Every fintech eventually faces the RegTech build or buy question for KYC, sanctions screening and transaction monitoring. We asked industry leaders how to make the call, and recent fines show that the firm keeps the risk whichever way it goes.

Compliance is one of the largest fixed costs in fintech. A LexisNexis study with Forrester found that financial crime compliance costs US and Canadian institutions $61 billion a year, and that costs had risen at 99% of them. The rules also keep moving. On 28 January 2026, the UK closed the OFSI Consolidated List and made the FCDO’s UK Sanctions List the single source for designations. As a result, any in-house screening engine tied to the old feed needed rework. That kind of change sits at the heart of every RegTech build or buy decision.

We asked compliance officers, CTOs and founders one question: when did you decide to buy a RegTech tool instead of building compliance in house, or the reverse, and what would you do differently? We also asked for KYC, AML and sanctions examples, with costs and timelines. Three people answered, and we used two. Neither runs a regulated fintech’s compliance function, so we checked their advice against regulator guidance and recent enforcement.

RegTech build or buy: what the fines show

First, the enforcement record. In October 2024, the FCA fined Starling Bank £28,959,426 after its automated sanctions screening had checked customers against only a fraction of the full UK list since 2017. Then, in July 2025, the FCA fined Monzo £21,091,300 over onboarding, risk assessment and transaction monitoring failures. Meanwhile, in the US, New York’s financial regulator fined Block $40 million over Cash App’s anti-money laundering programme. Its alert backlog grew from 18,000 in 2018 to more than 169,000 by 2020, partly after new monitoring tools went live.

None of these cases turned on the RegTech build or buy choice itself. Instead, each firm failed to test coverage, document its systems and add review staff as it grew. Also, regulators are clear that a vendor does not take the blame. The US banking agencies’ third-party risk guidance says using a third party does not reduce a bank’s responsibility. In the UK, the FCA’s SYSC 8 rules say the same about outsourcing.

Buy the engine, build the layer around it

Our first respondent runs an Indian software development and IT outsourcing firm with a US office in San Jose, California.

The time to buy a RegTech tool is when you see that the true cost of compliance comes after the first build, in keeping up with regulation for years. For high-liability functions like KYC and AML, firms often fixate on the few months of development time and capital spend needed to build in house. They overlook the long-term staff needed to track global list updates and handle surges in false positives. I have seen product roadmaps stall because senior engineers were pulled off to patch a compliance module after a sudden change in regional law.

The biggest hidden cost is your best developers working as part-time compliance analysts. If I were advising a founder today, I would buy the underlying compliance engine for its specialised logic and build a custom integration layer on top. That keeps the user experience unique to the brand while the vendor handles the accuracy of the screening data.

Selection criteria should also shift from integration speed to audit transparency. Many teams plug in a tool quickly, then find during a regulatory review that they cannot export a detailed decision trail for a specific flag. Choose vendors that offer deep logging and data portability, so you are never locked into a black box. Good execution means knowing which parts of your stack must be proprietary and which should go to specialists who track regulatory change full time.

Kuldeep Kundal, Founder & CEO, CISIN

Kuldeep’s audit trail point is the strongest RegTech build or buy advice here. Supervisors expect firms to explain why a system raised or closed an alert, even when a vendor built the model. His false positive warning also holds up. A 2024 peer-reviewed study notes that more than 90% of sanctions screening alerts turn out to be false positives. However, one point needs care. A vendor can keep list data current, but the regulated firm stays legally responsible for screening outcomes. Therefore, contracts should cover data quality, update times and audit access. Readers should also note that CISIN sells custom software development, including the integration work he recommends. It is not a fintech or a RegTech vendor.

Model three years, not three months

Our second respondent is a chartered accountant who serves as CFO of Verloop.io and runs CFO Matrix, a fractional CFO practice in Bengaluru.

The trap is assuming the off-the-shelf option is cheap and the bespoke option is expensive.

With an off-the-shelf tool, look at how much the cost per check rises and how much it will cost to get your data out. With a bespoke system, work out how many people you will need to maintain it when the rules change. That is an ongoing cost.

In general, if it is a common requirement and the rules change often, buy the software. If it is specific to your process and no vendor can provide it, build. Model both options over three years at three times your current volumes.

I cannot tell you where the breakeven point is, because it depends on your volumes, your jurisdiction and how much engineering resource you have.

Ankit Sarawagi, Curator, CFO Matrix

Ankit’s pricing point sits at the centre of any RegTech build or buy model, and it checks out. Most KYC vendors charge per verification, so costs grow in step with customers. For example, Stripe Identity lists $1.50 for a document and selfie check, which comes to $150,000 a month at 100,000 checks before any discount. Sanctions tools scale the same way. ComplyAdvantage’s Starter plan begins at $99 a month for 100 monitored entities, while larger firms move to quote-based contracts. Similarly, his warning on maintenance fits the UK list change, which forced in-house teams to repoint their feeds.

Still, his three-year, three-times-volume model is a rule of thumb rather than an industry standard. He gave no costs from a live project. CFO Matrix is a finance advisory practice, not a fintech.

Fintechbits analysis

Why the RegTech build or buy answer keeps changing

Taken together, the two answers point to a hybrid model. A firm can buy the screening engine and list data, then build the parts that touch its own customers and products. That approach matches what supervisors accept, as long as the firm can test and explain both halves. AI is also changing the sums, since vendors now sell agents that triage alerts. Our look at AI in AML compliance found real gains, along with the risk of alerts closed without human review.

What to watch next

Next, several rule changes will force another round of RegTech build or buy reviews. The EU’s AML Regulation applies from 10 July 2027, as covered in our guide to EU AMLR readiness. In the US, FinCEN proposed a new AML programme rule in April 2026 that would focus enforcement on significant or systemic failures. No final rule has followed yet. In addition, the GENIUS Act brings stablecoin issuers under the Bank Secrecy Act, with sanctions screening duties, by 18 January 2027 at the latest. In the UK, enhanced due diligence for some cryptoasset activity starts on 1 February 2027.

Above all, the RegTech build or buy decision does not move the risk. Buying saves engineering time, and building can fit a product more closely. Either way, the firm must test coverage, keep a clear audit trail and add reviewers before its alert queue outgrows them.

FintechBits covers payments, banking and fintech developments for readers in the US and UK. This article is for information only and is not financial or legal advice. Views expressed are those of the FintechBits editorial team.