Costs and pricing

How the money moves

The platform pays for almost everything. Vendors charge per check, per profile or per year; the sponsor bank charges program fees on top and keeps a veto; the customer pays in time, which shows up as churn; and regulators charge for failure.

How companies of different sizes use it

Headcount says little about what a company needs here, so I've sized companies by where they sit on the regulatory ladder (no duty of their own, a rented program, a program on a sponsor bank, their own licences, a bank charter) and by how many applications they check. The five labels follow that ladder roughly, and companies skip steps: a Fortune 500 retailer that opens a marketplace has its own INFORM duty from day one, and a small crypto firm with its own licences looks mid-market on compliance and like a startup on everything else. Nobody publishes this spend by size, so the figures are my rough estimates.

A startup, in this sense, has no legal duty of its own or rents its program, and checks up to a few hundred applications a month. A B2B software company that checks users only for fraud runs a document plus selfie at signup, maybe with a business lookup. A vertical software company that embeds payments often rents the whole program: on Stripe Connect, onboarding and identity checks come with the platform, and its own job is collecting the data and answering Stripe's requests for more. Self-serve tools fill the gaps, such as identity checks from Persona, Veriff or Sumsub and screening on ComplyAdvantage's starter plan, and Persona runs a free program for early startups. A founder or the head of operations owns it. My rough estimate is under $30,000 a year in tools. A startup that goes straight to a sponsor bank pays mostly for the compliance owner and independent audit the bank usually requires, which takes it to $150,000-400,000 all in. It moves on when the bank or payfac asks for more, when the product lets money leave faster (instant payouts, cards, lending), or when it wants control of the onboarding flow and the margin.

A scale-up runs its own program on a sponsor bank and checks anywhere from hundreds to tens of thousands of applications a month; the scheduling software from the start of this guide is a small one. The program covers KYB with ownership, checks on the owners, screening, transaction monitoring, case management and drafting suspicious activity referrals for the bank, all to the bank's bar. It buys a layer at a time, for example Persona for identity, Middesk for KYB, ComplyAdvantage for screening and Unit21 or Sardine for monitoring, and the bank approves each vendor. A head of compliance or BSA officer (the person accountable for the anti-money-laundering program, which the bank usually insists on) owns it, with a small team of analysts and a product manager for onboarding. My rough estimate is $300,000 to $2 million a year all in. The checks paid one by one are a few percent of that, and analysts and monitoring are most of it, which is why I'd budget identity as headcount rather than as a price per check. The cost per business falls as volume grows and the fixed cost spreads, unless alerts grow faster than the team. Exam findings or an order on the bank, the program fee compared with the cost of its own licences, expansion into new states or countries, and an alert backlog push it on.

A mid-market company holds its own licences, or is a small community bank, and checks tens of thousands of applications a month. It meets regulators directly, the way Block did. One licensing consultant puts licences in every US state at well over a million dollars and about two years, and going abroad adds Canada's money services registration or a UK or EU e-money licence. It runs several identity vendors behind an orchestration layer (one for documents, one for data, a fallback), buys registry data at scale and runs its own screening and monitoring platforms; community banks often buy monitoring from vendors close to their core banking system, such as Nasdaq Verafin. Vendor choice is now the company's own, but every model needs validation and an audit trail an examiner can read. A chief compliance officer owns it, with a BSA officer or MLRO (money laundering reporting officer), a financial-crime operations team in the tens, a fraud data science team and a product manager for onboarding. My rough estimate is $2-15 million a year, mostly people. International expansion, a bank charter application, an IPO or a regulator's finding push it to the next step.

An enterprise is licensed in many countries, or is a regional bank, and checks hundreds of thousands of applications a month. It onboards across dozens of licences, keeps its own ownership graph, reviews customers when something changes as well as on a schedule, and builds its own monitoring models. Review teams are large and often partly offshore: Wise says about a third of its staff work on financial crime. It buys from the incumbents on multi-year contracts (LSEG's World-Check or LexisNexis for lists, Moody's Orbis or Dun & Bradstreet for company data, NICE Actimize or Quantexa for monitoring) alongside several identity vendors and its own tools. A chief compliance officer reports to the board, with an MLRO in each country, a financial-crime organization in the thousands and platform teams that own onboarding and the entity graph. My rough estimate is $20-200 million a year. Regulators in several countries can limit its onboarding, as the UK's did with Monzo and Starling, and growth, a bank acquisition or an enforcement action that forces remediation moves it up.

A Fortune 500 company (one of the largest US companies by revenue) here means mostly the large banks and the biggest payments and marketplace platforms, with millions of customers to check and watch. Large banks run KYC teams in the thousands, and onboarding a corporate client is a separate product that can take months. Platforms with duties of their own, such as marketplaces under INFORM and payments companies like Block, run identity in-house with several vendors in parallel for coverage and failover, and their own fraud data. A board-level chief compliance officer owns it, with a global financial-crime organization, model risk management and procurement for multi-year data deals. My rough estimate is $100 million to over $1 billion a year for the largest banks; I haven't seen figures for the big platforms. Remediation can outweigh all of it: TD expects to spend about US$550 million in its 2026 fiscal year on fixing its US anti-money-laundering program, more than planned because of lookbacks. There's no next size up. The pressure comes from monitorships and consent orders, and on those the regulator sets the timeline.

What changes as a company grows (spend is my rough estimate):

Alerts are what make monitoring expensive at every size. Large US banks' numbers from 2017 show roughly 16 million alerts producing 640,000 reports, so about 4% of alerts led to a report. For sanctions name hits, the true-match rate rounds to zero. Most of a monitoring team's day is clearing alerts that were never going to matter. The industry total for financial-crime compliance in the US and Canada was about $61B a year in a vendor-commissioned study, and labour was the biggest part.