Regtech companies sell software to firms that live under regulators. Your customer is a bank, a payments firm, an investment manager, an insurer, a law firm or a crypto business. Your product helps them onboard customers, screen names, monitor transactions, file regulatory reports, track policies, or evidence their controls. You are not regulated the way they are. But when your product fails, the client's regulatory problem quickly becomes your contractual problem.

This guide is for UK regtech and compliance-software startups: KYC and onboarding platforms, AML screening and transaction monitoring, regulatory reporting tools, governance, risk and compliance (GRC) software, communications surveillance, Consumer Duty and conduct analytics, and regulatory change or horizon-scanning products, including AI-driven ones. It explains which insurance a regtech vendor needs, why regulated clients write their regulator's rules into your contract, and how to make sure your policies respond when a client says your software let them down.

If you are the regulated firm yourself (an EMI, a payments institution, a lender, an investment platform), this isn't your page. Read Fintech Insurance UK for the wider programme, and PSD2 Insurance UK if you need the professional indemnity certificate for AISP or PISP permissions. This page is about the supplier side: the business of selling compliance software to regulated firms.

Mesh'd Limited trading as Meshed is authorised and regulated by the Financial Conduct Authority under firm reference number 1033248. We arrange cover from the insurers on our panel and charge a flat 10% broker fee, with no admin add-ons. We don't publish prices, because regtech risk depends on what your product decides, who relies on it, and what your contracts say. Named customer quotes are off.

The short answer

Most UK regtech startups need technology professional indemnity (tech E&O) as the core policy, because the main allegation against you will be that your software or service didn't do what the client relied on it to do. Next to it:

• Cyber, because you hold some of the most sensitive data in financial services: identity documents, screening results, suspicious activity indicators, transaction data.

• Directors' and officers' (D&O), once you have investors, a board, or a regulated client asking who is accountable.

• Employers' liability, a legal requirement once you employ staff, with a minimum of £5 million.

• Crime, if staff can move money or if a payment-diversion fraud against your own business would hurt.

• Public liability, usually a small line unless you visit client sites or run events.

The detail that makes regtech different is simple: your client stays legally responsible for compliance even when they use your product, so they will want your contract, and your insurance, to stand behind what your software does.

Regtech, fintech, or neither? A quick sorting test

Before anything else, work out which bucket an underwriter will put you in. It changes which wording fits.

1. Do you hold client money, issue e-money, provide payment services, lend, or arrange investments? If yes, you are probably a fintech in your own right, and you need the regulated-firm programme on Fintech Insurance UK. Some firms are both.

2. Do you need FCA authorisation or registration for what you do? Under section 19 of the Financial Services and Markets Act 2000, no one may carry on a regulated activity in the UK unless they are authorised or exempt. Selling compliance software isn't usually a regulated activity in itself, but products that edge into advice, arranging, payment initiation or account information can be. If you're unsure, get legal advice before you buy insurance, because the answer changes the wording you need.

3. Do your clients use your output to make a regulatory decision? For example, accept or reject a customer, raise or close an alert, file a report, or sign off a control. If yes, you are a regtech vendor with decision-support exposure, and tech PI is your main policy.

4. Does a human at the client always review your output before acting? That doesn't remove your exposure, but it changes how a claim is argued, and underwriters will ask.

5. Are you an AI product? If your product uses machine learning or generative AI to classify, summarise or recommend, also read AI Insurance for UK Startups.

Most regtech startups answer "no" to the first two questions and "yes" to the third. That is the profile this page covers.

What your clients rely on you for, and how it goes wrong

Different regtech products fail in different ways. This table maps common product types to the allegation a regulated client would make and the policy that should respond.

Two things stand out. First, nearly every row is a professional liability claim, not a cyber claim. Second, the client's loss usually isn't just "the software didn't work". It's remediation projects, look-back reviews, external consultants, extra staff, and sometimes the cost of dealing with their regulator. Those are large, slow-building losses, which is why your PI limit and wording matter more than almost anything else.

Why your client's regulator ends up in your contract

Regulated firms can outsource work, but they can't outsource responsibility. The FCA's outsourcing rules in SYSC 8 say that a firm which outsources critical or important operational functions remains fully responsible for discharging its obligations under the regulatory system. The Money Laundering Regulations 2017 take the same line where a firm relies on a third party for customer due diligence: under regulation 39, the relevant person remains liable for any failure to apply those measures.

So your client can't point at you and tell the FCA it was the vendor's fault. What it can do is make sure the contract with you gives it rights, information and a remedy. That's why regtech MSAs look the way they do.

For larger investment firms (what the FCA calls common platform firms), SYSC 8.1.8R lists conditions that outsourcing must meet. They include:

• the service provider has the ability, capacity and any authorisation required to perform the functions reliably and professionally;

• the provider discloses any development that may have a material impact on its ability to perform;

• the firm can terminate the arrangement where necessary, with immediate effect when that is in its clients' interests, without detriment to continuity;

• the provider co-operates with the FCA;

• the firm, its auditors and the FCA have effective access to data and to the provider's business premises where needed for oversight;

• the provider protects confidential information;

• there is a contingency plan for disaster recovery and periodic testing of backup facilities where necessary.

Banks and insurers regulated by the PRA follow the PRA's supervisory statement SS2/21 on outsourcing and third-party risk management, which sets similar expectations. Many firms also run FCA operational resilience programmes. Firms in scope had until 31 March 2025 to make sure they could stay within impact tolerances for their important business services. If your product sits inside one of those services, the client will want to know how you recover from disruption.

Two newer developments will reach regtech vendors through client contracts:

• FCA incident and third-party reporting. The FCA published new operational incident and third-party reporting requirements on 18 March 2026, coming into force on 18 March 2027. Expect regulated clients to ask suppliers for faster incident notice and more information about material arrangements.

• EU clients and DORA. If you sell to financial entities in the EU, the EU Digital Operational Resilience Act (Regulation (EU) 2022/2554) applies to them. Article 30 lists key provisions their ICT contracts must include, such as service descriptions, data locations, data access and return on insolvency or termination, incident assistance at no extra cost or a cost set in advance, co-operation with authorities, and termination rights. DORA is EU law, not UK law, but UK suppliers to EU firms will see it in their paper.

There is also a UK regime for critical third parties. Under section 312L of FSMA 2000, HM Treasury can designate a supplier as a "critical third party" if a failure in its services could threaten the stability of, or confidence in, the UK financial system. That's aimed at very large providers, not startups, but it shows where the regulatory direction is heading.

None of this makes your company regulated. It makes your contracts heavier, and your insurance has to match them.

Clause by clause: the regulated-client MSA

Here are the clauses that show up most often in contracts between regtech vendors and banks, payments firms and other regulated clients, with what each means for your insurance.

"The Supplier shall maintain professional indemnity insurance of not less than [£X] for each and every claim, for the term and for six years after." This is the most common insurance clause. Check three things: whether your policy is "each and every claim" or "in the aggregate" (they're different), whether you can realistically buy cover for the run-off period after the contract ends, and whether the limit matches your exposure across all clients, not just this one. Tell us before you sign so the limit is achievable.

"The Supplier shall indemnify the Customer against all losses arising from any breach of the Supplier's obligations." A broad indemnity can take you beyond what the law would otherwise award, and beyond what your PI policy will pay. Many PI wordings exclude liability you have taken on by contract unless you would have had it anyway. Negotiate the indemnity down to specific risks (IP infringement, data protection breach caused by you) and keep everything else under the normal liability cap.

"The Supplier's liability shall be unlimited in respect of data protection breaches and breaches of confidentiality." Uncapped carve-outs are common in regtech because you hold sensitive data. Your cyber and PI policies have limits, so an unlimited promise is backed by your balance sheet beyond them. Push for a "super-cap", a separate higher cap for data claims, set at a level your insurance can actually support.

"The Supplier shall reimburse any fines or penalties imposed on the Customer by a regulator." Treat this as a red flag. Regulators fine your client for your client's failures. Many insurance wordings exclude fines and penalties, and whether a regulatory fine can be passed to a supplier as damages is a contested legal question. Don't sign a promise your insurance almost certainly won't stand behind. Offer to cover the costs of remediation that your fault caused instead.

"The Supplier warrants that the Services will comply with all Applicable Laws and Regulatory Requirements." This turns your client's regulatory obligations into your warranty. Narrow it to laws that apply to you as a software supplier, plus an obligation to provide the functionality described in the specification. Your product can support compliance; it can't guarantee it.

"The Supplier shall notify the Customer of any incident within [X] hours." Make sure your incident response plan can hit the deadline and that your cyber insurer's response panel can be used for it. Tight notice windows are becoming more common as regulated firms face their own reporting duties.

"The Customer, its auditors and any Regulator shall have rights of audit and access." This comes from the outsourcing rules above. It isn't an insurance issue as such, but audits produce findings, and findings can lead to disputes. Keep a record of everything you are asked and what you provided.

On reasonableness: under the Unfair Contract Terms Act 1977, where one party deals on the other's written standard terms, contract terms that exclude or restrict liability for breach must be reasonable (section 3). Where a term restricts liability to a specified sum, section 11(4) says the court must have regard to the resources available to meet the liability and how far it was open to the party to cover itself by insurance. In plain English: your insurance position can be part of how a court judges whether your liability cap is fair. That's a good reason to set caps by reference to the insurance you actually hold.

For the evidence side of these negotiations, such as certificates, security questionnaires and how to answer insurance questions in procurement, see MSA and Security Questionnaire Insurance Evidence for UK Startups.

Tech PI for regtech: what to check in the wording

Not every tech PI policy fits a compliance product. When you review a quote, check these points.

• Financial services exclusions. Many technology wordings exclude claims connected with financial services. That makes sense for a generic software house, but your entire customer base is financial services. Make sure any exclusion is limited to you providing financial services, not to you selling software to financial firms.

• Business description. "Software development" is not the same as "provision of AML screening and transaction monitoring software and related managed services". If you also run a managed review service (for example, analysts who clear alerts on the client's behalf), say so. That's a professional service, and it needs to be declared.

• Fines and penalties. Most wordings exclude fines. Check what happens to the client's costs of dealing with its regulator, which are often claimed as damages.

• Contractual liability. As above, check whether liability you take on only because of contract terms is excluded.

• Product failure, not just advice. The policy should cover failure of your technology to perform, including faulty updates, not just negligent advice.

• Data and list providers. If your screening depends on third-party data feeds, check how the policy deals with claims caused by a supplier's error.

• AI outputs. If a model classifies or summarises, check that the wording doesn't exclude errors from automated decision-making or AI-generated content.

• Territory and jurisdiction. If you sell to EU or US clients, confirm the policy covers claims brought there.

• Retroactive date. PI is usually written on a claims-made basis. Losses from a missed alert can surface years later, so keep continuous cover and don't lose your retroactive date when you switch.

For the product basics, see Professional Indemnity Insurance UK.

Cyber: you hold the data criminals want

Regtech products concentrate high-value data: passport and driving licence images, selfies and liveness checks, dates of birth and addresses, screening hits, internal risk ratings, and sometimes suspicious activity indicators. That makes you a target, and a breach at your end can affect dozens of regulated clients at once.

Under UK GDPR you are usually a processor for your clients' customer data. Article 28 requires controllers to use only processors that provide sufficient guarantees of appropriate technical and organisational measures. Article 32 requires security appropriate to the risk. Article 33(2) requires a processor to notify the controller without undue delay after becoming aware of a personal data breach. Under Article 82(2), a processor is liable for damage caused by processing where it hasn't complied with obligations directed at processors or has acted outside or contrary to the controller's lawful instructions.

A good cyber policy for a regtech vendor should cover:

• incident response: forensics, legal advice, notification costs and crisis communications;

• business interruption if your platform goes down, including dependent business interruption if a cloud provider fails (check the wording);

• data restoration;

• extortion and ransomware response, subject to the law;

• privacy and network security liability, for claims from clients and data subjects;

• regulatory investigation costs where insurable.

The overlap between cyber and tech PI matters a lot for regtech. If a breach of your platform exposes client data and also stops your screening service working, the client may bring one claim that mixes data loss and service failure. A combined tech PI and cyber policy with one insurer avoids two insurers each pointing at the other. If you buy them separately, check them against each other. More on cyber as its own class: Cyber Insurance UK. On downtime: SaaS Business Interruption Insurance for UK Startups.

D&O, crime and the rest of the programme

Directors' and officers' insurance. Regtech founders face the usual D&O risks (investor disputes, insolvency, employment-related claims, regulatory investigations), plus one extra: clients and investors may scrutinise statements about what your product can do. If a regulated client's board relied on your claims about detection rates or accuracy, a dispute can become personal. Section 232(2) of the Companies Act 2006 makes void any provision by which a company indemnifies a director against liability for negligence, default, breach of duty or breach of trust in relation to the company, except as the Act permits. Section 233 permits the company to buy and maintain insurance for its directors against that liability. That's the legal basis for D&O. See Directors and Officers Insurance UK.

Crime. Regtech companies are not usually holding client money, but your own finance team can still be targeted by invoice fraud and impersonation. If you run a managed service with access to client systems, ask whether third-party crime cover is needed. More: Crime and Fidelity Insurance for UK Startups.

Employers' liability. If you employ anyone, you generally need EL from an authorised insurer with a limit of at least £5 million, under the Employers' Liability (Compulsory Insurance) Regulations 1998. See Employers' Liability Insurance UK.

Employment practices liability. Useful once you're hiring quickly, particularly compliance specialists who change jobs often. See Employment Practices Liability Insurance for UK Startups.

Worked example: a seed-stage KYC startup's first bank contract

This is an illustrative example, not a real client.

The company. Eight people, seed-funded, selling an identity verification and onboarding product to fintechs. A mid-sized UK bank wants to pilot it for small business account opening.

Month 1: procurement. The bank's third-party risk team sends a questionnaire with 200 questions, including insurance limits, data locations, sub-processors, business continuity, and whether the company has had any incidents. The draft MSA asks for PI of a set amount per claim, cyber of a set amount, a six-year run-off commitment, unlimited liability for data protection breaches, and an indemnity for "any regulatory fines".

What they had. A generic tech PI policy bought at incorporation, with a lower limit and a business description of "software development". No cyber. No D&O.

What changed.

1. The business description was rewritten to describe identity verification and onboarding decisions for regulated firms, including the optional manual review service.

2. The PI wording was checked for a financial services exclusion. The original one excluded claims "arising out of financial services", which could have caught the whole product. A wording without that problem was needed.

3. Cyber was added, combined with PI, so a breach that also broke the onboarding flow would be handled by one insurer.

4. The founders went back to the bank with a counter-proposal: a super-cap for data protection claims at the cyber limit, deletion of the fines indemnity in exchange for a remediation-costs clause, and a run-off commitment of "reasonable endeavours to maintain cover" rather than an absolute promise.

5. D&O was added before the next funding round, because the lead investor's term sheet asked for it.

The result. The bank accepted the super-cap and the remediation clause. The pilot started with insurance that matched the contract, and the founders knew where their uninsured exposure sat.

The lesson: buy insurance after you've read the contract, and negotiate the contract knowing what insurance can do.

How underwriters look at a regtech business

Expect questions on:

• What your product decides. Does it make or recommend decisions (accept, reject, alert, file), or just store information?

• Who relies on it. Types of clients, how regulated they are, and how many are banks or large institutions.

• Human review. Whether clients review outputs before acting, and whether you offer a managed review service.

• Revenue split. By product, client type and territory.

• Contracts. Your standard terms, typical caps, any uncapped liabilities, and any indemnities for fines.

• Data. What personal data you hold, where it's hosted, how long you keep it, and your sub-processors.

• Security. Multi-factor authentication, privileged access management, backups, logging, vulnerability management, penetration testing, and certifications such as ISO 27001 or SOC 2. If a client requires Cyber Essentials, the NCSC scheme covers five technical controls, and Cyber Essentials Plus adds independent technical testing.

• Change control. How you release updates to rules, models and lists, and how you test them before they go live.

• Data feeds. Which third-party data you depend on (sanctions lists, registries, credit data) and what happens if a feed fails.

• Incidents and complaints. Anything that has gone wrong, even if no claim followed. Under the Insurance Act 2015 you have a duty to make a fair presentation of the risk, which includes disclosing every material circumstance you know or ought to know.

If you're preparing for a buyer's security review, our SaaS SOC 2 / ISO Buyer Insurance Questionnaire Pack helps you put the insurance answers together.

Setting limits without guessing

There's no standard limit for regtech, and we won't pretend there is. These are the factors that drive the decision:

• Your largest contract's insurance clause. This sets the minimum.

• The worst realistic remediation project. If your screening failed for six months across all clients, what would the look-back and remediation cost them? That's the claim you're protecting against.

• Aggregation. One faulty rule update can affect every client at once. If your PI limit is "in the aggregate", one event could use it all up. Ask how related claims are treated.

• Run-off. If you promise cover for years after a contract ends, your future limits matter too.

• Excess layers. If a bank wants a higher limit than a primary insurer will offer a startup, an excess layer on top can bridge the gap.

Talk to us before you agree the limit in a contract. It's much easier to negotiate a number you know is achievable.

Common mistakes regtech founders make

• Buying generic software PI with a financial services exclusion. It can quietly exclude your whole market.

• Agreeing to reimburse regulatory fines. It's often not insurable and shifts the client's own regulatory risk to you.

• Forgetting the managed service. If your team reviews alerts or verifies documents for clients, that's a professional service that needs to be declared.

• Treating cyber as optional. You hold identity and financial crime data; clients will ask for it, and a breach could affect all of them.

• Signing unlimited data liability. Use a super-cap linked to insurance you can buy.

• Letting the retroactive date reset. A missed-alert claim can surface years after the event.

• Not telling the insurer about AI. A move from rules to models changes the risk. Declare it.

FAQs

What insurance does a regtech startup need in the UK?

Usually technology professional indemnity as the core policy, with cyber, D&O once you raise money, and employers' liability once you employ staff. Crime and public liability depend on how you operate. The exact mix depends on what your product decides and what your client contracts require.

Is regtech insurance the same as fintech insurance?

No. Fintech insurance is built for firms that provide a financial product themselves and are often regulated. Regtech vendors sell software and services to those firms. Your main exposure is professional liability for your software. If you do both, you may need the fintech programme instead. See Fintech Insurance UK.

Do regtech companies need to be FCA authorised?

Not usually. Selling compliance software isn't normally a regulated activity in itself. But section 19 of FSMA 2000 prohibits carrying on a regulated activity without authorisation or exemption, and some products get close to regulated activities. Take legal advice if you're unsure.

Will my PI cover a client's FCA fine?

Probably not. Most wordings exclude fines and penalties, and recovering a regulatory fine from a supplier raises difficult legal questions. Your PI is more likely to respond to the client's remediation costs and other losses caused by your negligence, subject to the wording. Avoid contract clauses that promise to reimburse fines.

Our bank client wants audit and access rights. Does that affect insurance?

Not directly. Those rights usually come from the client's own outsourcing obligations, such as the FCA's SYSC 8 rules. They do increase scrutiny, so keep good records. Insurers may ask about major client audits in your proposal.

We sell to EU banks. Does DORA apply to us?

DORA applies to EU financial entities, not directly to most UK software suppliers. But Article 30 sets out what their ICT contracts must contain, so you'll see those requirements in your contracts. Make sure your insurance and incident response can support what you agree.

Do we need cyber insurance if we're hosted on a major cloud platform?

Yes. Cloud hosting doesn't cover your own incident response costs, your liability to clients, or a breach caused by compromised credentials or misconfiguration on your side. Check how the policy treats outages at your cloud provider.

Can you help a sole-trader compliance consultant who has built a software tool?

Talk to us. Sole traders are in scope for many covers, and we'll tell you what the insurers on our panel can offer for your specific mix of consultancy and software.

Talk to us

If you sell compliance software or services to regulated firms and want your PI, cyber and contracts lined up, speak to us. Bring your standard terms, your largest client's draft MSA, and a short description of what your product decides for clients. We'll tell you what the insurers on our panel will need and where your gaps are.

Mesh'd Limited t/a Meshed / Meshed Cover · FCA FRN 1033248 · flat 10% broker fee · limited companies, partnerships and sole traders · no fake prices · Speak to us