Perhaps the difference is the age/size of the product/company. I could see a new company that has no choice but to build new product being driven by regulations

Perhaps the difference is the age/size of the product/company. I could see a new company that has no choice but to build new product being driven by regulations, while a company that already has a long standing, regulated product has incentive to not introduce change. Equifax is definitely the latter.