Updated October 21, 2026
In brief
In the major 2024 and 2025 deals, fraud, risk and compliance software sold at about 3x to 8x revenue. Thoma Bravo paid about 8.1x revenue for Darktrace, Permira valued BioCatch at about 8.1x ARR and Experian paid about 3.5x revenue for ClearSale. Network data, AI efficacy and regulatory mandates earn the premium. Windsor Drake’s Q3 2026 update puts listed pure-plays at a median 2.18x EV/revenue and Visa’s $2.4 billion BioCatch deal at close to 13x trailing ARR.
Download
Available exclusively to fintech founders, executives, and investors.
For fintech founders, CFOs, and board directors, the current environment presents a complicated, dual-track reality. Public market multiples for general RegTech and compliance software have found stable ground, with median EV/Revenue valuations landing somewhere between 3x and 6x. This reflects a mature market that values operational efficiency and cash flow over pure growth. But there’s a premium tier that’s emerged above this baseline. Private companies tackling acute, existential threats, specifically Authorized Push Payment fraud, generative AI-driven synthetic identities, and regulatory orchestration, are still pulling in multiples ranging from 8x to 15x revenue.
Capital markets activity through late 2024 and 2025 shows a resurgence in high-value M&A, driven mainly by private equity consolidation and strategic portfolio building. Thoma Bravo’s $5.3 billion acquisition of Darktrace, Permira’s majority stake in BioCatch at a $1.3 billion valuation, and Feedzai’s $2 billion valuation all signal that sophisticated investors see the FRC sector as a critical defensive asset class. These deals validate the idea that platforms combining proprietary data networks with high-fidelity, explainable AI represent scarce assets worth paying up for.
This report covers valuation multiples, regulatory catalysts such as PSD3 and the EU AI Act, and competitive trends in the sector through 2027. With MarketsandMarkets projecting the fraud detection and prevention market to grow from $32.0 billion in 2025 to $65.7 billion by 2030, there’s still substantial opportunity for founders to position their companies for premium exits, assuming they can articulate a genuine platform-centric value proposition.
The relationship between revenue growth and valuation multiples has broken away from the linear patterns we saw in the previous decade. By the end of 2025 the market had settled into distinct valuation tiers based on the quality and durability of growth as well as its speed, measured by Gross Dollar Retention, Net Revenue Retention and unit economics.
Public market data from late 2024 and 2025 shows a sharp split in how capital markets value different segments of the fintech and RegTech ecosystem. The “rising tide lifts all boats” era is over. Investors are now drawing hard lines between “must-have” regulatory infrastructure and “nice-to-have” tools. Publicly traded GRC and RegTech companies are trading at median EV/Revenue multiples of roughly 2.9x to 5.2x, with the strongest performers reaching into the 8.3x range.
But when you isolate high-growth, AI-integrated platforms, the ceiling rises considerably. Lending and legacy fintech assets are stuck at depressed multiples, often hovering around 2.5x revenue. The market penalizes them for credit risk exposure and cyclical vulnerabilities, viewing them more like traditional financial services than software. AI-integrated fraud and risk platforms that have successfully deployed AI to combat generative AI attacks, on the other hand, are commanding premiums of 17.3x revenue or higher. This reflects what you might call the “scarcity value” of effective defenses against the growing threat of deepfakes and synthetic identities.
Private valuations continue running ahead of public equivalents for companies with clear category leadership. SaaS Capital put the median public B2B SaaS multiple at 7.0x run-rate revenue in January 2025, and its model gave the median private company 4.8x if bootstrapped and 5.3x if equity-backed. Within the specific vertical of fraud and financial crime prevention, recent private rounds and exits suggest a floor of about 8x ARR for “best-in-class” assets. The “Rule of 40”, where Growth % plus Profit Margin % exceeds 40, has become the gold standard. Companies hitting this benchmark are trading at 7.3x revenue or better, while those falling short are stuck near 2.0x. Founders who do not grow efficiently face serious multiple compression.
One critical trend boards should recognize is the aggressive capital deployment by private equity firms, which is effectively setting a valuation floor for mature, cash-generative assets. These firms are targeting companies where public markets have overcorrected or haven’t properly valued the inherent stickiness of compliance revenue streams.
Table 1: Valuation Multiples by Sub-Sector
| Sub-Sector | Public EV/Revenue Range | Private ARR Multiple Range | Key Value Drivers | Valuation Headwinds |
| Identity Verification (IDV) | 3.0x to 6.0x | 4.0x to 7.0x | Volume growth, orchestration capabilities, global coverage | Commoditization of OCR, price wars, low switching costs |
| Fraud Decisioning / Orchestration | 8.0x to 15.0x | 10.0x to 20.0x | Network effects, AI efficacy, “Guarantee” models | Implementation friction, high CAC, false positive rates |
| Behavioral Biometrics | 8.0x to 12.0x | 8.0x to 15.0x | IP moats, APP fraud detection, regulatory mandates (PSD3) | High R&D costs, privacy regulation, longer sales cycles |
| AML & Transaction Monitoring | 4.0x to 7.0x | 5.0x to 8.0x | Regulatory mandates, high switching costs (stickiness) | Legacy tech debt, lengthy sales cycles, intense competition |
| GRC & Compliance Platforms | 4.0x to 6.0x | 5.0x to 8.0x | Operational efficiency, cross-module selling | Perception as “cost center,” lower growth velocity |
Sources: SaaS Capital Index, Houlihan Lokey FinTech Market Update Q3 2025, D.A. Davidson GRC Technology Report 2025
Valuations in the FRC sector rest on financial performance and are also shaped by regulatory pressure that forces technology adoption and by the priorities of large consolidators. The M&A activity we’ve seen in 2025 provides concrete benchmarks that private companies can use to gauge their own valuations.
Thoma Bravo’s $5.3 billion acquisition of Darktrace is the main reference point. With an implied EV/Revenue multiple of 8.1x and an EV/EBITDA multiple of 34.2x, this deal effectively sets a ceiling for AI-driven security companies. What it tells us is that even for a public company with some baggage, high-growth AI revenue commands a premium around 8x. Investors treat cybersecurity and advanced fraud prevention as adjacent, high-value verticals worth paying up for.
BioCatch’s $1.3 billion valuation on roughly $160 million in ARR points to a similar multiple in the 8.1x range. Permira’s deal highlights the premium placed on behavioral biometrics, a technology that’s become essential for fighting Authorized Push Payment fraud, which traditional passwords simply can’t catch. Category leaders in specialized verticals can command multiples well above the general SaaS median.
Feedzai’s Series E round, which brought in $75 million at a $2 billion valuation, reinforces this trend. With 88% year-over-year growth in its behavioral biometrics segment, Feedzai shows that scale-ups can maintain premium valuations by successfully expanding from point solutions like transaction monitoring into broader “RiskOps” platforms.
The consolidation side tells a different story. Experian’s $350 million acquisition of ClearSale, valued at roughly 3.5x revenue, illustrates the multiple compression you see with regional leaders or companies that buyers view more as “data assets” than high-growth software platforms. It highlights how data incumbents are strategically acquiring transactional fraud capabilities to complement their static credit data bureaus.
Table 2: Major M&A Transactions 2024-2025
| Acquirer | Target | Deal Value | Implied Multiple | Transaction Date | Strategic Rationale |
| Thoma Bravo | Darktrace | $5.3 Billion | ~8.1x Revenue | 2024 (Closed Late 2024) | AI Cybersecurity scale; taking public asset private; operational efficiency play. |
| Permira | BioCatch | $1.3 Billion (Valuation) | ~8.1x ARR | 2024/2025 | Category leadership in Behavioral Biometrics; PSD3 tailwinds; defensive asset. |
| Investors (Series E) | Feedzai | $2.0 Billion (Valuation) | Unknown (High Growth Premium) | Oct 2025 | Expansion of RiskOps platform; 88% growth in biometrics; pre-IPO scaling. |
| Experian | ClearSale | ~$350 Million | ~3.5x Revenue | Oct 2024 | Regional expansion (LATAM) + Transactional Data + Fit with credit data. |
| Entrust | Onfido | $400M to $650M | ~3.0x to 4.5x Revenue | Apr 2024 | Deepfake defense; Biometric IDV consolidation; Portfolio expansion. |
Sources: Thoma Bravo press releases, Permira/BioCatch announcement, Feedzai funding announcements, Reuters M&A coverage, TechCrunch transaction reports
The Total Addressable Market for fraud risk and compliance software is expanding rapidly, driven by two main regulatory waves: PSD3 in Europe and the global shift in APP fraud liability. MarketsandMarkets projects the fraud detection and prevention market to grow from $32.00 billion in 2025 to $65.68 billion by 2030, a CAGR of 15.5%.
Within this broader market, the AI in Fraud Management sub-segment is accelerating even faster. Valued at $14.72 billion in 2025, it’s expected to hit $65.35 billion by 2034, driven by an 18.06% CAGR. The faster growth reflects an arms race in which financial institutions need AI defenses against AI-generated attacks such as deepfakes and synthetic identities.
The wider RegTech market offers massive runway for platform players. Starting from $18.84 billion in 2025, the sector is forecast to explode to $115.5 billion by 2035, a CAGR of 20.62%. The growth comes from increasing complexity around global sanctions and crypto-asset regulation, and from the automation of compliance workflows.
Geographically, the U.S. market remains both the largest and most mature, with the U.S. Fraud Detection & Prevention market projected to maintain a 17.9% annual growth rate through 2030. For founders, these growth rates help the investment case, because the underlying market is growing faster than the broader economy.
Table 3: Market Sizing & Growth Projections 2025-2030
| Market Segment | 2025 Market Size | 2030 Projected Size | CAGR % | Key Growth Drivers |
| Fraud Detection Software | $32.00 Billion | $65.68 Billion | 15.5% | Real-time payments, APP fraud liability, mobile banking adoption. |
| AI in Fraud Management | $14.72 Billion | $65.35 Billion (2034) | 18.06% | Generative AI threats, deepfake detection, automated decisioning. |
| RegTech Market | $18.84 Billion | $115.5 Billion (2035) | 20.62% | Regulatory complexity (PSD3, Basel), crypto compliance, cost reduction. |
| GRC Software Market | $30 Billion+ (2024) | $72 Billion | ~12-15% | Enterprise risk integration, ESG reporting, cybersecurity governance. |
| Online Fraud Detection | $32.39 Billion (2024) | $112.19 Billion (2032) | 16.8% | E-commerce expansion, card-not-present fraud, account takeover (ATO). |
Sources: MarketsandMarkets Fraud Detection Report, Precedence Research AI Fraud Management Study, Business Research Company RegTech Report, Grand View Research
Revenue growth by itself no longer earns top-tier multiples. The “Rule of 40” has become the primary framework investors use to assess valuation. The data consistently shows that SaaS companies get valued on a curve relative to this metric. Companies with a Rule of 40 score above 40% are trading at 7.3x revenue or higher. Those falling below 20% are seeing valuations squeezed down to the 2x-3x range.
Net Revenue Retention is another critical lever. In the fraud space, NRR functions as a proxy for product effectiveness, if your fraud tool actually works, usage volume should grow as the client grows, and they should adopt additional modules. An NRR above 120% signals a strong “land and expand” motion and commands a significant premium. Conversely, NRR below 100% is a red flag that suggests high churn or commoditization, which will hammer your valuation.
Efficiency metrics like CAC Payback Period and ARR per Employee are also under the microscope. A CAC payback under 12 months is considered best-in-class, indicating highly efficient go-to-market motions, often driven by channel partnerships or product-led growth. Founders need to optimize these inputs to move from the “Market Rate” valuation tier into the “Premium Tier.”
Table 4: Growth Metrics Impact on Valuation
| Metric | Premium Tier (High Multiple) | Market Rate (Mid Multiple) | Penalty Tier (Low Multiple) | Typical Multiple Range |
| Rule of 40 Score | > 40% | 20% to 40% | < 20% | High: 7x-15x | Mid: 4x-7x | Low: 2x-3x |
| Net Revenue Retention (NRR) | > 120% | 100% to 110% | < 100% | High correlation to valuation ceiling. |
| CAC Payback Period | < 12 Months | 12 to 24 Months | > 24 Months | Indicates sales efficiency and scalability. |
| ARR per Employee | > $250k | $150k to $250k | < $150k | Proxy for software vs. service mix. |
| Revenue Growth Rate | > 50% YoY | 20% to 50% YoY | < 10% YoY | Must be balanced with burn rate. |
Sources: BCG Rule of 40 Analysis, SaaS Capital Private Company Survey, Flippa SaaS Benchmarks
Two trends dominate M&A in the sector: PE take-privates and strategic platform expansion. Private equity firms, Thoma Bravo’s the poster child here, are snapping up mature, cash-generative assets where public markets overreacted on the downside. The usual approach is to buy assets with solid installed bases, tighten operations and then run buy-and-build strategies.
Strategic buyers are hunting for pieces to complete their “Identity Graphs.” Data incumbents like Experian, Equifax, Mastercard, they’re actively acquiring assets that bring fresh transactional data or geographic reach. This wave of consolidation is crushing mid-sized point solutions. You either scale into a platform or you find an exit. There’s not much middle ground left.
There is a real valuation gap between public and private markets. Public RegTech companies trade at 2.4x-5x revenue. High-quality private M&A often closes at 6x to 10x, sometimes higher. This gap is fueling take-private deals and pushing VCs to pour money into late-stage private companies that haven’t hit public market turbulence yet.
Table 6: Consolidation Trend Summary
| Buyer Type | Strategic Objective | Target Profile | Typical Multiple Range | Recent Example |
| Private Equity Firms | Cash flow optimization; Buy & Build; Take-private arbitrage. | Rule of 40 potential; High retention; >$100M ARR. | 6x to 10x EBITDA (Mature) / 4x-8x Rev | Thoma Bravo / Darktrace; Permira / BioCatch. |
| Data Incumbents | Expand Identity Graph; Acquire transactional data signals. | Unique data assets; Geographic leaders. | 3x to 6x Revenue | Experian / ClearSale. |
| Cybersecurity Platforms | Converge Cyber and Fraud; Unified Trust Platforms. | AI-native detection; IDV capabilities. | 5x to 10x Revenue | Entrust / Onfido. |
| Banking / Payments | Vertical integration; Cost reduction; Value-added services. | Embedded fraud tools; Merchant services. | Variable (Strategic Premium) | Mastercard / Ekata (Historical Ref). |
Sources: Houlihan Lokey M&A reports, D.A. Davidson GRC analysis, PE Hub transaction coverage,
The 2025 valuation environment for Fraud, Risk, and Compliance software is tough but lucrative for quality assets. An exit in the 8x to 15x revenue range requires strong unit economics and a Rule of 40 score above 40. Growth at all costs is finished. What gets rewarded now is efficient, durable growth.
From a strategy standpoint, you need to evolve from point solution to platform. Major banks are consolidating their vendor lists, which means single-feature companies are getting squeezed out. Go find partnerships or acquisition targets that let you add adjacent capabilities. Combine IDV with AML. Layer in fraud decisioning. Build out.
Use regulatory tailwinds, PSD3, liability shifts as your primary sales weapon. Don’t position your software as a compliance cost. Frame it as balance sheet protection. That shift alone can dramatically increase contract values and your pricing power.
Proprietary data is what acquirers want most. They’re buying data moats, not your codebase. A platform that does not collect and use unique data signals leaves value on the table. Getting the data right is the most direct route to a premium valuation.
FAQ
The strongest moats in this sector come from data network effects, proprietary IP and switching costs. In a data flywheel each new customer adds data that improves detection, which wins more customers; Socure verified more than 2.7 billion identity requests in 2024. BioCatch’s behavioral biometrics are an IP moat. AML and transaction monitoring tools are sticky because regulatory mandates embed them in compliance workflows. Identity verification built on commodity OCR has low switching costs and trades at 3.0x to 6.0x revenue in public markets.
Thoma Bravo paid $5.3 billion for Darktrace, about 8.1x revenue and 34.2x EBITDA. Permira’s majority stake valued BioCatch at $1.3 billion, about 8.1x ARR. Experian paid about $350 million for ClearSale, about 3.5x revenue, and Entrust paid $400 million to $650 million for Onfido, about 3.0x to 4.5x revenue. Feedzai raised $75 million at a $2 billion valuation in October 2025. In August 2026 Visa agreed to buy BioCatch for $2.4 billion in cash.
They sit above most of fintech. On the data in this report, lending and legacy fintech assets trade around 2.5x revenue, publicly traded GRC and regtech companies at median multiples of roughly 2.9x to 5.2x, and AI-integrated fraud and risk platforms at 17.3x revenue or more. Windsor Drake’s fintech valuation multiples page covers the wider sector.
MarketsandMarkets projected in July 2025 that the fraud detection and prevention market would grow from $32.00 billion in 2025 to $65.68 billion by 2030, a 15.5% compound annual rate. Precedence Research expects the AI in fraud management segment to grow faster, from $14.72 billion in 2025 to $65.35 billion by 2034, an 18.06% rate. Real-time payments, shifts in APP fraud liability and AI-generated attacks drive the growth.
Windsor Drake advises founder-led companies on sell-side M&A. A first conversation is confidential and starts with your numbers.
Research, not investment advice, a fairness opinion or a valuation of any specific company. Third-party data is cited to its source and remains its owner’s. Windsor Drake is not a registered broker-dealer and does not offer, sell or place securities. When a transaction requires a registered broker-dealer, that work is handled by a registered broker-dealer partner.
