Compliance is not one thing. It is bifurcating.
The global RegTech and compliance software market sits between $20 billion and $23 billion in 2026, scaling toward $85 billion by the mid-2030s at a 15% to 21% compound annual growth rate. Cloud-based deployments account for roughly 63% to 75% of the market. North America holds roughly 40% share. The numbers are real, the growth is real, and the regulatory tailwinds are real.
But treating the entire compliance stack as a monolithic beneficiary of regulatory complexity is an analytical error. Compliance is splitting into a compressing cost-center layer and a small number of genuinely rent-extracting moat layers. Which one you are looking at depends entirely on where in the stack you are.
The Causal Chain
Regulatory complexity alone does not create vendor lock-in. Complexity creates obligation. What creates lock-in is the accumulated institutional history that obligation generates over time.
The mechanism runs as follows: regulatory complexity forces mandatory, continuous infrastructure investment. That infrastructure accumulates institution-specific configuration, historical data, and audit history. Ripping it out means re-proving control effectiveness to examiners and auditors from zero. The switching cost becomes existential — a botched migration during an exam cycle is a career-ending event for a chief compliance officer, not an IT project. The vendor prices above commodity software rates because the buyer is not buying features; they are buying continuity of a trust relationship with a regulator. Rent is extracted.
The critical hinge in that chain is the middle step. A firm could in principle rebuild a policy engine from scratch relatively cheaply. What they cannot cheaply rebuild is five years of audit trail continuity, examiner familiarity with how their controls are documented, and the internal muscle memory of how they have always evidenced a given control. That is not a technology moat. It is a relationship and reputation moat that happens to be encoded in software.
Where the Rent Actually Sits
The compliance stack is not uniform. Different layers carry fundamentally different switching costs, and AI disruption is attacking them asymmetrically.
Regulatory intelligence and content layer. This is the layer that tracks what the rules are — Thomson Reuters, Wolters Kluwer-type providers. Moderate rent today, but this is the layer most exposed to erosion. Large language models are now competent at parsing regulatory text and mapping it to obligations, which is exactly the kind of interpretive labor these vendors used to sell at a premium. AI-native RegTech entrants are attacking this layer specifically because it is the most commoditizable by language models. The rent here is real but transient.
Policy and rules engine layer. This is where firms encode their own interpretation of rules into executable logic. High switching cost in practice due to years of accumulated custom rules, but low genuine differentiation between vendors. The rent here is mostly sunk-cost rent, not capability rent. This is also the layer that generic AI features are eating fastest, because generating and updating a rules configuration is close to what language models are naturally good at. Vendors selling only this layer are increasingly vulnerable.
Identity and financial-crime data layer. This is the strongest genuine moat in the stack. Know-your-customer screening, sanctions monitoring, adverse media databases, politically exposed person lists — players like NICE Actimize and Fenergo. The moat here has real network effects. The value of a sanctions and adverse-media database compounds with every institution feeding it signal, and no single competitor can replicate that data graph from scratch. Investment research this year has specifically called out companies like Broadridge and Veeva as retaining regulatory lock-in moats because of proprietary data plus workflow embedding, at a moment when they are explicitly downgrading other software holdings for eroding switching costs. This is where conviction belongs.
Audit trail and immutable logging layer. Rent here is behavioral, not technical. The artifact itself — an immutable log — is not hard to build. What is hard to displace is that examiners have learned to read a specific firm’s evidence format. Switching vendors means retraining your own examiner relationship, which nobody wants to risk. This is a soft, human-trust-mediated lock-in layered on top of a commodity technical capability. Real, but fragile.
Reporting and regulatory filing automation layer. This is where direct pipes into FinCEN, XBRL and SEC filing systems live. Highest genuine pricing power, because the switching cost is not just internal — it is certification with an external regulator’s own systems. Miswiring a filing integration is a compliance failure, not a software bug. Buyers pay a premium specifically to avoid touching this layer once it works. This is the other edge of the barbell.
The Barbell Is Forming
The correct model is not “compliance as moat” or “compliance as cost center.” It is a barbell. Durable rent is concentrating at the data-network edge and the regulator-interface edge. The middle of the stack — case management, rules configuration, generic dashboards, regulatory intelligence — is getting commoditized fast enough that vendors selling only that layer are structurally vulnerable.
The data supports this. NICE Actimize holds roughly 15% to 17% of the dedicated anti-money-laundering and financial crime software market, and its position is defensible because it sits at the data-network edge. Fenergo dominates the corporate and institutional banking client lifecycle management space for the same reason — proprietary entity-structure data that compounds with scale. Broadridge operates primarily as capital markets infrastructure with regulatory reporting embedded, which gives it a different but equally defensible profile.
Meanwhile, the vendors selling generic governance, risk, and compliance dashboards are racing to the bottom. Traditional GRC software vendors have rushed to add AI modules that do little more than convert static regulatory text into digital checkboxes. Because basic automated mapping is easy to replicate, point solutions that only offer surface-level regulatory tracking are seeing margins compress.
The Regulatory Capture Angle
The moat thesis is real for the data-network and regulator-interface layers. But it is worth holding an uncomfortable truth alongside it: the regulatory complexity generating the moat is not always legitimate risk-management complexity. Where it is not — where complexity is itself partly a product of compliance vendors and large incumbents lobbying for rules only they can economically absorb — the moat and the regulatory capture story become the same story told from two angles.
Large, established corporations use lobbying to shape regulatory frameworks. They push for hyper-detailed, intricate rules under the guise of safety and consumer protection. Regulatory agencies, often underfunded and lacking technical parity with the industries they oversee, rely on regulated incumbents or specialized outside parties to draft technical standards. The resulting web of complex rules creates an enormous administrative burden that only specialized third-party compliance vendors can manage. Incumbent firms leverage this ecosystem to extract economic rewards not by creating better products or competing efficiently, but by manipulating the social and political environment.
Compliance vendors and dominant corporations often work in tandem with lawmakers. A vendor might lobby for stricter data-privacy or reporting standards because it knows it will instantly spike demand for its proprietary software. The compliance-industrial complex is not an accidental byproduct of regulation. It is a deliberate feature of it.
This does not invalidate the moat thesis. It deepens it. The moat is real, but understanding its origins — and recognizing when you are looking at genuine risk-management infrastructure versus rent-extracting regulatory capture — is what separates analytical signal from institutional packaging.
Implications
The barbell has clear implications. The data-network edge (financial-crime data platforms, sanctions and adverse-media databases with compounding network effects) and the regulator-interface edge (filing automation, certification-layer integrations) carry durable pricing power. The middle of the stack (generic GRC dashboards, rules engines, regulatory intelligence) is being actively compressed toward cost-center status.
Position accordingly. Conviction belongs where the switching cost is existential and the data graph compounds with scale. It does not belong where the moat is a dashboard and the differentiation is a checkbox.