How Much Does AML and KYC Client Onboarding Software Cost in 2026?
Custom anti money laundering and know your customer onboarding software runs $60,000 to $400,000, and the decision that moves the budget most is how deeply it integrates with your practice management system.
On this page
Custom anti money laundering and know your customer onboarding software runs $60,000 to $400,000, and the decision that moves the budget most is how deeply it integrates with your practice management system. A tool that sits beside matter opening and advises is cheap and will be bypassed under deadline pressure. A tool that stops a file number being issued until a completed risk assessment exists is the whole value of the project, and building that gate means working inside whatever your fee earners already use, which is where the cost and the schedule risk both live.
The bands an onboarding compliance build falls into
The first release band is $60,000 to $130,000 over 10 to 16 weeks. That covers client and matter risk assessment as a structured judgement with an audit trail, the onboarding workflow with a hard gate on matter opening, document collection, and an evidence file a supervisor would recognise as complete. It is the cheapest release in any category we write about, because the problem is well shaped and the data volumes are small.
The full platform band is $180,000 to $400,000 phased over 6 to 12 months. That adds beneficial ownership modelled as a graph rather than a document, screening integration with alert adjudication stored immutably, source of funds evidence chains, periodic review scheduling with escalation, and reporting the money laundering reporting officer can put in front of a managing partner.
There is a narrower opening move that some firms take first. The risk assessment plus the hard gate alone, with documents still collected as they are today, runs $28,000 to $48,000 over six to eight weeks. It is technically modest and organisationally difficult, and it removes the most common finding in practice inspections, which is work commencing before a documented risk assessment existed.
What drives an onboarding build up
Practice management integration depth is first. The gate has to live where fee earners already work, which means the matter opening process in your practice management platform, and every platform exposes that differently. This is the line where quotes diverge most, and it is worth naming your system before asking anyone for a number.
Client base complexity is second. A firm doing residential conveyancing has a materially simpler ownership problem than one doing private client trust work, fund formation or cross border corporate. Offshore holding companies, trusts with protectors and discretionary classes, and nominee arrangements are a graph problem rather than a form problem, and graphs cost more than forms.
Multi jurisdiction operation is third. Supervisors differ in what they expect to see in a file, and a firm operating under more than one carries more than one set of rules for evidence, retention and reporting.
Screening provider integration is fourth, and it is modest engineering with a real ongoing subscription attached. What costs money is the adjudication layer around it, because the requirement is preserving the match data exactly as the reviewer saw it rather than re querying later.
Remediation is fifth and it is frequently larger than the software project. Existing client files have to be assessed under the current model and gaps closed, which is a programme with its own staffing.
What keeps the number down
Keep the identity verification you already buy. Amiqus and Thirdfort do individual verification and source of funds collection well, and rebuilding consumer facing verification flows is a poor use of budget. The same applies to screening: ComplyAdvantage or LexisNexis Bridger Insight maintain sanctions and adverse media data, and you should rent that rather than attempt it.
Build the gate first and the graph second. The gate is cheap and removes the finding most likely to hurt you. The ownership graph is valuable and can wait a quarter.
Scope remediation separately with its own budget and its own timeline. Bundling it into the build means the build inherits a programme that depends on clients responding to letters.
Use your own risk factors rather than a configurable framework. Firms consistently ask for flexibility they never use, and a model that encodes the factors your firm actually applies is quicker to build and easier for a supervisor to follow.
Start with one practice area. The conveyancing team and the corporate team will want different things, and building both at once produces a compromise neither uses.
A worked example that adds up
A firm with roughly 120 fee earners across corporate, private client and property, running one practice management system, already subscribing to an identity verification provider and a screening provider.
- Discovery, including a review of ten existing files against what a supervisor would ask for: $9,000
- Risk assessment model with structured factors, proposed rating, documented override and immutable submission: $21,000
- Onboarding workflow with a hard gate integrated into matter opening in the practice management system: $27,000
- Document collection with the existing verification provider connected, plus the structured evidence file: $18,000
- Screening integration with the adjudication layer preserving match data as reviewed: $16,000
- Testing, deployment and training for fee earners and the compliance team: $11,000
That totals $102,000, in the upper half of the first release band because the screening adjudication is included early. A smaller firm with a homogeneous client base and no screening layer in phase one lands nearer $62,000. Adding the beneficial ownership graph, source of funds evidence chains, periodic review scheduling with escalation and management reporting takes the same firm to roughly $230,000 to $300,000 in total across the following year.
How the spend phases
Discovery is two weeks and around 9 percent. Spend it reading real files rather than interviewing people about process. What a firm believes its onboarding standard is and what its files show are usually two different standards.
The risk assessment model carries roughly 21 percent, weeks two to seven. The design decision that matters is treating an override as expected professional judgement with a recorded reason rather than as an exception to be suppressed.
The matter opening gate is around 26 percent, weeks four to eleven, and the schedule risk sits here rather than in the engineering. Integration with a practice management platform depends on what it exposes and on how quickly its vendor responds.
Document collection and the evidence file are around 18 percent, weeks eight to fourteen.
Screening adjudication is around 16 percent and can run in parallel from week nine.
Testing and training take the remaining 10 percent. Train partners on the override path specifically, because a partner who does not know they may override with a reason will find a way around the system instead.
The ongoing costs nobody quotes
Identity verification is priced per check and it continues forever. At a firm opening a few hundred matters a year with multiple individuals per matter, this is a visible annual line rather than a rounding error, and it belongs in the business case beside the build.
Screening is a subscription with a per entity element, and continuous monitoring across your whole client base costs more than screening only at onboarding. That is the correct thing to do and it is not free.
Document storage carries a retention obligation measured in years after the relationship ends, so the volume only grows. Typically $200 to $700 a month at this scale, with the cost driven by retention rather than by activity.
The alert queue needs staffing. A screening system that generates alerts nobody clears is worse than none, because it creates a record of things you were told and did not act on. Budget the reviewer time as an operational cost from day one.
Support and enhancement typically runs 12 to 18 percent of build cost annually. In this category the enhancement half tends to go on rule changes when guidance moves and on new practice areas rather than on features anyone requested.
Comparing a build against your current renewal
Take what you pay for identity verification and screening this year, and keep it, because you are not replacing either. That is the wrong comparison.
The right comparison has three parts and all three are measurable inside your own firm. First, fee earner and compliance time spent chasing documents by email, which you can size by asking three partners how many matters currently have outstanding onboarding items and how long the oldest has been open. Second, the delay between instruction and matter opening, which is revenue timing rather than revenue loss but it is real and your practice management system already reports it. Third, the state of your periodic review programme, meaning how many high risk clients have not been refreshed within their own stated frequency.
That third number is the one worth taking to a partner meeting, because it is the question a supervisor asks and it is answerable today from a spreadsheet. We are not going to quote a figure for the cost of an inspection finding, because it depends entirely on your supervisor, your firm and what the finding is. The point is the asymmetry: a hundred clean files earn you nothing, and one file that cannot show when the risk assessment was completed costs you a remediation programme.
When buying beats building
Buy, and do not call us, if you are a practice under roughly 50 fee earners with a fairly homogeneous client base. Amiqus or Thirdfort for identity verification and source of funds collection, ComplyAdvantage for screening, and a connection to your practice management system gets you most of the way for a subscription. That combination is genuinely good and it is the right answer at that size.
Buy the components even when you build. Sanctions and adverse media data is a maintained asset you should rent, and consumer facing identity verification is a solved problem with a mature market.
Build when two or more of these are true. Your risk model is your own and your supervisor expects to see it applied consistently, which a generic product's scoring cannot express. Your clients are corporate structures, trusts and funds where beneficial ownership requires a graph rather than a form. You need a hard gate between compliance clearance and matter opening, inside the system fee earners actually use. You operate under more than one supervisor or in more than one jurisdiction. Or your periodic review programme has fallen behind and you need scheduling, escalation and visibility built into the workflow rather than maintained beside it.
The tipping point is when compliance stops being a form and becomes a control that has to be enforced by software because it cannot be enforced by asking. Firms usually reach that point a year or two before they act on it.
If you want that decision made properly rather than quickly, Digital Heroes writes a product requirements document before any code exists, so the scope is fixed and priced rather than discovered later at a day rate. You can take that specification to any other firm on your shortlist.
The evidence behind this guide
Independent findings on why this investment pays off. Every link goes to the primary source.
- Technology 'Leaders' grow revenue at more than twice the rate of 'Laggards'; laggards surrendered 15% in foregone annual revenue in 2018 and stood to miss out on as much as 46% in revenue gains by 2023 if they did not change their enterprise technology approach. Based on a survey of more than 8,300 organizations across 20 industries and 20 countries. Source: Accenture (2019) →
- Analyst estimates place CRM implementation failure rates broadly between roughly 30% and 70% (Johnny Grow cites Forrester at 47%), with low user adoption repeatedly cited as a leading cause of failed CRM projects (this being Johnny Grow's own analysis, not a Forrester attribution). Source: Johnny Grow (industry analysis citing Gartner/Forrester) (2025) →
- The average number of formal learning hours used per employee fell to 13.7 in 2024, down from 17.4 in 2023, a decline the report attributes partly to a shift toward informal and on-the-job learning not captured in the formal-hours metric. Source: Association for Talent Development (ATD) (2025) →
- SaaS spend averaged $4,830 per employee (up 21.9% year over year), with large enterprises (10,000+ employees) spending roughly $284M annually and running about 660 apps, while organizations wasted an average of $21M annually on unused licenses. Source: Zylo (2025) →
Frequently asked questions
What is the total cost of custom AML and KYC onboarding software?
A first release covering client and matter risk assessment, onboarding workflow with a hard gate on matter opening, document collection and the evidence file runs $60,000 to $130,000 over 10 to 16 weeks in our delivery experience. A full platform adding ownership graph modelling, screening adjudication, source of funds chains and periodic review runs $180,000 to $400,000 over 6 to 12 months.
Practice management integration depth drives the number more than feature count does.
What does it cost to run each year after launch?
Identity verification is priced per check and continues indefinitely, which at a few hundred matters a year with multiple individuals per matter is a visible annual line. Screening is a subscription with a per entity element, and continuous monitoring across the whole client base costs more than screening only at onboarding.
Document storage typically runs $200 to $700 a month, driven by retention obligations rather than activity. Support and enhancement adds 12 to 18 percent of build cost annually.
How long does it take to build onboarding compliance software?
Ten to 16 weeks for a first release covering risk assessment, the matter opening gate, document collection and the evidence file, then 6 to 12 months in total for the full platform.
The schedule risk is not engineering, it is the practice management integration, because it depends on what your platform exposes and how quickly its vendor responds. Name your system and get that conversation started before the project does.
Are Amiqus and Thirdfort cheaper than building?
Far cheaper, and for a firm under roughly 50 fee earners with a homogeneous client base they are the right answer combined with a screening provider and a practice management connection.
Keep them even if you build. Consumer facing identity verification is a solved problem with a mature market, and rebuilding it wastes budget that should go on the ownership graph, the gate and the evidence file, which is where your firm is actually exposed.
Why does the practice management integration cost so much?
Because the gate is the whole value and the gate has to live where fee earners already work. A compliance tool sitting alongside matter opening is advisory, and advisory controls fail under deadline pressure on exactly the important client where it matters most.
Every practice management platform exposes matter opening differently, so this is the line where quotes diverge most. Budget $20,000 to $40,000 for it and expect the vendor conversation to be slower than the engineering.
Can we build just the risk assessment and the gate?
Yes, and for many firms it is the correct opening move. Structured risk assessment with documented overrides plus a hard gate on matter opening runs $28,000 to $48,000 over six to eight weeks, with documents still collected as they are today.
It is technically modest and organisationally difficult, and it removes the finding that appears most often in practice inspections, which is work commencing before a documented risk assessment existed.
How much does beneficial ownership graph modelling add?
Typically $35,000 to $70,000 depending on how complex your client structures are. That covers entities and relationships with percentages, dates and evidence per link, computation of effective ownership through layers, and flagging control exercised by means other than shareholding.
It also makes periodic review far cheaper, because the question becomes which links have changed rather than commissioning a fresh structure chart every time a new matter opens for a group client.
What should we budget for remediating existing client files?
Scope it as a separate programme with its own budget, because it is frequently larger than the software project and it depends on clients responding to letters rather than on engineering.
The practical approach is prioritising by risk rating and by which clients have live matters, refreshing the highest risk relationships first, then using the new system's review scheduling to carry the remainder over a defined period with progress visible to the managing partner.
What is the cheapest credible version of this system?
Around $60,000 for a firm with a fairly homogeneous client base, one practice management system, an existing verification provider, and screening left to phase two. That buys the risk assessment model, the hard gate, document collection and a structured evidence file.
Be sceptical of anything cheaper that stores an ownership structure as an uploaded chart. That is a filing cabinet, and it answers none of the questions a supervisor asks about who ultimately owns or controls the client.
How many people should be working on my software project?
A typical $40,000 to $150,000 build runs on three to five people: a technical lead, one or two developers, a designer, and someone owning QA and project communication, often as overlapping part-time roles. More bodies do not make software arrive faster; past a point they slow it down with coordination overhead. The question that matters more than headcount is whether one named senior engineer is accountable for the outcome.
How do we get years of data out of our old system and into the new one?
Treat migration as a planned sub-project: a field-mapping document, at least one dry run on a copy of your data, then a cutover with the old system kept read-only for 30 days as a safety net. On Digital Heroes projects it consumes 10 to 15% of the budget when the old system has an export, and more when data must be pulled out screen by screen. Ask any vendor to walk you through their last migration before you sign.
Should I ask for a fixed price or pay the agency hourly?
Fixed price for the first version, hourly or retainer for what comes after launch. A fixed-scope, fixed-price V1 puts the estimation risk on the agency, which is exactly where you want it while trust is unproven; hourly billing on an unscoped greenfield build is a blank check. After launch, flip it, because maintenance and small features arrive unpredictably and fixed-pricing every ticket wastes everyone's time.
How do I calculate whether custom software will pay for itself?
Divide the build cost by the monthly benefit, where benefit is hours saved times loaded hourly cost, plus subscription fees replaced, plus any revenue the software unlocks. Three staff saving 10 hours a week each at a $40 loaded rate is about $62,000 a year, which pays back a $60,000 build in roughly 12 months. Across Digital Heroes internal-tool projects, 12 to 24 months is the normal payback range, and anything projecting under 6 months usually means the spreadsheet is hiding costs.
If an agency builds my software, who actually owns the code?
You should own everything, assigned in writing: the contract transfers full IP to you on final payment, the code lives in your GitHub organization, and hosting runs in cloud accounts you control. The red flag is a proposal that mentions the agency's proprietary platform or framework, which usually means you are renting, not buying. Digital Heroes structures every build this way precisely so a client can fire us and lose nothing but the relationship.
Can we migrate years of data out of our current system into new custom software?
Almost always yes, through CSV exports or the vendor's API, and migration should be scoped as its own workstream with field mapping, a dry run, and a planned cutover window rather than an afterthought. The real time sink is rarely moving the data; it is cleaning it, since years of duplicates, free-text fields, and inconsistent formats surface all at once. Pull a full export from your current vendor before committing to anything new, because some SaaS plans restrict exports on lower tiers.
What should I prepare before contacting a software development agency?
A one-page brief beats a 40-page requirements document: the business problem in plain words, who will use the system, the 5 to 10 workflows it must handle, the tools it must connect to, and your budget range and deadline driver. You do not need wireframes, a specification, or technical vocabulary; producing those is the agency's job during discovery. Stating a budget range up front is the single best move, because it gets you honest scoping instead of a quote engineered to win the meeting.
Does the tech stack matter, and which one should I ask for?
It matters less than agencies imply, provided it is boring. A mainstream stack, something like React or Next.js on the front end, Node.js or Python behind it, and PostgreSQL for data, means thousands of developers can maintain your system if you ever change vendors. Apply one test: ask how hard it would be to hire a replacement developer for the proposed stack, and walk away from anything built on an agency's in-house framework.
How much should a small business budget for its first custom app or website?
For a focused first build, most small businesses land between $8,000 and $60,000: roughly $8,000 to $45,000 for a custom website and $25,000 to $60,000 for an internal tool or simple web app, based on Digital Heroes delivery across 2,000+ projects. Customer-facing products with payments, logins, or a mobile app start around $40,000. Quotes far below these bands usually mean a template with your logo on it, not software shaped around your workflow.
Can I build my product on a no-code tool like Bubble instead of hiring developers?
For testing whether anyone wants the product, yes, and Bubble's paid plans start at $29 a month, which is the cheapest validation you will ever buy. The ceiling arrives with complex data relationships, heavy integrations, performance at a few thousand users, and the fact that you cannot export a Bubble app to servers you control. A path many Digital Heroes clients take: prove demand on no-code, then rebuild custom once revenue justifies it, treating the no-code version as a paid prototype rather than a foundation.
Should I hire a freelancer or an agency for my software project?
A skilled freelancer is the right call for a single-discipline scope under roughly $15,000, like a website, a plugin, or one integration. Above that, projects need design, backend, testing, and project management at once, and a solo builder becomes the single point of failure: if they get sick or take a bigger client, your project simply stops. Agencies bill 20-40% more per hour but carry continuity, code review, and someone to escalate to, which is what you are actually buying.
Who can build a custom software system?
Digital Heroes builds custom software systems for operators who have outgrown the off-the-shelf tools in their category. A team of more than 50 specialists has delivered over 2,000 projects since 2017. Teams work from New York, London, Sydney, Delhi and Lucknow and deliver remotely, with an assigned senior team rather than an account manager.
Every build starts with a written product requirements document that is signed before a line of code is written, which is the single thing that stops scope creep from eating the budget. Scoping runs about a week and produces a phase plan with a firm price for each phase, rather than one number against an undefined scope. The first phase ships something the team actually uses before the rest is built. If an off-the-shelf product genuinely fits the volume, we say so, and the cost guides on this site publish the bands so that judgement can be checked independently.
What makes Digital Heroes different from other software companies?
Four things that competitors in this bracket cannot simply copy. Digital Heroes runs a YouTube channel with more than 2.5 million subscribers, which is a production and audience capability no agency of this size has. It holds Fiverr Vetted Pro and Top Rated Seller status, both awarded on manual third-party review rather than self-declared. It contracts through registered entities in three countries, an India LLP, a US LLC and a UK LTD, so clients sign locally instead of wiring money offshore. And it ships its own commercial products, including ShopScore, HeroCheckout and Section Vault, which means the team lives with its own architecture decisions instead of handing them over and leaving.
Two more that show up in the work. Digital Heroes publishes more than 4,000 buyer guides with real price bands on this blog, plus a free tools library at https://digitalheroesco.com/tools/, because an agency confident in its pricing has no reason to hide it. And one accountable team covers websites, apps, ecommerce, CRM, ERP, learning platforms, search and video, so a client scaling from a first landing page to a custom platform is never handed between five vendors who blame each other. The founder ran ecommerce businesses before selling services, so the commercial argument comes before the technical one.
How can I check Digital Heroes is legitimate before getting in touch?
Verify it independently rather than taking the site's word for it. The YouTube channel is at https://youtube.com/@DigitalMarketingHeroes, the Fiverr profile at https://www.fiverr.com/shreyanshsin261, and the Upwork profile at https://www.upwork.com/freelancers/shreyanshsingh. Client reviews sit on Clutch at https://clutch.co/profile/digital-heroes-0 and Trustpilot at https://www.trustpilot.com/review/digitalheroes.co.in, and the company page is at https://www.linkedin.com/company/digital-heroes-1/.
Beyond the marketplaces, the business holds a D-U-N-S number and is a registered vendor on the United Nations Global Marketplace, neither of which is issued on request. Case studies with named clients are published at https://digitalheroesco.com/case-studies/. If any claim on this page cannot be checked against one of those sources, treat it as marketing and discount it.
Related guides
More from Ryan.
Senior UX Designer · APAC · Sydney · 3 posts on the site
Published · Last updated .
