In October 2024, TD Bank paid $3.09 billion in penalties to the DOJ, FinCEN, OCC, and Federal Reserve for AML compliance failures. Between 2018 and 2024, 92 percent of the bank’s total transaction volume — approximately $18.3 trillion — went unmonitored for suspicious activity (FinCEN, October 2024). The bank’s senior leadership had imposed a flat budget constraint on its compliance function: zero expense growth, year over year, regardless of transaction volume growth.
That budget decision cost 74 times more than the most expensive custom KYC/AML software platform on the market. It is the clearest data point available on the cost of non-compliance.
This guide works in the opposite direction: from the penalty schedule backward to the software investment that makes those penalties avoidable. It covers what custom KYC/AML software development costs by component, what buying a vendor stack costs per onboarded user, and the volume threshold where each path is financially correct.
| AML/KYC compliance penalty reference 2026 | |
| FinCEN SAR/CTR violation | $69,733/day (willful) |
| BSA program failure | Up to $1M per violation |
| OFAC sanctions violation | Up to $1.3M per count |
| Bank Secrecy Act criminal | $500K fine + 10 yrs prison |
| TD Bank (2024) — record AML fine | $3.09 billion total |
What KYC/AML compliance software actually covers
KYC (Know Your Customer) and AML (Anti-Money Laundering) software are two overlapping systems that most regulated financial institutions treat as a single compliance infrastructure. In practice they are five distinct technical layers, each with its own development cost, vendor market, and regulatory obligation.
| KYC/AML layer | What it covers | Build cost | Buy cost | Complexity signal |
| Identity verification (IDV) | Document OCR, biometric match, liveness | $15,000–$40,000 | $0.80–$2.50/check | High — deepfake liveness critical |
| AML screening (sanctions/PEP) | Watchlist screening, PEP database, adverse media | $20,000–$60,000 | $0.20–$1.50/check | High — daily list updates required |
| Transaction monitoring | Rule engine, ML scoring, alert generation | $40,000–$120,000 | $2,000–$15,000/mo SaaS | Very high — tuning is continuous work |
| Case management | Investigator workflows, SAR/CTR filing, audit trail | $30,000–$80,000 | $500–$5,000/mo SaaS | Medium — regulatory documentation critical |
| Risk scoring engine | Customer risk rating, dynamic profiling, CDD triggers | $25,000–$70,000 | Bundled or $1,000–$8,000/mo | High — model must match regulatory framework |
| Ongoing compliance data feeds | OFAC, UN, EU, PEP lists, adverse media | $0 if using vendor | $5,000–$30,000/yr data license | High — lists update daily; stale data = liability |
| The layer most teams underscope: transaction monitoring
Transaction monitoring is consistently the most expensive and most technically complex layer in any KYC/AML build. Rule-based systems that were adequate in 2020 no longer satisfy regulators who expect adaptive ML-based risk scoring, real-time alert generation, and auditable model governance. Building a production-grade transaction monitoring engine from scratch costs $40,000 to $120,000 in initial development, plus $30,000 to $60,000 per year in model maintenance and tuning. Buying a SaaS transaction monitoring platform costs $2,000 to $15,000 per month. Most fintech startups underestimate the ongoing tuning cost of both approaches. |
Custom KYC/AML platform build cost: what each scope level buys
Custom KYC/AML software development falls into three scope levels. The scope is determined by the organization’s size, the regulatory regime it operates under, and whether the platform needs to support third-party clients or only internal compliance workflows.
| Scope level | Who it serves | What is built | Cost range | Timeline |
| Basic — startup / fintech | Pre-Series A fintech, neobank, marketplace with <5,000 monthly onboardings | KYC IDV integration, basic AML watchlist screening, SAR workflow, audit log | $50,000–$100,000 | 4–8 months |
| Mid-tier — regulated financial institution | Licensed bank, broker-dealer, MSB, credit union with active compliance team | Full IDV + liveness, transaction monitoring, case management, risk scoring, CDD/EDD workflows | $150,000–$350,000 | 8–14 months |
| Enterprise — compliance-as-a-platform | Compliance SaaS vendor, banking platform, or institution offering KYC to third parties | Multi-tenant architecture, real-time ML TM, proprietary risk models, regulatory reporting, API for clients | $400,000–$1,200,000+ | 14–24 months |
Custom build component cost breakdown
| Custom KYC/AML platform: development cost by component (mid-tier build) | |||
| Identity verification engine |
|
$30K–$60K | |
| AML watchlist + PEP screening |
|
$25K–$55K | |
| Transaction monitoring rule engine |
|
$50K–$120K | |
| ML risk scoring model |
|
$40K–$80K | |
| Case management + SAR/CTR workflow |
|
$35K–$75K | |
| Audit trail + regulatory reporting |
|
$20K–$50K | |
| Data feed integration (OFAC/UN/EU) |
|
$15K–$30K | |
| API layer for system integration |
|
$20K–$40K | |
| Compliance documentation + testing |
|
$25K–$60K | |
Vendor market: 8 providers, real pricing, honest comparison
The vendor KYC/AML market consolidates around two buyer problems: identity verification at onboarding (IDV-first vendors) and ongoing transaction monitoring (AML-first vendors). Most growing fintechs use one vendor from each category rather than a single platform that covers both — because specialization at each layer produces better accuracy and lower per-check cost.
| Vendor | Coverage | Pricing | Geography | Integration | Best for |
| Sumsub | IDV + AML + fraud prevention | $1.35/check (basic) | 150+ countries | Strong; SDK + API | Mid-market fintech, crypto |
| Onfido (Entrust) | IDV + biometrics + liveness | $0.80–$2.50/check | 195 countries | Enterprise-grade | Enterprise; regulated industries |
| Persona | IDV + KYB + watchlist | $0.75–$2.00/check | Global | Developer-first | Startups; marketplaces |
| Trulioo | IDV + KYB + global coverage | Custom (enterprise) | 195 countries + 450 data sources | API + orchestration | Global enterprise; cross-border |
| ComplyAdvantage | AML screening + TM | $2,000–$10,000/mo | 230+ jurisdictions | API + dashboard | AML-first; banks, fintechs |
| Veriff | IDV + liveness | $0.80/check (self-serve) | 195 countries | Developer-friendly | Startups; gig economy; gaming |
| Shufti Pro | IDV + AML + deepfake detection | Custom | 230+ countries | Single API | High-risk industries; crypto |
| Unit21 | Transaction monitoring + AML | Custom ($2K–$20K/mo) | US-focused | Low-code + API | Mid-market fintechs |
| The hidden cost in KYC vendor pricing: the all-in check cost is 30 to 50 percent higher than the headline rate
Published per-check prices from vendors like Onfido and Veriff cover automated document verification and liveness. They do not include: sanctions screening (billed separately), PEP database checks (billed separately), manual review surcharge when automation fails ($2–$8 per escalated case), and resubmission fees when a user retries. The all-in cost per onboarded user — including all layers — is typically 30 to 50 percent higher than the headline per-check price (DeepIDV, 2026). At 10,000 monthly onboardings, a $1.35 headline rate becomes an effective $1.80 to $2.00 per user after all-in costs. |
Cost per onboarded user: build vs buy at scale
The build-vs-buy decision for KYC/AML software is fundamentally a volume question. At low onboarding volumes, vendor per-check pricing is dramatically cheaper than building a platform whose fixed costs dominate. At high volumes, a custom platform’s per-check cost approaches zero as fixed costs are distributed across more users.
The table below models annual cost per onboarded user for a vendor stack (buy) versus a custom platform (build), assuming a $200,000 custom build amortized over 12 months plus $0.15 per check in variable data costs.
| Monthly onboardings | Vendor cost (buy) | Custom platform cost | Cost per user (buy) | Cost per user (build) |
| 500/mo | $1,000/mo | $17,000/mo* | $2.00 | $34.00 |
| 2,000/mo | $4,000/mo | $17,300/mo* | $2.00 | $8.65 |
| 10,000/mo | $20,000/mo | $18,500/mo* | $2.00 | $1.85 |
| 50,000/mo | $100,000/mo | $23,500/mo* | $2.00 | $0.47 |
| 200,000/mo | $400,000/mo | $46,700/mo* | $2.00 | $0.23 |
*Build cost assumes $200K custom platform amortized over 12 months ($16,667/mo) plus $0.15/check variable cost for data feeds. Teal = buy is more expensive. Red = build overhead dominates.
What regulators require in 2026: the compliance floor
KYC/AML software requirements are set by a combination of federal law (Bank Secrecy Act, USA PATRIOT Act), FinCEN program rules, OFAC sanctions requirements, and — for crypto and international businesses — FATF guidance. In 2026, three regulatory developments materially changed the technical requirements for any new compliance platform build.
| Regulatory development | Effective date | Technical requirement | Cost impact on build |
| FinCEN CDD Rule — beneficial ownership update | February 2026 | Beneficial ownership re-verification logic at each new account opening; updated beneficial owner database | $10,000–$30,000 to implement new verification flow |
| FATF Horizon Scan — deepfake guidance | December 2025 | Liveness checks must include deepfake-resistant AI; simple photo selfie match no longer satisfies FATF guidance for AML CDD | $15,000–$40,000 to upgrade liveness layer; or switch to compliant vendor |
| Bank Secrecy Act SAR filing threshold | Ongoing | SARs required within 30 days of suspicious activity detection; system must generate, queue, and file via FinCEN BSA E-Filing | $20,000–$50,000 for SAR workflow build; or use case management SaaS |
| OFAC SDN list real-time screening | Ongoing | Every customer onboarding and every transaction above threshold must screen against OFAC SDN list in real time; stale screening = liability | $5,000–$15,000/yr data feed license; or included in vendor stack |
| Crypto AML — Travel Rule (FinCEN/FATF) | Ongoing | Virtual asset service providers must collect and transmit originator/beneficiary data on transfers above $3,000 | $30,000–$80,000 Travel Rule module; or use Notabene, Sygna, or similar |
Ongoing annual costs neither build nor buy articles include
Compliance software has a higher ongoing cost burden than most software categories because regulatory lists update daily, fraud patterns evolve constantly, and each regulatory change requires engineering response. The table below shows the annual cost categories that apply to every KYC/AML platform — custom or vendor — after go-live.
| Annual cost category | Custom platform | Vendor stack | Notes |
| Sanctions / PEP data feed license | $5,000–$30,000/yr | Included (but in markup) | OFAC, UN, EU, HM Treasury; updated daily; stale data = liability |
| Adverse media data feed | $5,000–$20,000/yr | Included in some vendors | Required for enhanced due diligence (EDD) on higher-risk customers |
| Transaction monitoring tuning | $30,000–$80,000/yr (internal) | Included in SaaS | Rules and ML models drift; false positive rate must be actively managed |
| SAR/CTR filing compliance | $10,000–$30,000/yr (internal) | $500–$3,000/mo SaaS | Regulatory deadlines; internal BSA officer time is the main cost |
| Independent AML audit | $15,000–$50,000/yr | $15,000–$50,000/yr | Required by most banking regulators; cost applies regardless of build/buy |
| Regulatory change response | $20,000–$60,000/yr (engineering) | $0 (vendor handles) | Rule changes (FATF, FinCEN, OFAC) require software updates; vendor absorbs this in custom |
| Platform maintenance and updates | $20,000–$50,000/yr | $0 (included in subscription) | OS updates, library patches, security fixes |
Build vs buy: the 5 questions that determine the right path
Most KYC/AML build-vs-buy decisions are made on gut instinct or developer preference. These five questions translate the decision into financially verifiable criteria.
| Question | Buy is the answer if… | Build is the answer if… |
| How many customers do you onboard monthly? | Under 20,000/month — vendor per-check cost is lower than custom platform fixed cost | Above 50,000/month — fixed cost of custom platform distributes across enough users to undercut vendor pricing |
| Do you need to white-label compliance to third parties? | No — your compliance is internal only | Yes — you are building a compliance platform for clients; SaaS vendors do not allow white-labeling their stack |
| Is your transaction monitoring use case standard? | Yes — rule-based screening and ML models from vendors cover your risk profile | No — proprietary risk models trained on your own transaction data outperform generic vendor models at your specific fraud pattern |
| Can you absorb regulatory update lag? | Yes — vendor updates their platform for regulatory changes; you accept their timeline | No — your compliance must update faster than vendor release cycles allow; mission-critical for banks with regulatory consent orders |
| Do you have an internal AML engineering team? | No — vendor stack reduces dependency on specialist AML engineers | Yes — you have data scientists and compliance engineers who can build and maintain proprietary models at lower marginal cost than vendor fees |
| The scenario that always justifies custom: compliance-as-a-product
If your business model requires offering KYC/AML compliance as a service to other businesses — as a BaaS provider, embedded finance platform, payroll API, or marketplace infrastructure — no vendor stack allows white-labeling at scale without prohibitive per-seat costs. The only path to offering compliance-as-a-product is building the compliance infrastructure as proprietary software. At that point, the build cost is not a compliance expense. It is a product development investment. |
Year 1 total cost: three realistic scenarios
| Cost category | Startup (vendor stack) | Mid-market (hybrid) | Enterprise (custom) |
| IDV vendor (build or buy) | $24,000/yr ($2.00 × 1K/mo) | $120,000/yr ($1.50 × 80K/mo) | Custom: $60,000 build |
| AML screening vendor | $12,000/yr ($1.00 × 1K/mo) | $36,000/yr | Custom: $40,000 build |
| Transaction monitoring | $24,000/yr (SaaS) | $60,000/yr (SaaS) | Custom: $80,000 build |
| Case management / SAR | $6,000/yr (SaaS) | $24,000/yr (SaaS) | Custom: $55,000 build |
| Data feeds (OFAC, PEP) | Included in vendor | $15,000/yr | $20,000/yr data license |
| Platform integration build | $15,000 (one-time) | $40,000 (one-time) | Custom: full build above |
| Compliance audit (annual) | $20,000 | $35,000 | $50,000 |
| Total Year 1 | $101,000 | $330,000 | $450,000–$750,000 |
What the cost data actually says
TD Bank spent a decade underfunding its AML compliance program under a zero expense growth mandate. The cost of that decision was $3.09 billion — equivalent to funding a top-tier enterprise KYC/AML platform 2,000 times over.
For early-stage fintechs and startups, the vendor stack path costs $50,000 to $120,000 in year one and scales linearly with onboarding volume. It is the financially correct decision below 20,000 monthly onboardings. For mid-market institutions, a hybrid approach — vendor IDV combined with custom transaction monitoring — reduces vendor dependency on the highest-cost layer while keeping development scope manageable. For enterprise-scale platforms or businesses offering compliance infrastructure to third parties, custom development is the only path that delivers the control, data ownership, and margin structure the business model requires.
The compliance cost is not optional. Every regulated financial institution pays it — either through software investment or through enforcement actions. The only variable is which form the payment takes.