The volume of data worldwide is exploding. The IDC projects that by 2025, all the world’s data will reach a volume of 175 zettabytes or 175 billion terabytes, which would make manual supervisory processes untenable. This data comprises information stored in data centers, mobile towers, branch offices, PCs, smartphones, and IoT devices, and is collectively referred to as the datasphere.  

Today, regulators struggle to keep pace with the speed of financial data. The growing volume and complexity of data require more than manual processes. They demand robust and adaptable systems that enable smarter supervision. MSC’s Data Maturity Framework seen below provides a structured roadmap to help regulators progress from basic data collection to integrated, data-driven supervisory systems, enhancing risk detection, operational efficiency, and preparedness for future regulatory challenges. As discussed in our previous blog, SupTech begins with the creation of strong and flexible data foundations, which is a crucial first step in the effective implementation of supervisory technology. 

Foundations of a good data system  

Robust data systems are essential for effective SupTech, as they enable timely collection, secure storage, and seamless integration of high-quality data needed for proactive, risk-based supervision. Structured data supports advanced analytics, while sound governance and cybersecurity ensure compliance and protection against threats. We can evaluate the effectiveness of a good data system across multiple stages, as seen below, each of which is vital to enable scalable and intelligent SupTech deployment. 

Before we discuss the three main dimensions of data collection, standardization, and storage, we must understand that some basic pillars span every phase of the data life cycle. Data granularity, data governance, and data security and privacy are not discrete phases, but ongoing facilitators that form the foundation of how well data is gathered, processed, managed, and consumed. Granularity ensures data is detailed enough for risk-based supervision without being overwhelming. Governance frameworks provide transparent guidelines for acquisition, validation, and responsible sharing, which promotes consistency and accountability. 

Also crucial is for stakeholders to ensure data privacy and security at all maturity levels. Since supervisory data typically contains sensitive financial and consumer-level information, cybersecurity, encryption, and privacy-by-design must be present from start to finish. Regulators at all stages must ensure that these standards are met to avoid breaches, maintain confidentiality, and uphold trust. These cross-cutting foundations work in parallel with technical pillars to define the long-term effect of each SupTech endeavor. 

If institutions intend to implement SupTech effectively, they must first assess their data maturity on these pillars, identify gaps where they exist, and align their solution with both their current and future needs. 

Data collection 

As financial sector supervisors evolve from basic to intermediate and advanced data collection systems, their capabilities must keep pace. At the basic level, data is submitted by regulated entities to regulators manually via tools, such as Google Forms or MS Excel over email, which requires minimal IT skills and basic protection, such as antivirus software and password controls. 

At the intermediate level, supervisors have been adopting structured digital reporting through bulk-upload web portals and traditional APIs. The Bank of Ghana implemented its ORASS platform to enable API-based reporting, as reported publicly by the central bank, while NAMFISA, Namibia’s nonbank regulator, uses its statutory ERS web portal for regulated entities. Separately, the Bank of Namibia operates its own reporting arrangements and announced an automated regulatory reporting system in 2023. These require skilled IT staff and safeguards, such as the implementation of HTTPS (to ensure secure, encrypted communications), API gateways, and audit logs. 

At the advanced level, supervisors use real-time APIs, streaming tools, such as Apache Kafka, AI and NLP platforms, such as spaCy or Amazon Comprehend, and middleware, such as MuleSoft and Apache NiFi for integration across systems. For example, the Bangko Sentral ng Pilipinas implemented a real-time API solution to improve data submission. These setups demand strong cybersecurity and legal frameworks for consent, provenance, and live supervisory oversight. 

Data standardization

Through MSC’s extensive work with several central banks, including projects in Africa and Asia, we have observed that the adoption of data standardization tools and automated validation aligns with international best practices and accelerates SupTech maturity. At the basic level, reporting relies on MS Excel templates, manual validation via macros, and email submissions, primarily supported by spreadsheet analysts and IT staff. 

In the intermediate stage, regulators shift to structured formats, such as XML or XBRL, and use schema validators and submission portals to streamline reporting. For example, the Central Bank of Ireland’s ONR platform enables firms to upload XBRL files directly, which improves accuracy and efficiency by involving schema experts and governance teams. 

At the advanced level, institutions deploy automated validation engines, NLP pipelines for unstructured document analysis (e.g. parsing audit reports), and global standards, such as ISO 20022, which have found increasing use in cross-border payment reporting frameworks. German Bundesbank’s NLP-based prospectus parser automates the interpretation of PDF documents with more than 90% accuracy.  

Institutions have also adopted the legal entity identifier (LEI) system maintained by GLEIF, alongside ISO 20022, to ensure clear entity identification in global reporting. The Bank of England mandates the inclusion of the LEI in FI-to-FI payments through its CHAPS high-value payments system, effective 1st May 2025, as publicly announced by the Bank of England. 

These advanced processes demand a skilled blend of NLP engineers, regulatory data analysts, and compliance technologists to take full advantage of automation, standards, and data intelligence in regulatory oversight. 

Data storage  

At the basic level, data is stored locally, on USB drives, shared network drives, or on-site servers, which are managed by basic IT staff and protected by simple file encryption, restricted physical access, and regular backups. These setups are low-cost but have limited resilience. 

At the intermediate level, supervisors use secure transfer protocols, such as HTTPS, SFTP, and FTPS, alongside cloud storage platforms, such as AWS S3 or Azure Blob Storage, typically managed by specialized IT teams. Institutions have been increasingly adopting cloud storage for better resilience. For example, the Bank of England has been expanding cloud usage, while the Reserve Bank of India plans to launch IFS Cloud for regulated entities.  

However, as adoption grows, central banks are concerned about the risks of storing sensitive supervisory or financial data outside national borders, particularly regarding data sovereignty, privacy, regulatory compliance, and resilience. Such concerns are significant, especially against the emergence of new technologies, such as Central Bank Digital Currencies. Many are now exploring sovereign or locally managed cloud options to address these issues. 

While many organizations are transitioning, there is no publicly available evidence confirming that any institution has completed full-scale supervisory data migration. This mirrors earlier blog: Global cloud usage remains relatively low overall. Yet, many regulators are entering the intermediate maturity phase where secure, partial cloud adoption is becoming common. This phase involves moderate costs and requires compliance with advanced security measures, such as encryption-at-rest, identifying Access Monitoring (IAM) policies, audit trails, firewalls, and Multifactor Authentication (MFA). 

At the advanced level, organizations deploy data lakes and warehouses, supported by cataloguing tools, such as AWS Glue or Azure Purview for real-time data sync. This infrastructure, maintained by cloud architects and metadata specialists, supports enterprise-scale analytics and governance. For instance, Banco de España manages more than 850 TB of regulatory data and performs thousands of analytical queries each week for robust, AI-ready supervision. 

The growing adoption of SupTech highlights that despite significant upfront costs, the long-term benefits in resilience, scalability, and regulatory capability far outweigh initial investments. Institutions preparing for SupTech upgrades must prioritize needs assessments, gap analysis, stakeholder consultations, cost-benefit analysis, and strategic planning to ensure successful transformation. 

“Regulator blames lack of timely data reporting for recent multi-million-dollar losses in the banking sector.”  

This stark headline on HSBC’s GBP-57.4 million fine reveals an unpalatable reality: Even the world’s major banks, equipped with advanced systems, can suffer costly outcomes due to gaps in data accuracy and reporting. Failure to properly identify eligible customer deposits has exposed significant weaknesses in data handling, which has led to heavy regulatory penalties and hurt customer trust. 

Such challenges multiply in developing or underdeveloped countries that have weaker data infrastructure and less mature supervisory technologies. Here, the risks compound and make financial stability even harder to safeguard.  

This is precisely where supervisory technology, or SupTech, can emerge as a panacea. It uses analytics to transform messy, incomplete data into clear, actionable insights that help regulators and firms spot threats and manipulations faster than traditional, manual methods. 

A leading example is Singapore’s Monetary Authority, which developed “Apollo,” an AI-powered system that analyzes vast volumes of trading data to detect subtle patterns of market manipulation that humans often miss. Apollo learns from expert investigators, which allows regulators to focus on the riskiest cases and illustrates how AI-driven SupTech reshapes market supervision. However, even the most advanced solutions depend fundamentally on high-quality data. Without timely, consistent, and complete data, these tools cannot yield reliable insights. 

For regulators, especially in emerging markets, strong and adaptable data systems are imperative and serve as the very foundation of effective, future-ready financial supervision that can prevent crises and protect markets. 

Global adoption: Steady progress but uneven readiness 

While SupTech adoption is increasing worldwide, progress remains uneven. MSC’s work with regulators across Asia-Pacific and Africa shows that while many authorities are interested, their level of readiness varies. A Cambridge SupTech Lab’s 2024 survey shows that 75% of advanced economy regulators and 58% of emerging market authorities now use one or more SupTech or RegTech tools, a gap that has narrowed from 25% in 2023 to 17% in 2024. But behind these encouraging numbers lies a deeper challenge, the unequal readiness of data systems that underpin SupTech initiatives. 

MSC’s country-based studies reveal that many lower-income nations are still in a transitional stage of digital supervision, where some automation exists but manual processes continue to dominate. In the Pacific region, for example, several central banks have launched pilot dashboards for data analysis, but much of the input still comes from manual submissions and non-standard templates. This limits both scalability and consistency. 

Our diagnostics also show that weak digital infrastructure, inconsistent data definitions, and unclear data governance frameworks are often bigger obstacles than funding. In short, the adoption of SupTech tools does not always mean being ready for them. In this context, “ready” refers to the availability of robust data foundations, including clarity, consistency, quality, and  governance of data. Many regulators may have access to these systems but lack the data foundations needed to use them effectively or expand them sustainably. 

Robust and integrated data systems are the foundation upon which effective SupTech supervision is built, powering automation, real-time oversight, and risk-based actions as shown below.

Why strong data systems matter 

SupTech begins with technology, but its true power depends on data, and that is where the foundation for effective supervision is built. Strong data systems sit at the heart of every effective supervisory function. They process high-frequency granular information automatically, detect risks the moment they surface, and give supervisors the confidence to act based on hard evidence. They ensure that every regulated entity reports consistently and comparably, and that sensitive information is stored securely while remaining accessible to those who need it. 

Table 1: Varying data requirements of supervisory functions 

Core challenge: Weak data foundations 

Across less digitally mature markets, MSC’s data maturity assessments have identified three interlinked gaps that frequently delay SupTech transformation. Figures based on MSC’s data are derived from direct surveys of Pacific Island regulators conducted in 2023 as part of our data maturity assessment work. Cambridge figures are cited for global context. While these overlap with global patterns described in the Cambridge SupTech Lab’s work, our regional evidence provides sharper insights into their practical consequences.  

Data quality gaps 

Manual and spreadsheet-based reporting still dominate. MSC’s Pacific SupTech readiness survey (2025) found that one-third of regulators rely on manual submissions. This finding echoes Cambridge’s 2023 global trend, which shows more than half of authorities still handle manual data and nearly three-quarters validate it manually. These overlapping findings underscore how poor-quality and manual data weakens supervisory confidence and delays risk detection. 

Lack of standardization 

MSC’s diagnostics across small islands and low-income economies show that few regulators have consistent taxonomies or standardized data dictionaries across departments. While only 14% of regulators globally report full data standardization, the figure drops even lower, below 10%, in smaller jurisdictions that depend on legacy reporting formats. The absence of common definitions forces supervisors to clean and reconcile data after submission, which slows decision-making, undermines cross-entity comparisons and systemic risk analysis, and makes it inefficient or impossible. As a result, any SupTech solution built on this data risks being weakened. 

Infrastructure constraints 

Even as some authorities explore cloud-based SupTech pilots, in-house or private server storage still accounts for more than half of supervisory data systems in the Pacific, as per MSC’s research. This reliance on in-house systems protects confidentiality but creates silos that block data sharing and integration with modern analytics tools.  

While Cambridge reports low global adoption of cloud storage (31.5%), MSC’s Pacific survey reveals a significant and continued dependence on in-house and private servers across the region, which sometimes exceeds 50% in individual countries. These regional figures may appear to contradict global studies, but they are consistent when viewed in terms of maturity. Many jurisdictions remain at the transitional stage, where cloud experimentation has begun, but full adoption is still limited. 

Why a direct jump to SupTech is risky 

The temptation to invest in the latest tools is understandable. MSC’s research, supported by findings from CCAF and OECD, shows that technological investments often underperform when built without solid data foundations. Ineffective systems yield unreliable results, exhaust critical institutional resources, and heighten exposure to operational and reputational vulnerabilities. In the absence of dependable data, even the most advanced SupTech initiatives can turn into costly trials. 

Therefore, the data shows that before regulators allocate funds to advanced SupTech platforms or infrastructure, they should follow a gradual, capability-based strategy aligned with the maturity of their data ecosystems. The gradual implementation of SupTech solutions promotes smoother implementation, enhances value realization, and prevents costly setbacks. Without this foundation, institutions risk pouring resources into advanced technologies without addressing core weaknesses in data systems, which would ultimately drain institutional capacity and weaken the stability of the financial system. 

In our next blog, we will explore the building blocks of effective data systems and MSC’s framework, which defines what constitutes basic, intermediate, and advanced maturity levels, and showcase how central banks use these stages to implement scalable and future-ready SupTech solutions.