Fraud, Risk and Compliance Valuations: Q3 2026
Spend on fraud, risk and compliance is compelled by a supervisor rather than chosen by a buyer, and the durability that follows is confirmed across the perimeter: every one of the eleven constituents grew. The premium that durability is assumed to earn goes somewhere else. Five listed pure-plays carry a median 2.18x EV/Revenue at the 25 September 2026 close while six diversified groups selling into the same mandate carry a median 7.72x on a segment-level read, a 5.54x spread. The report introduces The Mandate Premium: a mandate names the obliged entity and never the vendor, so the re-rating attaches to the group that owns the data and the bank relationship. Four US requirements were withdrawn or deferred in 2026 while the European calendar fixes new obligations from July 2027.
- Sector
- Cybersecurity
- Focus
- Valuations
- Published
- September 29, 2026
- Length
- 23 slides
- Reading time
- 13 minutes
Slide deck
23-slide deck. Desktop readers can page through the embedded viewer below. Mobile readers can open the direct PDF link.
Open slide deck PDF Key findings
- Listed pure-plays carry a median 2.18x EV/Revenue at the 25 September 2026 close, across Clear Secure, Mitek, Riskified, Intellicheck and GB Group.
- Six diversified groups selling into the same mandate carry a median 7.72x on a segment-level read, a 5.54x spread over the pure-plays.
- Durability held across the whole perimeter: Moody's KYC ARR reached $478m up 13% and is 100% recurring, Nasdaq financial crime revenue grew 22%, RELX Risk grew 8% underlying at an expanding 38.5% margin.
- Growth does not explain the discount: pure-play growth ran 16% to 27% in the June 2026 quarter against 4% to 13% at most group segments.
- Four US requirements were withdrawn or deferred in 2026, including domestic beneficial ownership reporting ended by final rule on 14 August 2026 and the investment adviser AML rule moved to 1 January 2028.
- The EU anti-money-laundering regulation applies from 10 July 2027, AMLA takes direct supervision of up to 40 groups from 2028, and financial services must accept the EU digital identity wallet by 24 December 2027.
- Visa agreed to acquire BioCatch for $2.4bn in cash, close to 13x published trailing ARR, while Thoma Bravo took Verint private at 2.20x revenue in the same twelve months.
- 44 of the 45 deduplicated transactions in the regtech, KYC and identity and fraud cohorts of the Windsor Drake index were bought by strategics, with Mastercard appearing five times and Visa three.
Methodology
Framework: The Mandate Premium. Every figure carries one of three bases and they are never blended: listed pure-play trading multiples computed from market data, segment-level reads on diversified groups that report a risk, fraud or compliance segment with its own revenue and margin, and private round marks, which are negotiated post-money valuations. Enterprise value equals market capitalisation plus total debt less cash and short-term investments at the market close of 25 September 2026, with GB Group at 146.80p and Wolters Kluwer at its Euronext Amsterdam close of EUR 68.66. Trailing twelve month revenue is built from each company's most recently filed report. Nasdaq is computed on revenues less transaction-based expenses and LSEG on total income excluding recoveries. Cellebrite and Cognyte are excluded because their buyer is a law enforcement or national security agency, and NICE is excluded from the pure-play set because its financial crime line reports inside a cloud, services and product split. Regulatory dates are taken from Official Journal texts, Federal Register documents and agency releases. Index counts come from the regtech, KYC and identity and fraud cohorts of the Windsor Drake transaction index, queried and deduplicated on target, acquirer and announcement month on 29 September 2026.
Frequently asked questions
What multiple do fraud, risk and compliance companies trade at in 2026?
Two answers, and the distance between them is the finding. The five listed pure-plays carry a median 2.18x EV/Revenue at the 25 September 2026 close. The six diversified groups that sell into the same regulatory mandate carry a median 7.72x on a segment-level read. The compelled revenue is the same; the owner is not.
Does non-discretionary revenue actually command a premium?
It commands a premium of roughly 5.5 turns, and the vendor does not collect it. Every constituent in the perimeter grew through the period, so the durability argument holds on the evidence. The re-rating attaches to the group that owns the data asset and the bank relationship rather than to the company that sells the compliance software.
Why do the pure-plays trade below the groups when they grow faster?
Growth is not the explanation. Clear Secure grew 26.6% and Riskified 21.7% in the June 2026 quarter against 8% underlying at RELX Risk and 4% organic at Wolters Kluwer's compliance division. Margin and mandate security are the explanation: the group segments run roughly double the operating margin, and a mandate names the obliged entity, never the vendor.
What did the 2026 US regulatory year do to the demand curve?
It withdrew four requirements in eight months. Domestic beneficial ownership reporting ended by final rule on 14 August 2026. The investment adviser AML rule moved to 1 January 2028. An April 2026 proposal would confine bank enforcement to significant or systemic failures. Exceptive relief in February 2026 removed due diligence at every new account opening.
Where is the mandate growing instead?
Europe. The EU anti-money-laundering regulation applies from 10 July 2027, AMLA begins direct supervision of up to 40 groups from 2028, every member state must offer a digital identity wallet by 24 December 2026, and financial services must accept it by 24 December 2027. The UK failure to prevent fraud offence has been live since 1 September 2025.
Do buyers pay differently for AI-native decisioning?
Visa paid $2.4 billion in cash for BioCatch in August 2026, close to 13 times the trailing annual recurring revenue BioCatch published for the end of 2025. Thoma Bravo took Verint private at 2.20x revenue in the same twelve months. The model-native asset cleared roughly six times the multiple of the rules-era platform.
Companies covered
Public and private companies referenced in this report.
Download the deliverables
If you are evaluating a sale
Windsor Drake is a sell-side only M&A advisory firm for founder-led software, fintech, and technology companies with enterprise values between $5 million and $300 million. This research comes from the same desk that runs our sale processes. If you are weighing an exit in this market, a confidential valuation is the place to start: no obligation, senior attention, and a view grounded in the transactions this report tracks.
Cite this report
Fraud, Risk and Compliance Valuations: Q3 2026. Windsor Drake Market Intelligence, 2026. windsordrake.com/market-intelligence/reports/fraud-risk-compliance-valuations-q3-2026. Windsor Drake Market Intelligence data is free to use with attribution to Windsor Drake (windsordrake.com).