The verdict in three sentences
An FCA-authorised payment institution managing 300,000 customers can no longer run its AML and counter-terrorist financing compliance with spreadsheets and ad hoc SQL queries: regulator reviews and suspicious activity reporting to the UK Financial Intelligence Unit require a complete audit trail. Custom software costs about $70,000 to $175,000 in 2026, with a 6 to 8 month timeline, versus $50,000 to $150,000 a year for a licensed international solution. Over five years, custom usually costs about half as much, provided you take ownership of list updates and scenario tuning.
The regulatory building blocks to cover in London
In the UK, the Money Laundering Regulations 2017 and FCA guidance require payment institutions and e-money issuers to run a risk-based system. In practice, the software must cover:
| Building block | 2026 operational requirement | Estimated effort |
|---|---|---|
| Tiered KYC | Balance and transaction limits by verification level, online upgrade | 6 to 8 weeks |
| Identity verification | Passport, driving licence, biometric residence permit, selfie and liveness check | 4 to 6 weeks |
| Sanctions screening | UN, UK (OFSI), EU and OFAC lists, daily rescreening of 300,000 customers | 4 weeks |
| Politically exposed persons | PEP database and enhanced due diligence | 2 to 3 weeks |
| Transaction monitoring scenarios | 25 to 40 rules: structuring, volume spikes, cross-border transfers | 8 to 10 weeks |
| Alert and case management | Assignment, comments, escalation to the MLRO | 4 weeks |
| Suspicious activity reports | Pre-filled case file, attachments, history | 3 weeks |
| Audit trail and retention | Tamper-evident log, retention of at least 5 years | 3 weeks |
2026 budget: custom or international solution
| Criterion | Licensed international solution | Custom software |
|---|---|---|
| Entry cost | $25,000 to $65,000 integration | $70,000 to $175,000 |
| Recurring cost | $50,000 to $150,000 a year | $13,000 to $30,000 a year (hosting, maintenance, lists) |
| 5-year cost (estimate) | $275,000 to $815,000 | $135,000 to $325,000 |
| Fit with your specific products and risk model | Limited configuration | Native |
| Data hosting | Often vendor-controlled | Your choice, UK or EU |
| Time to go live | 4 to 6 months | 6 to 8 months |
| Vendor dependency | High, annual price reviews | Code owned by the institution |
These figures are 2026 orders of magnitude; the FCFA equivalents used in our West African projects are based on about 600 FCFA to 1 USD.
Reducing false positives: the real productivity gain
A poorly calibrated system generates thousands of alerts a month, which analysts close in bulk. Regulators look at the quality of the analysis, not the volume processed.
| Monthly indicator | Before (generic rules) | After calibration (2026 order of magnitude) |
|---|---|---|
| Alerts generated | 2,000 | 800 |
| False positive rate | 95% | 80% |
| Average review time per alert | 15 min | 15 min |
| Review hours | 500 h | 200 h |
| Analysts needed (160 h a month) | 3.1 | 1.3 |
| Average time to file a suspicious activity report | 21 days | 7 days |
Mini case study
Amina, MLRO of a payment institution in London, compares two options for 300,000 customers. The international solution costs $42,000 in integration and $100,000 a year, i.e. $542,000 over five years. Custom software costs $125,000 plus $20,000 a year, i.e. $225,000 over five years. The difference reaches $317,000. Add the productivity gain: 300 review hours saved a month at about $45 per loaded hour, i.e. $13,500 a month or $162,000 a year. The 2-month longer timeline is the trade-off, which she covers by starting with KYC and sanctions screening.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
FAQ
How much does AML and KYC compliance software for a payment institution cost in 2026?
Between $70,000 and $175,000 for custom software, with $13,000 to $30,000 a year for maintenance and list updates. An international solution costs $50,000 to $150,000 a year.
How long must KYC and transaction data be kept?
UK regulations require at least 5 years after the end of the business relationship or the transaction. The software must guarantee log integrity over that period, which represents several terabytes for 300,000 customers.
Can the software file suspicious activity reports directly?
It prepares a complete, time-stamped case file, ready for submission through the UKFIU reporting channel. Filing remains the MLRO's decision, and the time saved is 2 to 3 weeks per report.
How many monitoring scenarios should we configure?
A payment institution of this size usually starts with 25 to 40 rules, then adjusts them every quarter based on the false positive rate. Targeting under 80% false positives is realistic in the first year.
How long before we are operational?
Plan 6 to 8 months: 6 weeks of scoping with compliance and internal audit, 16 to 22 weeks of phased development, then 4 weeks of acceptance testing and parallel running with the old system.
Let's scope your project. Tell us your customer count, transaction volumes and current tools: we will price the KYC, screening and monitoring blocks with a 6 to 8 month plan. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
