Build AML compliance in-house or partly outsource it?
Updated: 2026-11
In-house AML compliance pays off when new clients are onboarded regularly and knowledge of the mandates sits internally anyway. Partial outsourcing helps with set-up, peaks and specialist knowledge. Either way responsibility stays with the financial intermediary; the work can be outsourced, not the duty.
Newly covered advisers and small financial intermediaries face an early question: build AML compliance themselves or hand parts to a provider. Both are permitted as long as responsibility remains clear.
The decision depends less on price than on how well an external provider can assess the mandates and structures at all.
Head to head
| Criterion | AML compliance in-house | Partly outsourced |
|---|---|---|
| Knowledge of mandates | Sits with the people who know the clients. | Must be conveyed to the provider. |
| Set-up | Needs time and training. | Faster thanks to existing templates and experience. |
| Running costs | Internal time and training. | Fees, but less internal time. |
| Specialist knowledge | Limited, especially with complex structures. | Broader, for example on sanctions or crypto. |
| Dependency | On individuals in-house. | On the provider and its availability. |
| Responsibility | Internal. | Also stays internal, including oversight of the provider. |
When AML compliance in-house wins
- —New clients are onboarded regularly and clarifications require detailed knowledge of the mandates.
- —Someone has the time and interest to take on the AML unit and get trained.
- —Structures are manageable and repeat.
When Partly outsourced wins
- —Membership must be prepared at short notice, for example for advisers newly covered by December 2026.
- —There are complex individual cases requiring specialist knowledge.
- —Volume fluctuates strongly, so internal capacity does not pay off.
Our take
For most small organisations a mixed model works: set-up with external support, ongoing operation in-house with clear processes and a tool, specialist questions externally.
Anyone outsourcing sets out in the contract which tasks are transferred, how the provider reports and how internal oversight works. The SRO wants to see that responsibility is actually exercised.
Parent service: Digital Transformation
FAQ
May the AML unit be outsourced?
Parts of the work can be transferred. Responsibility for compliance remains with the financial intermediary, and the rules of the respective SRO apply.
What must stay internal?
Decisions on accepting clients and on reports, and oversight of the provider.
Does software help in-house operation?
Yes, because it manages deadlines, evidence and the audit trail and so takes over most manual work.