REG Completes SOC 2 Type 2 Examination for the REG Network Platform

REG Technologies has successfully completed a SOC 2 Type 2 examination covering the Security Trust Services Criteria for the REG Network platform. The final report has now been issued, following the SOC 2 Type 1 audit we completed in March 2026.

What the examination looked at

The two reports answer different questions. Our Type 1 audit looked at how REG’s controls were designed at a single point in time. The Type 2 examination looked at how those controls operated over an observation period, with an independent auditor testing them against operating evidence.

The scope is the Security Trust Services Criteria, applied to the REG Network platform.

A quick note on wording. SOC 2 is an attestation report rather than a certificate, so we describe this as a completed examination. We have written about the earlier milestone in our SOC 2 Type 1 and ISO 27001 update.

Where it sits alongside our other security work

REG’s Information Security Management System was first certified to ISO/IEC 27001 in 2024 and passed its latest surveillance audit in March 2026. The SOC 2 Type 2 examination sits alongside that certification and does not replace it. Our cyber security page sets out how the pieces fit together.

Why it matters for a regulatory technology provider

REG’s customers are regulated insurers, MGAs and brokers. They use REG Network to hold counterparty due diligence, screening results and signed documents, which puts REG inside their control environment. It also puts REG inside their own supplier oversight.

Regulated firms stay accountable for the third parties they rely on. They are expected to show how they oversee those suppliers, not simply assume they are secure. An independent auditor’s report gives those firms something concrete to place on file when a capacity provider, auditor or the FCA asks the question.

There is a simple consistency to it as well. A company that helps firms evidence their oversight of counterparties should be able to evidence its own controls in the same way. Customers remain responsible for their own compliance decisions and regulatory obligations, and the report is one input to that work.

 
“The Type 1 audit looked at how our controls were designed. The Type 2 examination looked at how they operated over time,” said Diogo Xavier Luís, Chief Technology Officer at REG Technologies. “We see it as one part of our ongoing assurance work, and it gives customers an independent report they can review alongside their own due diligence.”