T-NEX
Menu
DEEN
GRC provider register · Category 3 of 11

GRC software for regulatory intelligence & AML:
88 providers with AI classification.

In short: The T-NEX GRC provider register lists 88 providers for regulatory change and anti-money laundering, as of 18 October 2026. Of these, 86 document specific AI functions (98%), most often for analysing regulatory change. In Germany, Austria or Switzerland, 18 have a documented headquarters, twelve of them in Germany.

By and Published: As of: · Category page of the GRC provider register Reviewed by Andreas Unruh and Christoph Gembruch, managing directors of T-NEX GmbH, on
Illustration: globe with networked GRC providers whose AI evidence flows into a checked provider register

Neither completeness nor a general suitability for banks is claimed. Providers are listed alphabetically. The order is not a performance rating.

All 682 GRC providers in the market overview · 379 European GRC providers

Publisher: T-NEX GmbH. Andreas Unruh and Christoph Gembruch are managing directors of T-NEX. This editorial market overview is based on vendor sources and specialist primary sources. It contains no ranking and is not based on a joint product test. The market overview covers 682 providers from GRC and adjacent specialist areas. Acquired brands and former product names are not counted separately. Methodology and sources

Context

What does regulatory intelligence software do?

Regulatory intelligence software tracks what legislators and supervisors publish and turns relevant changes into an obligation inventory, a discipline often called regulatory change management (RCM). The category also holds anti-money laundering (AML) tools for transaction monitoring, sanctions and PEP screening (politically exposed persons) and know-your-customer (KYC) checks. Regulatory analysis and anti-money laundering barely overlap in the register: almost no entry documents AI for both. A few entries also monitor trading activity and employee communications for breaches of rules. The United Kingdom accounts for 13 entries, about as many as Germany.

  • No specific AI function in the sources checked: 2 entries
  • Documented AI use cases by topic, an entry can count more than once: Analysing regulatory change (20) · AML monitoring and case work (17) · Deriving obligations from regulations (17) · Sanctions and PEP screening (16) · Answering regulatory questions (13)
  • Documented headquarters in Europe: 61 of 88 providers, headquarters not separately checked: 13
  • Full entries on 2 alphabetical subpages

Questions for the demo, derived from the five criteria of the comparison:

  • Does a detected regulatory change get an owner, a measure and a deadline in the tool?
  • Does a subject-matter expert review every obligation derived by AI before it counts in the obligation inventory?
  • Does a report for the management board name the version of the rules and the assessment on which it is based?

Where does the duty to monitor regulation come from?

From MaRisk AT 4.4.2 para. 2: at regular intervals and taking risk into account, the compliance function identifies the material legal rules and requirements whose breach could endanger the institution's assets. Under para. 1 it works towards effective procedures and controls for complying with them. A monitoring tool supplies sources and drafts; deciding what is material stays with the compliance function.

What obligations does Section 25h KWG set for transaction monitoring?

Under Section 25h(2) KWG, credit institutions must operate and update data processing systems that identify business relationships and individual payment transactions which, compared with similar cases, are particularly complex or large, unusual, or without an obvious economic or lawful purpose. Under para. 3, such transactions must be investigated and documented. BaFin may set criteria under which credit institutions can dispense with such systems (para. 2 sentence 3). From 10 July 2027, Art. 26 of the EU Anti-Money Laundering Regulation (AMLR) directly governs the ongoing monitoring of business relationships and transactions.

May AI decide on its own in anti-money laundering?

From 10 July 2027, not on customer relationships without human intervention. Art. 76(5) AMLR then allows decisions resulting from automated processes and AI systems only on conditions: the systems process only data obtained under the customer due diligence rules of Chapter III, and decisions to enter into, refuse or maintain a business relationship, on occasional transactions and on the extent of customer due diligence are subject to meaningful human intervention. Customers may obtain an explanation and challenge the decision, except in relation to a report under Art. 69 AMLR. Independently of this, Art. 22(1) GDPR already applies to decisions concerning natural persons that are based solely on automated processing and produce legal effects or similarly significantly affect them.

Which providers of GRC software for regulatory intelligence & AML are headquartered in Germany, Austria or Switzerland?

Of the 88 providers, 18 have a documented headquarters in Germany, Austria or Switzerland: in Germany ACTICO, ASC Technologies, Certivity, Conformis, Harpocrates Solutions, Hawk, Leegle, LegalTegrity, Polzia, PROXORA, Regnology and Sinpex; in Switzerland cmpliance, IMTF, Legartis, Obsidian Regulatory Intelligence, Polixis and Vyntra. For 13 further providers, the headquarters has not been checked separately; they are not included in this list. Headquarters means the seat of the provider entity named in the entry, documented by the entry's location source (imprint, legal texts, official contact and company pages, occasionally official registers); it says nothing about ownership, hosting or data storage.

Regulatory framework.

  • MaRisk AT 4.4.2, BaFin Circular 06/2026 (BA): regular identification of material legal requirements by the compliance function, which works towards effective procedures and controls for complying with them (Source: BaFin, in German)
  • Section 25h(2) KWG (German Banking Act): data processing systems to identify unusual business relationships and transactions (Source: gesetze-im-internet.de, in German)
  • Art. 20, 26 and 76 AMLR (Regulation (EU) 2024/1624): sanctions and PEP checks, ongoing monitoring and human intervention in automated decisions, applicable from 10 July 2027 (Source: EUR-Lex)

Further reading on t-nex.de: Regulatory roadmap 2026 to 2028, EU AML package, Sanctions screening, and T-NEX for compliance and AML teams.

All 88 entries by subpage.

Each entry: name linking to the full entry, in brackets the ISO 3166 country code of the provider headquarters, where documented, and the AI status: AI evidenced = Specific AI functions documented; AI announced = Announced or in development; AI not evidenced = Not specifically documented in the source check; AI open = Source check still pending.

Is a provider missing or an entry out of date? Send us a note with a source via the contact form. Accepted changes are marked in the entry with the date they were checked.

Part 1: Digits to L

47 entries

Part 2: M to Z

41 entries

Publisher's own offering

T-NEX as publisher.

Register entry: T-NEX Banking Platform (DE, AI evidenced)

Regulations enter T-NEX Compliance by upload or from a configured source, with each edition kept as a separate version. The source view places recognised clauses beside the original. From confirmed clauses, the AI proposes requirements with an expected control measure, and business owners check the source reference before the requirements collection is approved. Earlier editions remain available together with their requirements, and changed regulations can appear as a separate work queue. T-NEX Fraud Detection checks transactions against nine rule types, including AML indicators. The AI triage also states the model and prompt version it used.

Register entry of the T-NEX Banking Platform (data as of 18 October 2026) · T-NEX Compliance · T-NEX Fraud Detection