The True Cost of AML Compliance: A Benchmarking Model
Firms routinely understate cost per onboarding by a factor of several, because they count the line item that arrives as an invoice and ignore the one that dominates the total: analyst time. This paper sets out a model for calculating the real figure, and where the cost actually concentrates.
"What does compliance cost us per customer?" is usually answered by dividing the screening subscription by the number of customers onboarded. That figure is almost always wrong, and wrong in the same direction.
It omits the analyst, the re-work loop, the exception cases, and the customers who left during the process. This paper sets out a model that captures them.
The Four Cost Pools
Separate the total into four pools, because they behave differently and respond to different interventions:
- Platform and data. Screening subscriptions, watchlist data, verification calls, identity data. Predictable, invoiced, easy to measure — and usually the smallest pool.
- Analyst time. Review, verification, EDD, alert investigation, escalation and quality assurance. Normally the largest pool, and the least measured.
- Re-work. Documents recaptured, information re-requested, files reopened because something was missed. A subset of analyst time worth isolating because it is almost entirely addressable.
- Foregone revenue. Customers abandoned during onboarding and revenue delayed by slow decisions. Invisible in the compliance budget and frequently larger than all three others combined.
Modelling Analyst Time Honestly
The common mistake is to use an average handling time across all cases. Onboarding effort is not normally distributed — it is bimodal. Model at least three bands:
- Straight-through — verified automatically, no analyst touch. Marginal cost close to the data cost alone.
- Standard review — one analyst pass, minutes rather than hours.
- Enhanced due diligence — source of wealth and source of funds enquiry, ownership resolution, senior approval. Hours, sometimes across days, and frequently involving more than one person.
The EDD band is where cost concentrates. A book with 5% EDD cases can easily see those cases consume a third or more of total onboarding effort. Any model using a single blended time will misprice the book and misdirect the remediation.
Our KYC cost calculator implements this banding directly.
Pricing Re-work Separately
Re-work deserves its own line because, unlike EDD, it produces no compliance value. A document rejected for image quality, a proof of address that arrives out of date, an ownership question asked twice because the first answer was not recorded — each is pure cost.
Quantify it by sampling: take a hundred completed files and count how many required a second request to the customer. In manual processes the proportion is often uncomfortable. It is also the pool most responsive to intervention, because capture-time validation removes the loop rather than shortening it.
The Cost Nobody Budgets
Abandonment is a compliance cost even though it never appears in the compliance budget. If onboarding takes days and requires a desktop session, a proportion of applicants will not finish — and the ones most likely to leave are frequently the ones with the most alternatives.
To include it: multiply the abandonment rate attributable to the verification steps by the expected lifetime value of the customer. Firms are often startled by the result. The same applies to delay: revenue that arrives three weeks late is not revenue lost, but in a funding or trading context it can be close.
Alert Investigation as an Ongoing Cost
Onboarding is one-off; monitoring is perpetual. The ongoing pool is driven by alert volume multiplied by average investigation time, and alert volume is a function of tuning rather than of risk.
This is why false-positive rates are a cost question as much as a control question. A programme generating alerts the team cannot investigate properly does not merely cost more — it produces rushed dispositions and late reports, which converts a cost problem into a regulatory one. Our companion paper on false-positive reduction covers the tuning method.
Building the Benchmark
Assemble the model in this order:
- Count onboardings by band over a representative period — a quarter, not a month.
- Time each band by observation, not estimate. Self-reported handling times are consistently optimistic.
- Apply fully-loaded analyst cost, including management, QA and training overhead.
- Add platform and data cost per case.
- Isolate re-work by sampling.
- Add abandonment and delay at the revenue line.
The output is a defensible cost per onboarded customer by band, and — more usefully — a clear picture of which pool to attack. In most firms it is not the subscription.
The Ongoing Pool: Monitoring and Review
Onboarding cost is one-off and visible. The ongoing pool is recurring, larger over a customer lifetime, and almost never modelled.
It has three components. Alert investigation is alert volume multiplied by average investigation time — and alert volume is driven by tuning rather than by underlying risk, which means it is substantially within your control. Periodic review is the refresh cycle: number of customers due, multiplied by review effort, which itself varies by risk band exactly as onboarding does. Screening maintenance is the continuous rescreening of the book against updated watchlists, plus the disposition of whatever that surfaces.
A useful exercise: calculate ongoing cost per customer per year and compare it to onboarding cost. In most firms with a multi-year customer lifetime, the cumulative ongoing cost exceeds the acquisition-side compliance cost several times over — which reframes where automation investment should go.
This is also where the periodic review model itself becomes a cost question. A three-year cycle across a large book is a substantial recurring commitment, and much of it is spent confirming that nothing has changed. Our paper on perpetual KYC covers the alternative.
Building a Business Case Finance Will Accept
Compliance business cases fail for predictable reasons, and most of them are presentational rather than substantive.
Do not lead with headcount reduction. It is the weakest version of the argument, it is politically difficult, and it is frequently untrue — the team usually absorbs growth rather than shrinking. "The existing team handles three times the volume without adding heads" is both more defensible and more likely to be what actually happens.
Separate avoided cost from avoided risk. Finance will accept a modelled operational saving. It is more sceptical of "reduced regulatory risk" because the counterfactual is unprovable. Present them separately rather than blending them, and quantify only the first.
Include the revenue line. Onboarding abandonment is a revenue number, not a compliance number, and it is usually the largest single figure in the model. Bringing it in moves the conversation from cost centre to revenue enablement — which is a different conversation entirely.
Use bands, not averages. A business case built on a blended cost per onboarding will be challenged the moment someone points out that cases differ. Banding pre-empts that and demonstrates the model was built from observation.
Be honest about what does not improve. Enhanced due diligence on a genuinely complex structure will still take hours. A case that claims otherwise invites scepticism about everything else in it.
What the Model Usually Reveals
Three findings recur. Cost per onboarding is materially higher than the firm believed. The EDD minority consumes a majority of effort. And the largest single addressable saving is re-work, not headcount.
That last point matters for how the business case is written. "Reduce the team" is a difficult argument and often the wrong one. "Remove the re-work loop so the existing team handles growth without adding heads" is both easier to defend and usually more accurate.
Model Your Own Cost Base
We will run this model against your actual volumes, bands and handling times, and show where the cost concentrates — including the pools that never reach the compliance budget.
