Insights · Compliance software for fintech and banks

Custom or off-the-shelf compliance software: which should a fintech or bank choose?

Claude Certified Services Partner(Anthropic)

Direct answer. Most fintechs and banks should buy the regulated core of a compliance platform and build only what is specific to them. Buy the detection and record-keeping engines (KYC/AML screening, transaction monitoring, regulatory reporting). Build the layers that differ per institution: jurisdiction rules, workflow, data integration, evidence and audit trail. A fully custom platform makes sense only when a licensed vendor cannot model your products or data. A fully off-the-shelf set-up works only while your processes match the vendor’s.

Last updated: 21 October 2026 · S-PRO team

2014Founded, headquartered in Zurich

250+Engineers in Zurich and Łódź

ISO27001 and 27701 certified

CPNCertified partner in the Claude Partner Network

What counts as a compliance platform here?

This guide is for CIOs, COOs and CCOs at banks, wealth and asset managers and fintechs in Switzerland and the EU who compare compliance management systems. It covers the whole platform. For the narrower AML AI question, see Should a bank build or buy AML AI?

Five functions, usually bought from more than one source:

Client due diligence.KYC onboarding, identity verification, sanctions and PEP screening, risk scoring (KYC service).
Transaction monitoring.Rules and models, alert handling, case management (AI agents for AML and transaction monitoring).
Regulatory reporting.Suspicious-activity reports and periodic reports to the supervisor.
ICT-risk and third-party governance.For EU entities, the DORA register of information, incident handling and resilience testing.
Audit trail.Who decided what, on which data, when, and why (what a KYC AI audit trail should log).

How do custom, off-the-shelf and hybrid compare?

Swipe to compare →

Criterion	Off-the-shelf	Custom	Hybrid
Fit with standard processes	Strong	Not needed	Strong for the core
Fit with unusual products or data	Limited to configuration	Full	Full for the custom layer
Time to first use	Usually shortest	Usually longest	Between the two
Regulatory updates	Vendor ships them	Your team owns them	Vendor for the core, you for custom rules
Real-time transaction monitoring	Built-in, vendor-tested	Must be engineered and validated	Vendor engine, your integration
Multi-jurisdiction rules	Vendor’s supported list	Any, at your effort	Vendor list plus your own rule layer
Audit logs and reports	Vendor format	Your format	Vendor core plus a unified evidence layer
Lock-in and exit	Higher	Lower, if you own code and data	Depends on interfaces
Main cost drivers	Licences, volume, configuration	Engineering, validation, run team	Both, with integration work

No figures are given here: cost depends on scope, volume and your supervisory setting, and is only estimated against a defined scope.

Which criteria should drive the choice?

KYC/AML coverage. List the client types, risk categories and data sources you must cover. Check whether the vendor can model them by configuration. If not, the gap is your custom work.

Operational resilience (DORA). For EU financial entities, Regulation (EU) 2022/2554 (DORA) has applied since 17 January 2025 and covers ICT risk management, incident reporting and third-party risk. A vendor platform is usually an ICT third-party service: DORA expects contractual arrangements, exit strategies and an entry in your register of information (Article 28). A custom platform shifts more of the ICT-risk work to you but gives you control of the stack. DORA covers financial entities authorised in the EU and their ICT third-party providers, so a Swiss institution is affected mainly through EU subsidiaries or branches or through contracts with EU entities; whether it applies is a case-by-case legal question. In Switzerland the comparable supervisory expectations come from FINMA (see the FAQ).

Several jurisdictions. Rules differ between Switzerland (the Anti-Money Laundering Act, AMLA, with duties on customer identification in Art. 3, special due diligence in Art. 6, record-keeping in Art. 7, organisational measures in Art. 8 and reporting in Art. 9, plus FINMA’s AML Ordinance, AMLO-FINMA), the EU (the AML Regulation, Regulation (EU) 2024/1624, applicable from 10 July 2027, with a later date, 10 July 2029, for a few categories of obliged entity) and other markets. Ask who maintains each rule set and how a change is tested and released.

Audit logs and reports that stand up to a regulator. Where AI is part of the platform, FINMA Guidance 08/2024 (governance and risk management when using AI, 18 December 2024) applies. It is supervisory guidance, not a statute. FINMA reports there that results often cannot be understood, explained or reproduced, and that institutions depend on third parties such as model and cloud providers; it expects institutions that use AI to align governance, risk management and controls with the risks. Practically: every alert, decision and model version should be reconstructable, and the record exportable without the vendor’s help.

Real-time monitoring. Decide what “real time” means for your payment types (pre-transaction block or post-transaction alert) and test latency on your own volumes. Never rely on a vendor’s benchmark alone.

Scalability. Check behaviour at your expected peak volume and what happens when you add a product or a country.

When does each option fit?

Off-the-shelf:standard retail or SME products, one or two jurisdictions, no complex data landscape, a small compliance engineering team.
Custom:unique products or data, regulatory requirements no vendor covers, or a strategic wish to own the logic. Needs a team that can validate models and run the platform for years.
Hybrid:most mid-size banks and scale-ups. A vendor engine sits at the centre. Custom services add integration, orchestration, case workflow, reporting and the audit layer around it.

What should you check before you decide?

Scope.Which of the five functions are in scope in the first release?
Jurisdictions.Which jurisdictions and regulators, and who owns each rule set?
Product coverage.Does the vendor support your products out of the box, or only by custom rules?
Validation.How is the platform tested and validated before each release, and by whom?
DORA.Which parts are ICT third-party services under DORA, and are exit rights agreed?
Data location.Where does data live (Swiss, EU, other regions) and who can access it?
Evidence export.Can you export decisions, logs and model versions independently of the vendor?
Latency.What is the latency for real-time monitoring on your own volumes?
Ownership after go-live.Who maintains it after go-live, and who handles regulatory change?
AI classification.If AI is part of the platform, who classifies it under the EU AI Act and who is accountable (EU AI Act compliant AI agents for banks)?

Write the answers down before you ask for quotes. They define the scope that any cost estimate depends on.

What drives the budget?

Without figures, the drivers are: number of functions and jurisdictions in scope, transaction and client volume, integration depth with core banking and data sources, validation and testing effort, hosting and data-residency requirements, and the run team after launch. Moving from a pilot to production adds operating work that is easy to miss; see AI agent pilot to production cost at a bank.

How does S-PRO help?

S-PRO is an engineering partner headquartered in Zurich (founded 2014, 250+ engineers, ISO 27001 and ISO 27701 certified). It does not sell a compliance platform. It builds the layers around one: integrations, custom rule and workflow services, evidence and audit-trail components, and AI agents for research and drafting. It works with client-owned code and infrastructure, and an exit plan can be agreed at contract stage. Details of its security and supplier controls are on Security and compliance for financial institutions. S-PRO is a Certified partner in the Claude Partner Network. S-PRO does not claim regulatory approval or certification on behalf of its clients.

To compare options for your set-up, talk to our team: a first conversation covers scope, jurisdictions and the build/buy/hybrid split. Contact S-PRO, Löwenstrasse 45, 8001 Zürich.

Book a discovery call (45 min)

Sources

Regulation (EU) 2022/2554 (DORA): eur-lex.europa.eu
Regulation (EU) 2024/1624 (AML Regulation): eur-lex.europa.eu
FINMA, Guidance 08/2024, Governance and risk management when using artificial intelligence (18 Dec 2024): finma.ch
FINMA Circular 2023/1, Operational risks and resilience – banks: finma.ch (PDF)
Swiss Anti-Money Laundering Act (AMLA, SR 955.0): fedlex.admin.ch
FINMA Anti-Money Laundering Ordinance (AMLO-FINMA, SR 955.033.0), German: fedlex.admin.ch

FAQ

Questions buyers ask us

How do I compare compliance management systems for a fintech?

Compare them on the five functions in scope, the jurisdictions each supports, how rule changes are tested and released, what evidence you can export, and which parts are ICT third-party services under DORA. Use the same written checklist for every vendor.

What makes compliance software scalable for an enterprise?

Predictable behaviour at peak volume, the ability to add products and countries by configuration, and an architecture that separates the detection engine from workflow and reporting. Test with your own volumes.

Which compliance tools support real-time transaction monitoring?

Dedicated transaction-monitoring engines from specialist vendors support it, as do custom builds. The practical question is whether you need pre-transaction blocking or post-transaction alerts, and what latency you can accept. Validate on your own data.

What software helps with cross-border financial regulation?

Platforms with maintained rule sets for each jurisdiction, plus a layer that maps your products to those rules. Where a vendor does not cover a market, a custom rule service is added. Ownership of each rule set must be named.

Is DORA relevant to Swiss fintechs?

DORA applies to EU financial entities and their ICT third parties. A Swiss firm is affected through EU subsidiaries or branches, or through contracts with EU financial entities that pass DORA requirements on to their ICT providers. Check this per case with legal counsel. For Swiss banks, supervisory expectations on operational risk and resilience, including ICT risk and dependencies on external service providers, are set out in FINMA Circular 2023/1 “Operational risks and resilience – banks” (in force since 1 January 2024).

Can a custom compliance system pass a regulator's review?

We are not aware of a general procedure in which FINMA or EU supervisors approve compliance software in advance. Supervisors assess the institution: its governance, controls, validation, logs and outcomes. Custom or bought, you need to be able to demonstrate these.

What are you building?

Contact

You will talk to engineers who build for banks, not to a sales script. Fill out the form and get an answer within one business day.

Security and privacy firstISO 27001 and ISO 27701 certified.
Claude Partner NetworkS-PRO is a Certified partner in the Claude Partner Network. Our team includes Claude-certified engineers and architects.
Proven in regulated financeBanks, wealth managers and fintechs in Switzerland, the EU and the US.

Who you’ll talk to

Michael BarskyiHead of Banking & Fintech

Dustin SchulzeSenior Business Analyst

Prefer email or phone?

hi@s-pro.ioEmail +41 41 539 15 83Phone