The verdict in three sentences
For a London e-money institution with 120,000 customers, AML compliance can no longer rely on spreadsheets and manual reviews: the FCA expects a documented risk-based approach, continuous sanctions screening and traceable suspicious activity reports to the NCA. A market solution charges 0.40 to 1.70 GBP per check, while a custom AML and KYC platform costs 150,000 to 400,000 GBP and takes 5 to 7 months to deploy. Custom, or a hybrid model, only beats pure SaaS over three years when volumes and monitoring licence fees are high.
The building blocks of a KYC and AML setup in 2026
The framework is the Money Laundering Regulations 2017 as amended, the FCA's financial crime guide and JMLSG guidance, plus sanctions obligations under the UK sanctions regime administered with OFSI. The FCA has repeatedly fined payment firms not for lacking controls but for controls that did not work in practice, so effectiveness is what gets tested.
| Building block | Function | Share of custom budget | 2026 watch point |
|---|---|---|---|
| Onboarding | ID document, selfie, liveness check, proof of address | 20 % | Drop-off rate, target below 15 % |
| Sanctions and PEP screening | UK sanctions list, UN, EU, PEPs, adverse media | 15 % | Daily updates, false positive handling |
| Customer risk scoring | Score by profile, country, channel, product, volumes | 15 % | Documented methodology approved by the MLRO |
| Transaction monitoring | Threshold rules, structuring, unusual patterns | 20 % | Below 3 % irrelevant alerts after tuning |
| Alert and case management | Work queue, evidence, reasoned decision, audit trail | 15 % | Measured handling times |
| Suspicious activity reports | Case preparation and submission to the NCA | 5 % | Full traceability, tipping-off protection |
| Regulatory reporting | Indicators for the FCA and the risk committee | 10 % | Exports ready for a supervisory visit |
Market solution or custom build: the numbers
International identity and screening platforms charge per check and connect quickly. Transaction monitoring is usually sold as a separate licence, often 40,000 to 100,000 GBP a year for a firm this size, with generic rules that need heavy tuning.
| Criterion | SaaS market solution | Custom build | Hybrid (SaaS identity + in-house engine) |
|---|---|---|---|
| Initial cost (2026 order of magnitude) | 20,000 to 50,000 GBP of integration | 150,000 to 400,000 GBP | 100,000 to 250,000 GBP |
| Unit cost | 0.40 to 1.70 GBP per check | 0.20 to 0.35 GBP for biometric check only | 0.25 to 0.50 GBP |
| Time to go live | 6 to 10 weeks | 5 to 7 months | 3 to 5 months |
| Fit with your risk assessment | Partial | Full | Strong on monitoring |
| Name matching and transliteration | Variable | Designed for your customer base | Designed for, on screening |
| Data location | Often outside the UK | UK possible | Mixed, to document under UK GDPR |
| Vendor lock-in | High | Low | Medium |
Typical 7-month plan
Month 1: business-wide risk assessment, products and channels inventory, list selection. Months 2 to 4: onboarding, screening and scoring development. Month 5: monitoring rules engine and alert management. Month 6: migration of the 120,000 existing files and retroactive screening. Month 7: testing with the MLRO, documentation for internal audit, go-live. For reference, the Kolonell grid for a complex application of this kind starts at 7,000,000 FCFA (10,670 EUR) and goes beyond 15,000,000 FCFA (22,870 EUR) depending on scope, delivered remotely and excluding biometric verification vendor fees.
Mini case study
Emma, MLRO of an e-money institution in London (illustrative example), handles 30,000 new onboardings and 40,000 periodic reviews a year, i.e. 70,000 checks. With SaaS at 1.00 GBP per check plus a 60,000 GBP monitoring licence, the annual bill reaches 130,000 GBP. Custom: 280,000 GBP of development, plus 9,000 GBP of outsourced biometric checks (30,000 at 0.30 GBP) and 50,000 GBP of hosting, tuning and maintenance, i.e. 339,000 GBP in year one then 59,000 GBP a year. The gap of 71,000 GBP a year puts breakeven around year four. That is why most firms this size in 2026 choose the hybrid route: keep SaaS identity checks, build the monitoring engine.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
Does the FCA require a specific software?
No, it requires outcomes: reliable identification, risk-proportionate due diligence, records kept at least 5 years after the relationship ends, and traceable SARs. Whatever the tool, it must prove this during a supervisory review.
How many false positives should we expect on sanctions screening?
Before tuning, 5 to 10 % of customers can trigger an alert, especially on transliterated names. Good configuration brings this below 1 to 2 %, which changes the team's workload entirely.
Can we keep a SaaS vendor for identity checks only?
Yes, it is the most common hybrid model in 2026. Biometric checks stay outsourced at 0.20 to 0.35 GBP per file while scoring, monitoring and alerts run in an in-house engine.
How long to screen 120,000 existing customers retroactively?
Processing takes a few hours, reviewing the resulting alerts takes 3 to 6 weeks depending on team size. Plan it before go-live.
What annual maintenance budget should we plan?
Count 12 to 18 % of the build cost per year, i.e. 30,000 to 60,000 GBP, to follow regulatory changes, new lists and rule tuning.
Let's scope your project. Tell us your customer volume, products and data location constraints: we will price a KYC and AML scope, an indicative budget and a realistic timeline. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
