Should a bank build or buy AML AI?

What do “build”, “buy” and “hybrid” mean for AML AI?

• Buy:license an AML/KYC vendor platform (screening, transaction monitoring, case management, increasingly with AI features) and configure it. The vendor owns the product and its roadmap.
• Build:the bank, or a partner on its behalf, develops custom AI components around its own policies, data and systems. The bank owns the code and prompts built for its project.
• Hybrid:the platform stays the system of record; custom AI agents take over the research, drafting and cross-checking around it, using the platform’s output as input. This is the pattern S-PRO builds (see AI agents for AML and transaction monitoring): an agent does not replace the screening engine or the monitoring system.

Note that “AML AI” covers different jobs with different answers. A rules or machine-learning detection engine that scores transactions is a different purchase from an agent that reads a hit and drafts a verdict. The build-vs-buy question is usually clearer when you split by job.

How do build, buy and hybrid compare?

This table is a decision aid built from the criteria banks normally have to weigh. It contains no market statistics: any cost, speed or accuracy comparison for your case has to come from your own pilot or vendor evidence.

Swipe to compare →

Which regulations affect the decision?

Responsibility for compliance stays with the supervised institution in every row of the table above. Primary sources are linked below and listed at the end.

• Switzerland.The Anti-Money Laundering Act (AMLA, “GwG”) and FINMA’s Anti-Money Laundering Ordinance (AMLO-FINMA) set the duties; suspicious-activity reports go to MROS, the Money Laundering Reporting Office Switzerland. (The Swiss AMLA is a national statute and is unrelated to the EU authority of the same abbreviation below.) For AI specifically, FINMA Guidance 08/2024 (18 December 2024; full guidance, PDF) is supervisory guidance, not a statute, and says there is no AI-specific legislation in Switzerland. It expects supervised institutions that use AI to identify, limit and control the risks, and names model risks (robustness, correctness, bias, explainability) and a growing dependence on third parties. Its findings are directly relevant to build vs buy: for externally purchased applications, institutions sometimes struggled to determine whether AI is included, which data and methods are used and whether sufficient due diligence exists; FINMA looked for a central AI inventory with risk classification, defined responsibilities and accountabilities, and, in the case of outsourcing, additional tests, controls and contractual clauses on responsibilities and liability. It also notes that risks tend to be higher when AI is used to comply with supervisory law.
• EU AML package.Regulation (EU) 2024/1624 (AML Regulation) applies from 10 July 2027 (Art. 90; 10 July 2029 for certain obliged entities under Art. 3(3)(n) and (o)). Directive (EU) 2024/1640 is transposed by Member States, in general by 10 July 2027. Regulation (EU) 2024/1620 establishes the Anti-Money Laundering Authority (also abbreviated AMLA: do not confuse it with the Swiss Act); it applies from 1 July 2025, and direct supervision of selected obliged entities is to commence as of 2028 (recital 86). Outsourcing is regulated directly: under Art. 18 of Regulation (EU) 2024/1624 an obliged entity may outsource tasks to service providers but must notify the supervisor before the provider starts, stays fully liable, must be able to demonstrate that it understands the rationale and approach of the outsourced activities, must assure itself that the provider is sufficiently qualified, and must lay the conditions down in a written agreement. Some tasks may not be outsourced under any circumstances, among them the decision on a customer’s risk profile, the decision to enter into a business relationship, reporting suspicious activity to the FIU (with a narrow intra-group exception) and the approval of the criteria for detecting suspicious or unusual transactions. This sets the limit for both a vendor and a build partner: they can prepare and support, the bank decides. S-PRO is not a lawyer; national supervisors may add detail.
• EU AI Act.Regulation (EU) 2024/1689 classifies AI systems by risk. AML, KYC and transaction-monitoring triage are not named in Annex III point 5, so classification depends on what the system decides; credit scoring of natural persons is named (point 5(b)), with an exception for fraud detection. High-risk obligations (risk management, documentation, logging, human oversight) apply from 2 December 2027 for Annex III under Regulation (EU) 2026/1744, in force since 27 July 2026; Annex I systems follow on 2 August 2028. The general application date of 2 August 2026 is unchanged for provisions the Omnibus did not move (for example Art. 50 transparency, with a transitional period to 2 December 2026 for Art. 50(2) marking by generative systems already on the market). Effect on build vs buy: if you buy, ask the vendor in writing how it classifies each AI feature and who is provider and deployer; if you build, you may carry provider duties yourself. A supplier cannot make a bank “AI Act compliant”; it can make compliance demonstrable. For EU AI Act dates and obligations for bank AI agents, see EU AI Act compliant AI agents for banks.
• DORA.Regulation (EU) 2022/2554, applicable since 17 January 2025, applies to EU financial entities and requires ICT third-party risk management (Art. 28: the financial entity remains fully responsible; Art. 29: assessment of ICT concentration risk; Art. 30: key contractual provisions, set out in writing). It reaches a platform vendor or build partner through the contract and only for EU-regulated clients. A Swiss-only institution is not directly in scope.

When should a bank buy, build or go hybrid?

Buy when

• the function is standard (for example sanctions list screening) and a vendor has references at comparable institutions;
• you have little internal engineering capacity and no unusual policy to encode;
• you can get the vendor’s AI classification, logging and data-use terms in writing.

Build when

• the process or the data is specific to your bank and no platform can be configured to it;
• you need control over models, hosting and data residency that a vendor cannot give;
• you have, or will hire, the capacity to maintain evaluations and prompts, or you contract a partner and secure ownership of code and prompts.

Go hybrid when

• a platform is already in place and accepted by audit, but analysts still spend time pulling client files, reading adverse-media hits, gathering alert context and writing narratives;
• you want the agent to be replaceable without re-validating the detection engine.

What is a practical decision checklist?

Answer each in writing before signing or starting a build.

1. Which job are we deciding about?Detection, screening triage, periodic review, case drafting or reporting support. One answer per job.
2. Does an existing platform already cover it acceptably?If yes, start with configuration and treat AI as an add-on.
3. What would the agent decide alone?If the answer is anything that affects a client file or a regulatory report, redesign: a named person must approve.
4. What is logged, where, and for how long?Sources and steps per case, reviewable by audit. Retention set by the bank.
5. Who is provider and who is deployer under the EU AI Act, and what is the classification?In writing per system, signed off by your compliance function.
6. Which models see client data, where is it hosted, and what are the provider’s data-use terms?Confirm in writing; residency per project.
7. How do we measure accuracy?Agree an evaluation set with compliance before go-live and set go/no-go criteria. Ask any vendor for the same.
8. What is the exit plan?Data export for a platform; code, prompts and documentation ownership for a build.
9. Third-party risk.If you are an EU financial entity, are DORA contractual provisions covered and is the supplier in your ICT register?
10. Who maintains it after launch?Name the owner for model updates, evaluations and prompt changes.
11. What is the smallest first process?Pilot one agent on one process with clear go/no-go criteria before committing to a platform-wide change.

How does S-PRO approach the build and hybrid options?

What S-PRO publishes today (s-pro.io): Zurich-based, founded 2014, 250+ engineers, R&D centers in Zurich and Łódź, ISO 27001 and ISO 27701 certified. S-PRO is a Certified partner in the Claude Partner Network. Our team includes Claude-certified engineers and architects.

For AML the typical hybrid build is three agents on top of the bank’s existing systems: periodic review, adverse media and sanctions hit triage, and transaction-monitoring alert triage. Each drafts and recommends; a compliance officer or analyst decides; every step is logged. Details, regulations and staged pilot path are on AI agents for AML and transaction monitoring at a bank; onboarding-stage work is on KYC onboarding AI agents for banks and the KYC service. Security and compliance approach: security and compliance for financial institutions. The wider service: AI agent development for banks and financial institutions. Cost drivers: AI agent pilot to production cost at a bank.

What S-PRO does not claim. S-PRO has not published AML-specific performance figures (throughput, false-positive reduction) and we do not invent them. S-PRO does not sell an AML platform, does not give regulatory or legal advice, and is not “AI Act certified” or “FINMA-approved”. ISO 27001 and ISO 27701 are information-security and privacy management certifications. Comparable production work published on s-pro.io is described on the AML page (an AI support agent for a leading neobroker, a policy assistant at the Swiss subsidiary of an international bank); these are not AML metrics.

Discuss your build-vs-buy question with an engineer. ISO 27001 and ISO 27701 certified. S-PRO is a Certified partner in the Claude Partner Network. Zurich, since 2014, 250+ engineers. Book a discovery call (45 min), or send a message.

How S-PRO helps with this

If you are a CIO, COO or Chief Compliance Officer weighing a platform against custom AML AI, S-PRO runs a 45-minute discovery call on one process: we map your existing KYC/AML and monitoring systems, apply the checklist above with your compliance team, and scope a pilot for the agent layer, with human approval and an audit trail, if the hybrid route fits. Contact S-PRO, Löwenstrasse 45, 8001 Zürich.

Book a discovery call (45 min)

Sources

1. FINMA, Guidance 08/2024 release, 18 Dec 2024: finma.ch
2. European Commission, AML/CFT at EU level: finance.ec.europa.eu
3. Regulation (EU) 2024/1624: eur-lex.europa.eu; Directive (EU) 2024/1640: eur-lex.europa.eu; Regulation (EU) 2024/1620: eur-lex.europa.eu
4. Regulation (EU) 2024/1689: eur-lex.europa.eu; Regulation (EU) 2026/1744: eur-lex.europa.eu
5. Regulation (EU) 2022/2554 (DORA): eur-lex.europa.eu