Build versus buy for AML software is a question of total cost and accountability, not of licence price against engineering salaries. Building moves product, data and upkeep costs onto your team, while buying moves them to a vendor and adds a vendor-management duty. In both cases, BSP-supervised institutions remain accountable for the controls.
This guide gives a framework and a worksheet with blank cost lines for you to fill in. It uses no savings percentages, because the figures commonly quoted for the cost of AML compliance cannot be traced to a comparable source, and the real cost varies widely by institution. Fyscal ARCX is an AML product, so we say below what would make building the better answer.
It is written for CFOs and CTOs who hold the budget, and for heads of AML who will live with the result.
What does the build-versus-buy decision cover?
It covers who designs, runs and keeps current each AML capability, for screening, monitoring, case management and reporting.
The choice is rarely all or nothing. A team can build monitoring scenarios on a bought case management system, or buy screening and build its own reporting layer. Even a system built in-house depends on external inputs, such as list data and the AMLC's reporting format, and each of those changes over time. The AMLC's GoTRACS issuance, for example, phases in a new reporting format and new document-upload requirements over one to three years from effectivity. Whoever owns the system owns the work of following that change.
What does BSP require whichever route you take?
BSP keeps the accountability with the bank, and the testing and evidence expectations apply to built and bought systems alike.
BSP's outsourcing rules, as reported on Circular 1137, require banks to assess whether each outsourcing arrangement is material, and bar outsourcing of inherent banking functions such as taking deposits, granting loans, managing risk exposure and general management. Banks must also assess outsourcing risks periodically, ensure the portability of the outsourced service, and carry out due diligence on the provider's financial soundness, reputation and technical capability. The same report says banks hold primary responsibility for ascertaining the adequacy of design and effectiveness of controls. The earlier guidelines on outsourcing state that the board and senior management remain responsible for outsourced activities and give BSP examiners access to the service provider.
A hosted AML platform may fall within these rules, so assess it as an outsourcing arrangement under your own policy. If the platform includes AI, BSP's M-2026-031 applies a shared-responsibility model to outsourced providers. For monitoring, BSP's Memorandum M-2023-013 covers system design and pre-implementation testing and independent testing, whoever built the system.
Where does the cost of building come from?
It comes from the ongoing work of keeping a system current, tested and evidenced, far more than from the first release.
The worksheet below lists the cost lines to price for each route. Leave the last column blank until you have your own figures, and do not borrow a number from a vendor's marketing.
| Cost line | If you build | If you buy | Your figure |
|---|---|---|---|
| Initial development or implementation | Design, build and test of each module | Implementation and configuration | |
| Integration | Pipelines from core banking, channels and onboarding | Connectors and mapping work | |
| Detection content | Writing and maintaining rules and scenarios as typologies change | Vendor content plus your own configuration | |
| List data and updates | Sourcing, loading and verifying lists | Included or licensed | |
| Case management and audit trail | Case tooling, timeline, locking at closure | Included | |
| Regulatory reporting | Building and updating filing formats | Included or add-on | |
| Model validation (if ML is used) | Validation staff or external reviewer | Vendor documentation plus your validation | |
| Testing and independent review | Test data, test harness, reviewer support | Reviewer access to documentation | |
| Security, hosting and resilience | Your infrastructure and controls | Vendor's, assessed by you | |
| People | Engineers, product owner, analysts | Administrator, analysts | |
| Vendor management and exit | Not applicable | Due diligence, monitoring, exit plan | |
| Opportunity cost | Engineering time not spent elsewhere | Configuration time |
Which costs are easy to miss?
Regulatory change, key-person risk and the time it takes to produce evidence are the three that budgets usually leave out.
Regulatory change. BSP and AMLC issuances change thresholds, formats and clocks. If every change needs an engineering ticket, the delay is a compliance risk as well as a cost, a point we develop in our piece on why AML implementations take so long.
Key-person risk. A built system often depends on the two people who understand it. Plan for their absence.
Evidence. An examiner will ask for calibration records, change approvals and closed-case reasoning. A built system has to produce these as well, and our guide to threshold tuning describes what that record looks like. The independence of whoever tests the system matters too, as we explain in who checks the auditors.
When does building make sense?
Building makes sense when you have unusual requirements, real engineering and validation capacity, and the commitment to keep the system current.
Four conditions favour it. The products or data are unusual enough that no vendor covers them. The institution already employs engineers and a model validation function. The leadership will fund upkeep for as long as the system runs. And the AML team can specify requirements in detail, because a built system embeds whatever the team knew when it wrote the specification. If fewer than all four apply, price the build as a long programme and not a project.
When does buying make sense?
Buying makes sense for teams that need to show working controls soon, with regulatory content maintained by someone else.
A team of five to fifteen rarely has spare engineering capacity, and our guide to AML for rural and cooperative banks shows how stretched such teams are. Buying shifts the maintenance of detection content, list handling and reporting formats to a provider. It does not shift accountability, so the buyer needs to test what the vendor says. Our buyer's guide lists 25 questions to ask, and our overview of what RegTech can and cannot do sets expectations. Ask each vendor to model pricing against your actual volumes, and ask for the contract terms on documentation access, audit rights and exit.
What about a hybrid?
Buy the core, and build only the connections and the logic that make your business different.
Many institutions land here. The vendor supplies screening, monitoring, cases and reporting, while the institution builds its own data feeds and a small amount of custom analysis. The test for a hybrid is portability. If you can export your rules, case history and configuration, the exit cost stays bounded, which is also what the outsourcing rules ask a bank to consider.
How do you use the worksheet to decide?
Fill in both columns over a five-year horizon, then test the result against four questions.
- 01Which route gets you to a defensible, evidenced control soonest?
- 02Which route keeps the system current with regulatory change at the lowest risk?
- 03Who is accountable for each cost line, and can they show it to an examiner?
- 04What would it cost to leave, and how long would that take?
If the answers to the first and second questions point the same way, the decision is usually clear. If they conflict, the extra cost of the safer route is the price of the risk you are avoiding, and the board should see it stated that way. To reduce the cost of AML compliance under either route, fix alert quality first, because every false positive adds to the analyst workload in both columns.
How does Fyscal ARCX fit the buy route?
Fyscal ARCX is built so that compliance teams, not engineers, own the day-to-day changes. In Transaction Monitoring, a compliance team defines its own variables and rules, tests them against historical data in a dry run before activation, and has a record of each change. Case Management brings related alerts into one case per customer with a timestamped timeline, and Regulatory Reporting prepares filings from the case record. Connectors bring in data from internal and third-party systems.
If you want to compare the build and buy columns with real numbers, book a walkthrough of Fyscal ARCX and bring your cost worksheet.