KYC and AML compliance software for a bank: custom vs package

The verdict in three sentences

For any regulated bank, KYC and AML compliance software is no longer optional: supervisors expect systematic sanctions screening, a documented customer risk score and an audit trail that holds up during an examination. In 2026 a recognised international package typically costs USD 70,000 to 250,000 over three years for a mid-sized bank once licences and integration are counted, while a custom layer plugged into your core banking system is priced on quote according to real scope. The right choice depends less on the price tag than on the quality of your customer data and your ability to tune rules to your own payment channels.

What supervisors actually expect from a compliance tool

Whether you report to the BCEAO in West Africa, a European regulator or a US examiner, the logic is the same: a risk-based approach. Examiners rarely ask which software you use. They ask for proof that every customer was identified, profiled, screened and reviewed at the right frequency, and that every alert was closed within a reasonable time with a documented decision.

The most common weakness in mid-sized banks is not the lack of a tool but false positive handling. Poorly tuned screening routinely flags 3 to 8 % of the customer base, which means thousands of manual reviews for a bank with 200,000 accounts.

Off-the-shelf package or custom development: the comparison

Large compliance packages bring proven scenario libraries and sanctions lists maintained by the vendor. Their weak point, especially in emerging markets, is integration: connectors to local core banking systems, mobile money flows, transliterated names and very frequent homonyms.

A hybrid approach often works best: keep a recognised screening engine for sanctions lists and build the KYC portal, risk scoring, alert workflow and regulatory reporting in-house. That is where the bank-specific value sits.

Four building blocks of a successful project

The first workstream is data quality: without correct date of birth, nationality and occupation, no risk score is reliable. Plan 2 to 3 months of remediation on the existing customer base. Next comes the rules engine, designed so compliance staff can adjust a threshold without a developer. The third pillar is the alert workflow with four-eyes validation, mandatory comments and timestamps. Finally, the management dashboard must produce the indicators examiners ask for in one click: alert volumes, average handling time, share of reports filed.

Mini case study

Grace, Head of Compliance at a commercial bank with 180,000 customers, handles alerts in spreadsheets with a team of 6 analysts. Screening produces 9,000 alerts per year, 96 % of them false positives, and each alert takes 25 minutes on average: 3,750 hours a year.

After deploying a risk score tuned to local homonyms and a prioritised alert queue, volume falls to 4,000 alerts and average handling time to 15 minutes: 1,000 hours a year. The bank saves 2,750 hours, about 1.7 full-time analysts. At a loaded cost of USD 2,000 per analyst per month, that is roughly USD 40,000 a year, before counting the risk of a regulatory fine that can reach several hundred thousand dollars.

FAQ

Is a package enough to pass a regulatory examination?

No, software is only a support. Examiners check the risk assessment, the quality of customer files and how alerts are actually handled; a poorly configured tool with 30 % incomplete KYC files is still a finding.

How long does it take to become compliant?

Allow 6 to 12 months depending on the state of the customer base. Data remediation often accounts for 30 to 40 % of the timeline.

Can mobile money and cross-border transfers be monitored?

Yes, provided flows are pulled from the core banking system or partners through APIs. Typical scenarios target structuring below thresholds and repeated flows to high-risk countries.

Can the data stay hosted in-country?

Yes, a custom solution can run on the bank's own servers or with a local host. This is a strong argument against SaaS packages hosted outside the jurisdiction.

What does annual maintenance cost?

For a package, budget 18 to 22 % of the licence each year. For a custom solution, Kolonell maintenance runs from 35,000 to 120,000 FCFA (53 to 183 EUR) per month depending on the level, with regulatory changes quoted separately.

Let's scope your project. We work with your compliance team to define the KYC, scoring and alert scope, then a release plan by functional batch. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.