What is RegTech? A governance glossary

GovTech is the use of digital technology to modernise how governments deliver services and run their own operations — the citizen-facing portals, and the registries, payment systems, and case-management tools behind them. What distinguishes GovTech from ordinary software procurement is the nature of the buyer: a government works under legal mandates, public accountability, and obligations to its citizens that a private customer does not carry, so questions of data control, auditability, and continuity are not features but requirements. GovTech ranges from simple digitisation — replacing a paper form — to infrastructure that changes what an institution can credibly promise, such as registries whose records are tamper-evident. For the regulators, frameworks, and institutions that shape this field in one jurisdiction, see GovTech in Cameroon.

RegTech — regulatory technology — is technology that helps regulated organisations meet their legal and regulatory obligations: monitoring transactions, screening counterparties against sanctions and watchlists, keeping auditable records, and producing the reports that supervisors require. The term took hold in financial services, where anti-money-laundering and know-your-customer duties made manual compliance unmanageable, but the logic now reaches any sector with reporting duties. Good RegTech does not replace judgment; it makes compliance demonstrable, so that an institution can show — not merely assert — that an obligation was met. That is why verifiable records and open data standards matter more in RegTech than raw automation. For the supervisory landscape and frameworks in one jurisdiction, see RegTech in Cameroon.

SupTech — supervisory technology — is technology used by supervisors and regulators themselves: collecting regulatory data directly and automatically, analysing it for anomalies, and directing inspection resources where the data shows the highest risk. It is the mirror image of RegTech — RegTech serves the regulated entity, SupTech serves the authority overseeing it — and the two converge on the same requirement: data structured well enough for a machine to read. A supervisor with SupTech can move from periodic, sample-based reporting toward continuous supervision, but only as fast as the quality of the data it receives allows. RegTech and SupTech are treated together in RegTech in Cameroon.

A beneficial owner is the natural person who ultimately owns or controls a company or legal arrangement — the human being at the end of every chain of shareholdings, nominees, trusts, and intermediary entities, however long the chain. The concept exists because legal ownership and real control can diverge: a company may be legally held by another company, in another jurisdiction, on behalf of someone whose name appears nowhere. Beneficial-ownership registers exist to make that real ownership legible to authorities and, increasingly, to the public — and what separates a registry from a list of unchecked claims is verification. That verification problem is what RÉCOR, SIGIL’s sovereign beneficial-ownership registry designed for Cameroon, is built around.

The Beneficial Ownership Data Standard (BODS) is an open data standard, maintained by Open Ownership, for publishing beneficial-ownership information as structured, interoperable data; its current version is v0.4. BODS is statement-based: separate statements describe each person, each entity, and each ownership-or-control relationship between them, with typed interests such as shareholding and voting rights. The point of the standard is portability — data published to BODS can be read by analysis platforms, journalism tooling, and other jurisdictions’ systems, and is not locked to the software that produced it. The specification is published at standard.openownership.org. RÉCOR is built to export to BODS v0.4; the export profile is documented in the record.

FATF Recommendation 24 is the international standard on transparency and beneficial ownership of legal persons, set by the Financial Action Task Force: countries must ensure that adequate, accurate and up-to-date information on the beneficial ownership of companies is available to competent authorities. The FATF adopted a strengthened Recommendation 24 in March 2022. The Recommendation deliberately binds jurisdictions, not vendors — it says what a country must be able to answer, not which system answers it — which is why registry software is assessed against it rather than certified by it. RÉCOR is designed to satisfy FATF Recommendations 24 and 25 and to export to an open standard, so that the country’s answer remains portable.

Procurement integrity is the condition in which public contracts are awarded and performed the way the rules intend — competitively, transparently, at fair prices, for the public’s benefit — rather than steered by collusion, favouritism, or fraud. Public procurement is where public money meets private suppliers, which makes it both indispensable and exposed: the same processes that buy medicines and roads can be bent to buy loyalty. Protecting integrity therefore means more than punishing violations after the fact; it means publishing data in analysable form, watching for patterns that merit scrutiny, and keeping records that cannot be quietly rewritten. The institutions, rules, and data landscape of one jurisdiction are mapped in Procurement integrity in Cameroon.

Red-flag analytics is the automated screening of data — procurement notices, company registries, sanctions lists, court records — for defined indicators of elevated risk, called red flags: a single bidder where many were expected, a contract split just below a threshold, a supplier incorporated days before a tender. A red flag is a lead, not a finding. It justifies scrutiny; it never justifies sanction by itself, because every flag has innocent explanations, and an honest system keeps that distinction explicit rather than letting a score masquerade as proof. The discipline lies in defining flags precisely, calibrating how much each one means, and routing every consequential conclusion through human judgment. That is the design of APEX, SIGIL’s anti-corruption intelligence system for public procurement.

Sovereign governance infrastructure is public-interest software an institution genuinely holds: it runs on infrastructure the institution controls, the institution holds the keys, the data stays under the institution’s control, and every consequential action is authorized, bounded, and proven. The term marks a contrast with conventional cloud delivery, where the vendor holds administrative access, receives telemetry, and can revoke service remotely — an arrangement a private company may accept, but one a public institution holding citizens’ data under a legal mandate often cannot. Sovereignty here is not isolation: such systems can still build to open standards and export portable data. What changes is who answers for the system — and who can be locked out of it, which should be no one. The full argument is made at Sovereign governance infrastructure.

Governed cybersecurity is security work conducted under one rule: a technical capability is never an authorization. Being able to scan, exploit, or remediate is never permission to do so; every consequential action must pass an explicit, fail-closed chain of controls — authenticated identity, exact permission, authorized scope, the human approval its risk demands — and no finding is trusted until an independent, deterministic check re-verifies it. The term answers a real failure mode: as security tooling gains autonomous capability, the danger shifts from what tools cannot do to what they do without anyone having decided they should. Governed cybersecurity puts the deciding back where it belongs — with the institution. The doctrine is set out in full at Governed cybersecurity.

A tamper-evident audit chain is an append-only record of events in which every entry is cryptographically linked to those before it, so that any alteration — an edit, a deletion, a reordering — breaks the chain’s mathematics and becomes detectable. Tamper-evident is a precise claim, and a deliberately modest one: it does not promise that a record can never be attacked; it promises that an attack cannot succeed silently. Strengthenings include anchoring the chain in a Merkle tree and having independent witnesses countersign it, so that a forger would need to compromise several parties at once. An audit trail with these properties turns “trust our logs” into “check our logs” — the difference between a claim and a proof. Why SIGIL builds every system this way is set out in How we build.

Cryptographic shredding is the destruction of data by destroying the encryption key that makes it readable: the ciphertext may physically persist on disks and in backups, but without the key it can never again be rendered into information. Its value is sharpest where two duties collide — a person’s right to have their data erased, and a record’s duty to remain append-only and tamper-evident. Deleting bytes from an append-only chain would break its integrity; shredding the key honours the erasure while the chain’s mathematics survive intact, so a deletion can never silently rewrite history. In RÉCOR, citizens’ deletion rights are designed to be honoured exactly this way.