Compliance teams rarely buy technology for its own sake. In our conversations, two questions came up again and again: will it reduce the cost of doing the work, and will it stand up when the regulator asks?
Financial crime compliance is expensive. UK financial institutions spend an estimated £38.3 billion a year on it, according to LexisNexis Risk Solutions. Costs rose 12% in 2023 and are up nearly a third since 2021. For the compliance and financial crime leaders Shape Finance spoke to, that cost sits behind the technology conversation.
Yet cost alone does not make the business case. The investments practitioners described most often did two things at once: they reduced the manual effort behind the work, and they made the result easier to defend.
Where the manual effort sits
Across very different firms, the same areas came up again and again: investigations, customer due diligence (CDD) and, at smaller firms, manual reviews triggered by screening hits.
Investigations come first. A former financial crime leader at a cross-border payments firm said the priority was lowering “the headcount or the hours that go into ops, into investigations”, because “that is where most of the money goes.”
Customer due diligence sits right alongside. A financial crime leader at a large payments processor named both together: “transaction monitoring being a key one, customer due diligence being the other.” The two are tightly linked. A senior member of the financial crime team at an e-money firm said financial crime operations and the second line together make up “a fifth to a quarter of the overall headcount of the business.” They explained part of the reason: “you can’t effectively do a transaction monitoring investigation without reviewing the customer due diligence information.” In other words, every alert review is also a CDD review, which is where the cost builds.
Smaller firms feel it in different places. A compliance manager at a payments firm described manual reviews whenever high-risk jurisdictions or adverse media are flagged. A compliance lead at a small insurer described sanctions screening hits that need “human intervention” to confirm whether a customer really is the person on the list.
Cost is the starting point
When the payments processor’s financial crime leader was asked what was driving the pressure, their answer was direct: “genuinely it’s costs.” The logic, they explained, is to get customers onboarded faster, because “the longer you [on]board and the more touch points you have, the more expensive it is.” Faster onboarding also means revenue starts sooner. Firms want to do it compliantly, to avoid fines, and with as few manual touch points as possible.
A compliance leader at a large money transfer business described the same aim: using technology “to better resolve alerts with fewer human bodies, because that kind of then rolls into costs.”
For smaller firms, the pressure is sharper still. Any decisions “need to be commercially viable,” said the insurer’s compliance lead, whose biggest challenge is “being proportionate to the risk and making sure that you’re still doing everything that you need to do” without letting costs accumulate.
Technology is part of the bill too. The same LexisNexis study found that firm-level cost increases were largely driven by technology investment, which grew at twice the rate of employee-related costs. Every new tool has to earn its place.
In our view, cost explains why firms look at technology. It rarely explains what they choose.
Defensibility decides what gets bought
Whatever a firm buys has to survive scrutiny, and the payments processor’s financial crime leader had seen what happens otherwise. Plenty of firms turned to technology to cut costs, but “not always correctly”, they said. “A lot of the companies that were screaming, we fixed due diligence, we’re a fintech, we’re amazing, suddenly have got big problems with their due diligence and the regulator.”
The former payments leader put it plainly: “you don’t just spend money to say you have it.” Any new approach needs “actual edge and something that is going to pass the regulator.” The regulatory downside is just as concrete. In July 2025, the FCA fined Monzo £21 million after finding its financial crime controls had not kept pace with its rapid growth.
So what does “defensible” mean in practice? Leaders gave three answers.
You can’t point at the tool. A compliance leader at a payments firm said that when regulators get involved, “you can’t just say, well, it was the AI.” Firms need to be able to explain what the tool did and why a decision went the way it did.
Someone still has to own the decision. A compliance leader at a start-up payments firm said regulators “will not ask the bot.” They will ask the human who reviewed its response what they did next.
The output has to be explainable. A compliance professional at a mortgage lender wanted a tool they could explain, not a “black box binary response” that flags fraud without saying why.
The e-money firm’s financial crime team member put it most simply. New tools don’t change the principles, which remain “explainability, data integrity, understanding how the tooling is being utilised.” Knowing your risks, assessing them across the customer portfolio and managing them proportionately at customer level is what gets you through regulatory interventions.
The best investments do both
The strongest cases combine the two. A compliance manager at a payments firm said the aim is to reduce the number of clicks an analyst has to make, which means tools that fit existing systems so nobody is “on like three different vendors trying to get the answer.”
Quality matters as much as speed. Transaction monitoring, the e-money firm’s financial crime team member said, is “as much about quality” as volume. And automation can strengthen the audit position: a compliance leader at a large money transfer business pointed out that “it’s easier to test a model than the individual work of an individual human.”
But the two goals can pull apart. The former payments leader described a regulatory worry that people reviewing automated output stop really checking it. Faster review only helps if the review is still real.
In our view, that makes efficiency and defensibility partners with a condition attached. Efficiency without defensibility is a false economy, and defensibility without efficiency is unaffordable.
What this means for leaders
Before making the case for the next compliance technology investment, it is worth asking:
- Where does investigator time actually go? Measure the hours, especially on obvious non-matches and repeat look-ups, before choosing a tool.
- Will it make each decision easier to explain? A tool that saves time but leaves gaps in what was checked, and why, is a false economy. A named person should still be able to own the outcome.
- Does it improve quality as well as volume? Feeding investigation outcomes back into due diligence and rule tuning is where the quality gain comes from.
- Is it proportionate? Match the investment to your risk profile and size, rather than to what the largest firms use.
In a function where every pound and every decision can be questioned, the investments worth making answer both questions at once: is the work cheaper to do, and is it easier to defend?
Continue the conversation
What does a strong business case for compliance technology look like?
Senior compliance and financial crime leaders will be comparing notes on exactly that at FinTech Compliance Leaders on 9 March 2027, Shape Finance’s invitation-only forum.
