Competition Law and Regulatory Technology Ecosystems

1. Introduction

A regulatory technology ecosystem (RegTech ecosystem) is the network of technologies, businesses, regulators, data providers, financial institutions, compliance professionals and digital infrastructure used to monitor, enforce and comply with legal and regulatory obligations.

In competition law, regulatory technology can help authorities identify cartels, detect bid-rigging, investigate algorithmic pricing, screen mergers, monitor digital platforms and assess market concentration. However, the same ecosystem can generate competition concerns when a small number of technology providers control essential compliance software, market data, analytics infrastructure or automated decision-making systems.

The central question is therefore twofold: How can technology improve competition-law enforcement, and how can competition law prevent regulatory technology markets from becoming concentrated or exclusionary?

Regulatory technology ecosystems are particularly significant in digital markets, financial services, cloud computing, artificial intelligence, online platforms, cybersecurity and automated compliance services.

2. Meaning and characteristics of regulatory technology ecosystems

A regulatory technology ecosystem comprises several interconnected layers.

Regulatory authorities

Competition agencies, financial regulators and sectoral authorities

RegTech infrastructure

AI analytics · Data platforms · Compliance software · Cloud services · Digital reporting systems

Regulated enterprises

Banks, platforms, manufacturers and service providers

Market participants

Competitors, suppliers, consumers and independent innovators

Conceptual model: data, software and regulatory decisions interact across the ecosystem.

The principal characteristics are:

Data dependence: effective compliance and enforcement depend on access to reliable, timely and sufficiently detailed data.

Network effects: a platform may become more valuable as more businesses, regulators or data sources use it.

Economies of scale: large providers can spread software development, security and compliance costs across many clients.

Interoperability: systems must exchange data and communicate through APIs, common formats or compatible interfaces.

Algorithmic decision-making: AI systems can flag suspicious conduct, rank risks and generate enforcement leads.

Regulatory dependence: mandatory reporting or certification requirements may create captive demand for particular providers.

Switching costs: proprietary formats, historical data and integration requirements can make changing providers expensive.

These characteristics can improve efficiency while also creating barriers to entry and opportunities for exclusionary conduct.

3. Legal framework governing RegTech ecosystems

Competition law does not generally prohibit large technology providers or automated compliance systems merely because they are efficient or widely adopted. It addresses conduct that satisfies the applicable legal tests for anticompetitive agreements, abuse of dominance, merger control or other prohibited practices.

A. Anticompetitive agreements

Businesses that develop regulatory technology may unlawfully coordinate prices, divide customers, restrict innovation or exchange competitively sensitive information.

For example, competing compliance-software vendors could agree on minimum subscription prices or agree not to recruit each other's specialist engineers.

In the European Union, Article 101 of the Treaty on the Functioning of the European Union (TFEU) prohibits agreements and concerted practices that restrict competition, subject to applicable exemptions. Comparable rules exist in other jurisdictions.

B. Abuse of dominance

A dominant provider of regulatory data, compliance infrastructure or cloud-based monitoring services may engage in abusive conduct through:

Refusal to provide access to an indispensable input, where the demanding legal conditions are satisfied.

Exclusive contracts that foreclose competing providers.

Discriminatory access or interoperability conditions.

Unlawful tying or bundling of compliance tools.

Predatory pricing or exclusionary rebates.

Using privileged information obtained through a regulatory role to disadvantage rivals.

Dominance itself is not unlawful. The relevant question is whether conduct by a dominant undertaking constitutes an abuse under the applicable legal framework.

C. Merger control

Acquisitions of compliance software companies, regulatory-data aggregators, AI analytics firms or specialist cybersecurity providers may eliminate emerging competitors or strengthen control over essential inputs.

Authorities should consider not only current market shares but also innovation competition, potential entry, access to data, customer switching costs and the strategic importance of the acquired technology.

D. Data protection, cybersecurity and regulatory governance

RegTech operations may also be subject to privacy, cybersecurity, sector-specific reporting and administrative-law requirements. These obligations can overlap with competition law.

A regulatory mandate should not automatically be treated as proof that a market restriction is justified. Authorities must examine the scope of the mandate, the available alternatives and whether the restriction is legally attributable to the state or independently chosen by an undertaking.

4. At least eight important case laws

The following cases are not all direct disputes about RegTech vendors. They are important analogies and precedents concerning digital ecosystems, data access, interoperability, platform control and exclusionary conduct—issues that can arise within regulatory technology markets.

Case 1: Microsoft Corp. v Commission (2007)

Court: Court of First Instance of the European Communities, Case T-201/04.

Facts: Microsoft was found to have abused its dominant position, including by refusing to provide interoperability information needed by competing work-group server operating systems and by tying Windows Media Player to Windows.

Legal principle: A dominant undertaking's control over technical interfaces and interoperability information may raise competition concerns when it prevents competitors from developing or supplying viable alternatives.

Relevance to RegTech: A dominant regulatory software provider might control the interfaces needed to connect compliance systems with banks, businesses or regulatory reporting platforms. If it restricts access in a manner that unlawfully forecloses competition, competition-law intervention may be warranted.

Significance: The case illustrates why interoperability can be essential to competitive entry, while also demonstrating that compulsory access must be assessed against the applicable legal requirements.

Case 2: Google LLC and Alphabet Inc. v European Commission (Google Android) (2022)

Court: General Court of the European Union, Case T-604/18, judgment of 14 September 2022.

Facts: The Commission's decision concerned Google's Android ecosystem, including contractual restrictions, pre-installation arrangements, exclusivity payments and anti-fragmentation obligations. The General Court largely upheld the Commission's findings, while reducing the fine.

Legal principle: Competition authorities may examine the combined effects of several contractual practices across interconnected digital markets rather than treating each arrangement in isolation.

EUR-Lex

+1

Relevance to RegTech: A provider offering regulatory reporting, identity verification, risk analytics and audit software might use bundled services or exclusive contracts to entrench its position across several related markets.

Significance: Ecosystem analysis helps authorities assess cumulative foreclosure, customer lock-in and the strategic advantages arising from control over connected services.

Case 3: IMS Health GmbH & Co. OHG v NDC Health GmbH & Co. KG (2004)

Court: Court of Justice of the European Communities, Case C-418/01.

Facts: The dispute concerned access to a pharmaceutical sales-data structure used in market research. IMS Health's structure had become an industry standard, and a rival sought access to it.

Legal principle: Under exceptional circumstances, refusal by a dominant undertaking to license intellectual property may constitute abuse. The Court identified demanding conditions, including indispensability, exclusion of competition in a secondary market and prevention of a new product for which there was potential demand, subject to the precise legal test.

Relevance to RegTech: A regulatory-data provider may own a proprietary classification system, benchmark dataset or technical format that competing compliance tools need to serve customers effectively.

Significance: The case helps explain the tension between protecting investment in proprietary systems and preventing the misuse of control over indispensable inputs. Mere commercial usefulness or customer preference is not enough to establish indispensability.

Case 4: Oscar Bronner GmbH & Co. KG v Mediaprint (1998)

Court: Court of Justice of the European Communities, Case C-7/97.

Facts: A newspaper publisher sought access to a rival publisher's nationwide home-delivery distribution system.

Legal principle: A refusal to grant access to infrastructure controlled by a dominant undertaking is not automatically abusive. The essential-facilities analysis applies a strict indispensability threshold, among other conditions.

Relevance to RegTech: A company claiming that a rival must provide access to a compliance database, fraud-detection network or reporting infrastructure must demonstrate more than the fact that access would reduce costs or improve convenience.

Significance: This case guards against imposing access obligations simply because an incumbent has superior infrastructure. It preserves incentives to invest while allowing intervention in exceptional cases.

Case 5: Google Search (Shopping) — Google and Alphabet v Commission (2021)

Court: Court of Justice of the European Union, Case C-48/22 P, judgment of 10 September 2024.

Facts: The dispute concerned Google's treatment of its own comparison-shopping service relative to competing comparison-shopping services in general search results.

Legal principle: The Court upheld the finding of abuse arising from the combination of more favourable positioning and display for Google's own service and the demotion of competing services, assessed in the circumstances of the case.

Relevance to RegTech: A platform that distributes regulatory analytics, compliance ratings or risk-monitoring tools could distort competition if it systematically gives preferential visibility to its own downstream product while disadvantaging rival providers.

Significance: The case highlights the importance of examining platform design, ranking and distribution practices—not merely prices or formal contractual restrictions.

Case 6: European Commission v Intel Corp. (2024)

Court: Court of Justice of the European Union, Case C-240/22 P, judgment of 24 October 2024.

Facts: The case arose from Intel's use of conditional rebates and the Commission's assessment of their exclusionary effects. The litigation addressed the proper evaluation of evidence relating to the as-efficient-competitor test.

Legal principle: Where the Commission has undertaken an as-efficient-competitor analysis, the EU courts must review the relevant arguments and evidence in accordance with the applicable legal framework. The assessment of exclusionary rebates requires careful attention to their capacity to foreclose competitors.

Relevance to RegTech: A dominant compliance-software provider might offer conditional rebates tied to a customer's use of multiple services or its refusal to adopt rival tools.

Significance: Authorities should assess commercial context, economic evidence and foreclosure capability rather than assuming that every discount or bundled subscription is unlawful.

Case 7: Bundeskartellamt v Meta Platforms (German Facebook data case, 2023)

Court: Court of Justice of the European Union, Case C-252/21, judgment of 4 July 2023.

Facts: The case concerned Meta's combination of user data from Facebook and other sources, the relationship between data processing and dominance, and the role of the German competition authority.

Legal principle: Data-protection compliance may be relevant to a competition-law assessment of a dominant undertaking's conduct. The judgment also clarified limits on competition authorities' independent determination of questions governed by data-protection law.

Relevance to RegTech: A provider may obtain sensitive business, identity or transaction data through multiple regulatory and commercial services. Combining these datasets may produce efficiencies, but it may also create entry barriers or competitive advantages that rivals cannot replicate.

Significance: The case demonstrates the need for coordinated competition and data-protection oversight without treating every data-protection infringement as an antitrust violation.

Case 8: Qualcomm Inc. v European Commission (2024)

Court: Court of Justice of the European Union, Case C-466/19 P, judgment of 26 September 2024.

Facts: The litigation concerned a Commission decision relating to Qualcomm's alleged predatory pricing in the market for UMTS baseband chipsets and the evidentiary assessment underlying the decision.

Legal principle: The judgment illustrates the importance of properly substantiating exclusionary-conduct findings and assessing the relevant economic and evidentiary record.

Relevance to RegTech: If an established provider prices regulatory analytics or compliance software below an appropriate cost benchmark to eliminate competitors, authorities must examine the applicable predatory-pricing test, market structure, duration and exclusionary capability.

Significance: Strong competition enforcement must be evidence-based. Low prices can benefit customers, and they should not be condemned without establishing the required legal elements.

Comparative lessons from the cases

These judgments do not establish that every restriction involving regulatory software is unlawful. Their application depends on the relevant jurisdiction, market circumstances, conduct and statutory tests.

5. Major competition issues in regulatory technology ecosystems

A. Market concentration in compliance software

Regulatory technology markets can become concentrated because sophisticated software requires substantial investment in cybersecurity, data processing, legal expertise and ongoing updates.

A small number of providers may dominate specialised markets for anti-money-laundering screening, transaction monitoring, sanctions screening, regulatory reporting or competition-law analytics.

Concentration is not inherently unlawful. However, it may create competition risks where firms use market power to raise prices, restrict access or prevent entry.

B. Data monopolisation

Regulatory data may be valuable because it enables better fraud detection, benchmarking, market analysis and predictive enforcement.

Competition concerns arise where a provider:

Accumulates exclusive access to commercially important datasets.

Prevents customers from transferring their data to rival providers.

Uses confidential customer information to compete against those customers.

Combines datasets in ways that create durable barriers to entry.

Authorities should distinguish legitimate data protection and intellectual-property interests from exclusionary restrictions that lack sufficient justification.

C. Algorithmic collusion and coordinated pricing

RegTech systems increasingly use AI to detect suspicious pricing patterns. However, algorithms can also facilitate coordination when competing businesses use shared pricing software, common data feeds or automated optimisation tools.

For example, competing compliance-software providers could use the same pricing platform to exchange sensitive commercial information or implement coordinated subscription-price increases.

The legal assessment should examine whether there is an agreement, concerted practice or other conduct prohibited under the applicable law. Similar algorithmic outcomes alone do not necessarily establish unlawful coordination.

D. Interoperability restrictions

Regulatory software must frequently connect with enterprise systems, identity databases, accounting platforms and government reporting portals.

A dominant provider could undermine competition by imposing discriminatory API access conditions, limiting data export or making integration with competing systems unnecessarily difficult.

Possible remedies include:

Standardised data-export formats.

Transparent and proportionate API-access requirements.

Non-discriminatory technical access where legally justified.

Reasonable switching and migration arrangements.

Security requirements applied consistently to comparable providers.

E. Exclusive procurement and certification

Governments and regulated industries may rely on approved software vendors or certification providers. Exclusive arrangements can improve security, reliability and accountability, but they may also prevent qualified rivals from entering the market.

Procurement rules should therefore be transparent, proportionate and based on objective technical requirements. Where possible, authorities should avoid unnecessary vendor lock-in and support interoperable alternatives.

F. Mergers and acquisitions

Acquisitions of emerging RegTech businesses may remove potential competitors before they achieve substantial market shares.

Merger assessments should consider:

Whether the target represents a significant source of future innovation.

Whether the acquiring firm controls essential regulatory data or infrastructure.

Whether the transaction eliminates a credible alternative supplier.

Whether the combined business can foreclose competing software providers.

Whether claimed efficiencies are verifiable and likely to benefit customers.

6. Role of regulatory technology in competition-law enforcement

RegTech can strengthen enforcement by allowing authorities to process large quantities of evidence more efficiently.

1. Cartel detection

Machine-learning tools can identify suspicious bid patterns, unusual price movements, communications networks and recurring patterns in procurement data.

2. Market monitoring

Automated systems can track concentration, entry and exit, switching costs, price dispersion and changes in market structure.

3. Merger screening

Data analytics can identify overlapping products, potential competitors, vertical relationships and acquisitions of emerging innovators.

4. Compliance automation

Businesses can automate competition-law training, document reviews, risk alerts, internal audits and controls over sensitive information sharing.

These tools should assist, rather than replace, legal and economic judgment. A suspicious statistical pattern is an investigative lead, not proof of an infringement. Enforcement decisions require reliable evidence, reasoned analysis and appropriate procedural safeguards.

7. Regulatory technology ecosystems under Indian competition law

In India, the principal statutory framework is the Competition Act, 2002, as amended.

The Competition Commission of India (CCI) can examine RegTech-related conduct under several provisions.

For instance, if a dominant compliance-software provider prevents customers from using competing services through exclusionary contractual restrictions, Section 4 may become relevant. If competing vendors agree to fix subscription prices, Section 3 may apply.

A merger between major regulatory-data providers may require assessment under Sections 5 and 6, depending on the applicable statutory thresholds, exemptions and transaction rules.

The CCI would need to establish the relevant market, assess market power and examine the competitive effects of the conduct. It should not assume that technological superiority, data ownership or a large customer base automatically constitutes an infringement.

8. Regulatory autonomy and institutional coordination

RegTech ecosystems often involve several authorities, including competition regulators, data-protection authorities, financial regulators, cybersecurity agencies and government procurement bodies.

Effective governance requires coordination without eliminating institutional independence.

The following principles are particularly important:

Clear jurisdiction: define which authority handles competition, privacy, security and sector-specific compliance.

Evidence-sharing safeguards: establish lawful mechanisms for sharing relevant information while protecting confidentiality.

Consistent standards: reduce conflicting technical and reporting requirements where possible.

Independent review: ensure that automated risk scores and enforcement recommendations can be scrutinised.

Proportionate remedies: select interventions that address the identified harm without unnecessarily restricting innovation.

Accountability: document the operation, limitations and validation of analytical systems used in enforcement.

The European Union's Digital Markets Act offers an additional, complementary framework for designated gatekeepers. Its interoperability and data-access obligations illustrate how ex ante regulation can address certain ecosystem bottlenecks alongside traditional competition law.

European Commission

+1

9. Proposed regulatory governance framework

A sound framework for competition in RegTech ecosystems should combine market oversight, technical standards and procedural safeguards.

Stage 1 — Market assessment

Identify key suppliers, data dependencies, barriers to entry, network effects and switching costs.

Stage 2 — Risk identification

Screen for exclusionary conduct, collusion, discriminatory access, tying, lock-in and anticompetitive acquisitions.

Stage 3 — Legal and economic assessment

Determine whether statutory requirements are satisfied, considering evidence of foreclosure, efficiencies, security risks and consumer effects.

Stage 4 — Proportionate intervention

Apply suitable remedies, such as ending unlawful exclusivity, improving interoperability, or imposing access obligations where legally justified.

Stage 5 — Monitoring and review

Measure whether the remedy improves entry, switching, innovation and customer choice without compromising legitimate security requirements.

10. Conclusion

Competition law and regulatory technology ecosystems are increasingly interdependent. RegTech can improve the speed, consistency and accuracy of regulatory compliance and antitrust enforcement, but its reliance on data, network effects, proprietary interfaces and automated decision-making can also generate new forms of market power.

The cases involving Microsoft, Google, IMS Health, Bronner, Intel, Meta and Qualcomm provide useful legal principles for evaluating interoperability, access to essential inputs, platform conduct, data concentration and exclusionary pricing.

The appropriate approach is neither to prohibit technological concentration automatically nor to allow regulatory infrastructure to become an unchallengeable competitive bottleneck. It is to preserve incentives for innovation while preventing unlawful exclusion, protecting procedural fairness and enabling effective entry by competing providers.