The big internet companies, like Google, Facebook etc, have no regulation on their code, yet adopt practices like code review.

Banks have pretty bad software quality, too. (I worked for one bank, and talked to lots of people.) Though that's a generalization: there's lots of places for software in a bank. The parts that directly handle the money tend to have less bugs emerging day to day, but that's more because of low velocity and operating within known parameters (so as not to trigger any lurking bugs in the edge cases).