-asset surveillance requirements. At mid-market scale the choice between Eventus Validus and Nasdaq SMARTS in 2026 is closer than the Phase 2 review suggested.
NICE Actimize Xceed / SURVEIL-X enterprise-tier positioning unchanged. NICE Actimize’s Phase 2 SOLID verdict held with explicit framing as the integrated enterprise option rarely matching mid-market budgets. Through 2025-2026 the positioning has not materially shifted. Operators at the tier-1 enterprise scale with existing NICE relationships continue procuring NICE Actimize Xceed; mid-market operators continue selecting Eventus Validus or Nasdaq SMARTS depending on jurisdictional fit and crypto-asset surveillance requirements.
Chain analytics specialists. Chainalysis Reactor, Elliptic Lens, and TRM Labs are not Phase 2 chapter vendors (chain analytics was not a Phase 2 category) but have surfaced as procurement-relevant infrastructure layered alongside trade surveillance for VARA and CASP operators. The 2026 procurement-relevant question is whether these specialists are procured separately or whether bundled offerings from Chainalysis (KYT plus Reactor) or from competing vendors satisfy the operator’s MiCAR Title VI plus EU TFR plus VARA chain analytics requirements with fewer vendor relationships. The bundling is improving; standalone chain analytics procurement is increasingly the path only for tier-1 operators wanting best-of-breed across multiple chain analytics vendors.
Transaction reporting: Cappitech under S&P + the broker-CASP divergence
The transaction reporting segment has consolidated meaningfully and the broker-versus-CASP procurement divergence has crystallised:
Cappitech post-S&P Global integration. The S&P Global Market Intelligence integration is now operationally complete as the vendor refresh dispatch covered. The Phase 2 STRONG PICK verdict holds for CySEC and hybrid broker-side procurement. The procurement context shift is that Cappitech now operates under S&P enterprise contract templates with cross-sell paths into adjacent S&P products (ratings data, regulatory news, third-party risk). The MiCAR-adjacent cross-sell is the procurement-relevant 2026 question: S&P’s ratings and analytics products are not directly relevant to MiCAR Title VI surveillance but are increasingly bundled in commercial proposals to existing Cappitech customers. Operators should evaluate whether bundling delivers procurement value or constitutes upsell pressure.
Kaizen Reporting accuracy testing positioning unchanged. Kaizen’s Phase 2 SOLID verdict held with the explicit framing that accuracy testing exists as a separate procurement layer because the ESMA 2023 review found roughly 30% of MiFIR reports contain errors. Through 2025-2026 the positioning has not materially shifted. ESMA has continued issuing reporting accuracy guidance; the procurement relevance of Kaizen Reporting as a defensive layer over the primary reporting vendor remains the same.
MarketAxess Trax ARM and APA positioning. MarketAxess Trax’s Phase 2 SOLID verdict held with cons explicitly noting limited public product documentation at research date. Through 2025-2026 the product has not materially shifted in positioning. The procurement-relevant question remains the same: fixed-income operators procure Trax; FX-and-CFD-only operators procure Cappitech.
The broker-CASP transaction reporting divergence. The most procurement-relevant shift is structural rather than vendor-specific: CASPs do not procure transaction reporting vendors at all because MiCAR replaced MiFIR transaction reporting with Title VI market abuse surveillance plus Travel Rule recordkeeping. Operators running pure CASP operations skip the entire transaction reporting category; operators running hybrid CFD plus CASP face the procurement question of whether to maintain Cappitech for the CFD broker side only or to consolidate around a single regulatory operations vendor for both sides. The Phase 2 chapter framing did not anticipate this divergence because it preceded MiCAR full force.
Comms surveillance: Behavox + Smarsh positioning + off-channel expansion
The comms surveillance segment has continued evolving along the off-channel expansion vector that the CySEC dispatch flagged:
Behavox modern AI-driven coverage continues expanding. Behavox’s Phase 2 SOLID verdict held on the strength of modern AI and NLP coverage extending to mobile and collaboration platforms. Through 2025-2026 the product has continued expanding off-channel capture (WhatsApp Business, Signal, personal email exposure detection for designated employees) under FCA enforcement pressure that has not abated. The procurement-relevant 2026 question is depth: Behavox’s mobile capture coverage extends to corporate-managed devices and to personal device WhatsApp Business through opt-in deployments, but personal Signal exposure remains a gap that no comms surveillance vendor cleanly closes. Operators with significant personal-Signal exposure risk should evaluate whether vendor capability gaps are mitigated by alternative controls (clear desk policies, designated employee monitoring).
Smarsh incumbent positioning maintained. Smarsh’s Phase 2 SOLID verdict held with the Gartner MQ Leader 2025 third-party validation. Through 2025-2026 the positioning continues to lead on channel breadth (the Smarsh acquisition of Actiance in 2017 plus subsequent expansions covers the broadest channel set of any chapter vendor). The procurement-relevant 2026 question for operators is whether Smarsh’s email-and-mobile-first positioning closes the off-channel exposure gap as effectively as Behavox’s AI-NLP-first positioning. Operators with high-trade-volume desks and substantial conduct risk exposure may select Behavox; operators with broader retention requirements and lower-trade-volume client-facing operations may select Smarsh.
Off-channel exposure as a procurement filter. The most procurement-relevant 2026 shift is that off-channel comms exposure is now an explicit RFP question for hybrid and tier-1 operators rather than a category-level capability assumption. Operators should request vendor disclosure of their specific channel-by-channel capture capability (Microsoft Teams via API integration, WhatsApp Business through Meta’s Business API, Slack via SCIM, Bloomberg Terminal chat through the BLOOMBERG_INTEGRATION partnership, personal devices via opt-in mobile device management) and reconcile that against the operator’s actual conduct risk surface.
Travel Rule infrastructure: standalone procurement category
Travel Rule infrastructure was not a Phase 2 chapter category but surfaced in the Phase 3 CASP and DMCC plus VARA dispatches as a separate procurement decision adjacent to KYC. Through 2025-2026 the category has matured into a standalone procurement decision with explicit vendor positioning:
Notabene continues as the most-adopted procurement option for both EU CASP and UAE VASP operators wanting broad counterparty network coverage. The 2026 procurement question is counterparty reach: which VASPs in the operator’s expected transfer corridor are on the Notabene network and which are not. Operators with transfer flow concentrated on Notabene-network counterparties procure Notabene; operators with significant non-Notabene counterparty exposure face the procurement choice of parallel TR providers.
Sumsub TRP module continues as the bundled offering for operators wanting integrated KYC plus Travel Rule from a single vendor. The procurement-relevant 2026 question is whether the bundled commercial proposition delivers value or whether component-level procurement (Sumsub for KYC, Notabene for Travel Rule) is the better procurement decision. For lean CASP operators the bundled procurement is operationally simpler; for mid-market and tier-1 CASPs the component-level procurement often delivers better counterparty coverage.
TRP Network continues as the alternative network with different counterparty coverage breadth than Notabene. Some tier-1 CASPs run TRP Network as the secondary Travel Rule provider alongside Notabene as the primary, specifically to cover counterparties not present on the primary network.
Coinbase TRUST continues as the institutional-tier offering with strong counterparty coverage for large CASP and VASP relationships but with adoption skew toward US-aligned operators. EU CASP operators evaluating Coinbase TRUST should weight the counterparty coverage in their specific transfer corridors rather than the global network size.
The procurement-relevant 2026 shift is that Travel Rule infrastructure procurement is no longer a single-vendor decision. Mid-market and tier-1 CASPs commonly run two Travel Rule providers in parallel to close counterparty coverage gaps; the operational overhead is meaningful but is the only path to comprehensive coverage that EU TFR enforcement increasingly expects.
Regulatory horizon scanning: CUBE + Corlytics multi-jurisdiction expansion
The regulatory change intelligence segment has matured through 2025-2026 in MiCAR-relevant ways:
CUBE MiCAR taxonomy expansion. CUBE’s Phase 2 SOLID verdict held with the explicit framing as multi-jurisdiction regulatory intelligence appropriate for cross-border operators. Through 2025-2026 the MiCAR taxonomy has expanded to cover all EU member states with operational CASP regimes plus the ESMA technical standards layer. For operators with multi-jurisdiction CASP plus CFD broker operations the product is increasingly procurement-relevant; for single-jurisdiction operators the procurement value is narrower.
Corlytics post-ClauseMatch integration covered in the refresh. The ClauseMatch integration covered in the vendor refresh dispatch is operationally complete. The Phase 2 SOLID verdict holds; the procurement-relevant 2026 question is whether the combined regulatory intelligence plus policy mapping product delivers value as a single procurement or whether component-level procurement is appropriate. The licensing structure still differentiates the two heritages; operators using only one component should evaluate component-level procurement.
Three procurement implications for 2026 RegTech architecture
The above produces three concrete procurement implications:
Implication 1: The hybrid CFD plus crypto-asset surveillance question favours Eventus Validus more strongly than Phase 2 surfaced. Operators running hybrid operations (CySEC CFD plus VARA crypto, DMCC CFD plus VARA crypto, or CySEC CFD plus CASP under MiCAR) face the question of whether to run a single trade surveillance vendor across both sides or to maintain separate vendors. Eventus Validus’s strengthened crypto-asset positioning through 2025-2026 makes it the strongest single-vendor answer to this question at mid-market scale. Operators procuring trade surveillance in 2026 should explicitly evaluate the unified-vendor question rather than defaulting to per-side procurement.
Implication 2: Travel Rule procurement is increasingly a multi-vendor decision. Operators procuring Travel Rule infrastructure should treat the counterparty network coverage question as the primary procurement filter. Single-vendor procurement is operationally simpler but increasingly leaves coverage gaps that EU TFR enforcement expects to be closed. Mid-market and tier-1 CASPs should budget for parallel Travel Rule providers and the operational overhead of running two networks simultaneously.
Implication 3: Off-channel comms exposure is an explicit procurement requirement rather than a category-level capability assumption. Operators procuring comms surveillance in 2026 should request vendor disclosure of channel-by-channel capture capability and reconcile against the operator’s actual conduct risk surface. FCA enforcement focus on off-channel comms has not abated through 2025-2026; the procurement consequence of underspecifying channel coverage is regulator-facing rather than vendor-facing.
What comes next in the per-pillar series
Two per-pillar dispatches shipped (payments, RegTech). The remaining per-pillar candidates with built-up editorial signal:
- Crypto exchange white-label consolidation. The Phase 2 chapter surfaced LIMITED findings for Match-Trade Crypto and ETNA Software. The institutional crypto-native segment (ChainUp, AlphaPoint) is consolidating in ways that warrant chapter-level update. MiCAR’s CASP authorisation effect on the WL vendor positioning is also procurement-relevant.
- KYC and AML segment consolidation. Several pending KYC vendor mergers are expected to close in 2026 H2; a per-pillar dispatch covering the consolidated landscape will be appropriate once the M&A activity has settled.
- Liquidity provider procurement deep dive. Phase 2 covered the chapter at category level; a per-pillar dispatch covering specific LP relationship procurement (tier-1 prime broker access for mid-market operators, regional MENA LP procurement for DMCC operators, crypto LP procurement under MiCAR for CASPs) would deliver operator-actionable depth that the chapter alone does not.
Beyond per-pillar dispatches, the Phase 3 roadmap also includes the M&A and positioning refresh sub-series (the first refresh dispatch covered six events) and the new operator archetype dispatches (CASP plus CFD broker hybrid under EU regulation, ADGM FSRA institutional broker, LATAM or APAC CFD broker if procurement-relevant signal accumulates).
If you operate a broker or CASP stack and the RegTech framing above does not match your direct procurement reality, that is the editorial signal we are looking for. The corpus improves through ground-truth from operators.