Switching Vendors
How to Switch AML and KYC Software Vendors Without a Compliance Gap
Changing screening, KYC or transaction monitoring software is a compliance event, not just an IT project. This guide covers the outsourcing rules that can apply, the records that must survive the switch, and a step-by-step checklist for moving without a gap in screening or monitoring.
The Short Version
Why a Vendor Switch Is a Compliance Event
Your AML obligations do not pause while systems change. Customers still need screening against current sanctions lists, transactions still need monitoring, and the records behind every decision must stay available for at least five years. A switch therefore has three risks to manage: a gap in coverage during cutover, records lost with the old system, and outsourcing rules that require planning, due diligence and in some cases contact with your regulator.
The table below summarises what the main regulators expect. Check the rules that apply to your licence: requirements differ between banks and other firms, and whether a particular service counts as outsourcing depends on the facts.
What Regulators Expect
Outsourcing and System-Change Rules by Regulator
Requirements and guidance relevant to changing an AML, KYC or screening provider, checked against each regulator’s text on 14 October 2026.
| Regulator | Rule | What it means when you change provider |
|---|---|---|
| MAS (banks) | Notice 658, in force from 11 December 2024 | Name screening by a third party is listed as an outsourced relevant service. Banks keep a register of these services and submit it to MAS twice a year, carry out due diligence before taking on a material service, keep the right to terminate with reasonable notice, and have customer information deleted when a contract ends. Annex C treats SaaS and other public cloud services as outsourced relevant services, and the contract-term requirements apply to existing agreements from their next extension. Whether a particular software licence counts as outsourcing depends on the facts. |
| MAS (banks) | Guidelines on Outsourcing (Banks) | Contracts should set a minimum period to carry out termination and provisions for a smooth transition, backed by plans that keep the bank operating if an arrangement ends. |
| MAS | Guidance for Effective AML/CFT Transaction Monitoring Controls (2018) | When a firm sunsets a monitoring system for a new platform, it should complete user acceptance testing and resolve issues before go-live, assess the need for interim bridging measures, and keep senior management updated on them (para 2.12). Para 2.13 also expects regular data integrity checks. |
| EU | DORA Articles 28(8) and 30, from 17 January 2025 | For ICT services supporting critical or important functions, firms need tested exit strategies, and contracts must include an adequate transition period. |
| UK | FCA SYSC 8.1 and PRA SS2/21 | When outsourcing critical or important operational functions, firms must keep continuity and quality if the outsourcing ends, by moving it to another provider or doing it themselves (SYSC 8.1.8R(12)). PRA SS2/21 expects documented exit plans for material outsourcing. |
| Hong Kong | HKMA SPM SA-2 | Authorised institutions planning to change their outsourcing arrangements should discuss the plans with the HKMA in advance, and customer data should be retrieved from or destroyed by the old provider. |
Records
Records You Must Keep Through the Switch
Export these before the old contract ends, and confirm you can still read them once the old system is switched off.
| Record | Minimum retention | Source |
|---|---|---|
| Customer due diligence information and account files | At least 5 years after the business relationship ends | MAS Notice 626 para 12.3(a); UK MLR 2017 reg 40; Hong Kong AMLO Schedule 2 s20; FATF Recommendation 11 |
| Transaction records | At least 5 years after the transaction is completed | MAS Notice 626 para 12.3(b); AMLO Schedule 2 s20; FATF Recommendation 11 |
| Records linked to a suspicious transaction report or an investigation | As the authorities direct, which can be longer | MAS Notice 626 para 12.5 |
| Screening results, alerts and case decisions | Treat as part of the CDD file: Notice 626 includes the results of any analysis undertaken | MAS Notice 626 para 12.3(a) |
Your contract will usually require the old vendor to delete your customer data when it ends, and under MAS Notice 658 banks must make sure that happens. Make sure you hold complete copies first.
Step by Step
A Ten-Step Checklist for Switching Vendors
- Document what the current system does. List the screening lists, matching thresholds, monitoring rules and scenarios, risk-scoring factors, integrations and reports. This is the baseline the new system must meet.
- Check your outsourcing obligations. Decide whether the service is a material or critical outsourcing for your licence, update your register, and contact your regulator where the rules require it.
- Do due diligence on the new provider before signing: data security, data location, continuity arrangements and the provider’s own exit terms.
- Agree the contract terms that protect the transition: notice periods, a transition period, data return in a usable format, deletion on exit, and audit rights.
- Export and reconcile your records. Move CDD files, screening results, alerts and case notes, and reconcile record counts so nothing is lost.
- Configure and test the new system against your baseline, including user acceptance testing and back-testing on historical data.
- Run the old and new systems side by side for a defined period, or put bridging measures in place, and compare the alerts each produces.
- Rescreen the whole customer base on the new screening system before cutover. No regulator text we found requires this in those words, but it is good practice: the FCA’s Financial Crime Guide asks whether customer lists are rescreened after each update, and Wolfsberg guidance calls for rescreening when customer or list information changes.
- Cut over and decommission. Switch traffic to the new system, then confirm the old provider has deleted your data once you hold your copies.
- Review after go-live. Check alert volumes and outcomes against the old system, tune thresholds, and report the result to senior management.
Common Questions
Switching Vendors FAQ
Do I need to tell MAS when I change my AML software provider?+
It depends on your licence and the service. For banks, MAS Notice 658 treats name screening by a third party as an outsourced relevant service: banks keep a register of these services and submit it to MAS twice a year, and must notify MAS in specific cases such as terminating an arrangement after a confidentiality breach. Check the notice and guidelines that apply to your firm.
How long must I keep KYC records after switching vendors?+
The same period as always: under MAS Notice 626, at least five years after the business relationship ends for CDD records, and at least five years after the transaction for transaction records. The UK and Hong Kong apply similar five-year rules. Switching vendors does not shorten them.
Should I run the old and new systems in parallel?+
It is the safest way to compare results and avoid a gap. MAS guidance on transaction monitoring says firms moving to a new platform should conduct user acceptance testing before go-live and assess the need for bridging measures in the meantime.
Do I need to rescreen all customers after changing screening system?+
We found no rule that says so in those words, but it is widely treated as good practice. A new system uses different matching logic and sometimes different data, so rescreening the full base shows whether anything the old system missed now matches.
What should the contract with a new provider include?+
Termination rights with reasonable notice, a transition period, data return in a usable format, deletion of your data on exit, and audit rights. In the EU, DORA requires an adequate transition period in contracts for ICT services supporting critical or important functions.
Considering a Different Platform?
Book a demo and compare One Constellation with your current system on the requirements in this checklist.
