The verdict in three sentences
An FCA-authorised payment institution can no longer run onboarding and sanctions screening on spreadsheets and disconnected tools: the FCA expects a risk-based, fully evidenced approach under the Money Laundering Regulations 2017. Two paths coexist: SaaS building blocks billed around GBP 0.40 to 1.60 per check, or an integrated platform with a market budget of roughly GBP 250,000 to 600,000. Above 10,000 onboardings a month, an owned platform that orchestrates SaaS blocks is usually the best option, delivered in 6 to 9 months.
What the UK framework requires in 2026
The MLRs 2017, the JMLSG guidance and the FCA's Financial Crime Guide require payment institutions to identify and verify customers, assess risk, apply enhanced due diligence to PEPs and high-risk third countries, screen against the OFSI consolidated list and other relevant lists, monitor transactions and file Suspicious Activity Reports (SARs) to the NCA. FCA reviews of payments firms have repeatedly flagged the same weaknesses: incomplete customer files, no periodic refresh, alerts closed without rationale. Since 2024, the Consumer Duty also pushes firms to avoid needlessly blocking legitimate customers.
| Obligation | What the software must do | Risk if missing |
|---|---|---|
| Identification and verification | Document capture, data checks, selfie and liveness | Accounts opened with fake IDs |
| Risk assessment | Customer score by country, activity, channel, amounts | Uniform due diligence, wasted cost |
| PEPs and sanctions | OFSI, UN, OFAC and EU screening | FCA action, OFSI penalties |
| Transaction monitoring | Thresholds, structuring, velocity, mule patterns | Undetected laundering, APP fraud exposure |
| SAR filing | Alert case file, workflow, NCA submission support | Failure to report offence |
| Periodic review | Refresh files according to risk level | Stale customer base |
| Audit trail | Timestamped history of every decision | Cannot justify decisions to the FCA |
Comparing the options
| Option | Cost (2026 order of magnitude) | Timeline | Strengths | Limits |
|---|---|---|---|---|
| SaaS blocks only (identity, screening) | GBP 0.40 to 1.60 per check + GBP 1,000 to 4,000 a month | 1 to 3 months | Fast start | No single customer view, scattered workflow |
| Tailored platform + SaaS blocks | GBP 250,000 to 600,000 | 6 to 9 months | Workflow fits the firm, data owned | Structuring project to manage |
| Enterprise AML suite | GBP 400,000 to 1.5 million licence and integration | 9 to 15 months | Feature-rich | Cost, oversized for a PI |
| Core platform add-on module | Varies by vendor | 3 to 6 months | Integrated | Often weak on screening and mobile |
| Manual checks | 3 to 6 compliance FTE | Immediate | None | Not sustainable above 2,000 customers a month |
Key technical point: name matching across diaspora customer bases (multiple spellings of Mohammed, transliterations from Arabic, Cyrillic or Urdu) is hard. A poorly tuned screening engine produces 5 to 10 % false positives and buries the compliance team.
How Kolonell works on this
We build these platforms as part of our custom web applications and our cybersecurity offer. A regulatory compliance project goes beyond the top of our complex grid (7,000,000 to 15,000,000+ FCFA, 10,670 to 22,870+ EUR) and is priced in a detailed quote after scoping, with documented hosting and penetration testing. Maintenance follows our plans at 35,000, 75,000 or 120,000 FCFA per month (53, 114 or 183 EUR), with enhanced support priced in the quote if needed.
Our approach: risk mapping with the MLRO, selection of identity and screening blocks, construction of the single customer file and alert workflow, then testing on anonymised real cases before go-live.
Mini case study
Rachel, MLRO of a London payment institution, handles 15,000 new onboardings a month with 6 analysts.
- SaaS only: 15,000 checks × GBP 1.00 = GBP 15,000 a month plus GBP 2,500 screening, about GBP 210,000 a year.
- Integrated platform at GBP 400,000 that triggers paid biometric checks only for medium or high-risk profiles (30 %), with low-risk customers verified through cheaper electronic data checks at GBP 0.20: 4,500 × GBP 1.00 + 10,500 × GBP 0.20 = GBP 6,600 a month plus GBP 1,800 screening, about GBP 100,800 a year.
- False positives cut from 8 % to 2 %: 900 fewer alerts a month, freeing about 2 analysts for transaction monitoring, roughly GBP 110,000 a year.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Combined annual saving: about GBP 220,000. The platform pays back in under 2 years, faster as volumes grow.
FAQ
Can data be hosted outside the UK?
UK GDPR allows transfers to adequate countries, including the EEA, or with safeguards such as the IDTA. Many firms keep identity data in a UK region and call SaaS blocks without long-term storage.
Which sanctions lists must we screen?
At minimum the OFSI consolidated list. Most payment institutions also screen UN, OFAC and EU lists, since correspondent banks and card schemes expect it. Lists should refresh at least daily.
How long does full compliance take?
Allow 6 to 9 months for the platform, then 3 to 6 months to refresh the existing customer base by risk level, high-risk customers first.
Does the system file SARs automatically?
It prepares the case file, history and evidence, and the nominated officer decides. The decision to report stays human, which is what the NCA and FCA expect.
How does this help in an FCA review?
The audit trail shows within minutes who approved which file, when and on what basis. That is often what makes the difference during a supervisory visit.
Let's scope your project. Share your onboarding volumes, core platform and latest audit findings and we will return an architecture and a staged compliance plan. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
