[Finance](https://bfcs.ai/industry/finance/) · [Cheaper](https://bfcs.ai/cheaper/) # Can AI Cut Compliance Costs? Financial crime compliance is expensive to run and far more expensive to get wrong. Automation can thin the queue of alerts that people must review, but the savings figures we found come from vendors. What it cannot do is move the obligation: Australian rules still require a senior manager to approve the program. Updated **October 2026** · 7 min read · Evidence-graded · 8 sources ## The BFCS verdict Every article scored on the same four dimensions | Dimension | Verdict | Why | | --- | --- | --- | | Better | Partly · Moderate confidence | Sharper alert ranking, mostly vendor-reported · UK firms responding to a Bank of England and FCA survey ranked anti-money laundering and combating fraud among the highest perceived current benefits of AI. The only named-bank gains in alert quality we found, HSBC's, come from a press release by its vendor, Google Cloud, not from independent study. | | Faster | Partly · Low confidence | Analysis compresses; investigation still takes people · HSBC's financial crime head, quoted in a press release by its vendor Google Cloud, said the time to analyse its transactions fell from several weeks to a few days. Alerts that remain still need a person to investigate and decide whether to report. | | Cheaper | Partly · Low confidence | Review effort can fall; accountability costs do not · In a US sample of 11 banks, identity verification and reporting were the costliest areas, and a vendor, Google Cloud, reports alert volumes down more than 60% at one bank. We found no independent study of net cost after validation, data work and oversight. Costs were proportionally higher at the smallest banks, which in our reading matters for the small firms now entering the regime. | | Safer | Conditional · Governance-gated | Only with a named owner who checks the machine · Automated controls can fail unnoticed for years, as at Starling Bank, which the FCA fined. AUSTRAC requires senior manager approval of the program and expects it for monitoring changes, and APRA holds the board accountable for operational risk, including service providers. | ## The problem, in numbers Financial crime compliance has two price tags: the cost of running it and the cost of failing at it. The second is public in Australia. AUSTRAC's court-ordered penalties include $1.3 billion against Westpac in 2020, $700 million against Commonwealth Bank in 2018, $450 million against Crown in 2023 and $67 million against SkyCity Adelaide in 2024. (Source 1) The Federal Court declared that Westpac had breached the AML/CTF Act on over 19 million occasions. The bank admitted failing to properly report over 19.5 million international funds transfer instructions worth over $11 billion, and AUSTRAC's chief executive pointed to its failure to run effective transaction monitoring. (Source 1) The first price tag is harder to see: the nearest official figures we found come from overseas. In a US Government Accountability Office review of a nongeneralisable sample of 11 banks, estimated direct costs of complying with the Bank Secrecy Act in 2018 ranged from about US$14,000 to about US$21 million. (Source 4) In the UK, firms filing the FCA's financial crime return employed around 17,403 full-time equivalent staff in financial crime roles in 2019/20. The FCA estimates that staff time alone costs around £1.1 billion a year, before any spending on systems. (Source 5) The bill is also spreading. From 1 July 2026, businesses including lawyers, accountants, conveyancers, real estate professionals and dealers in precious stones and metals came under AML/CTF obligations. In March, AUSTRAC said this would take the number of businesses it regulates from around 19,000 to close to 100,000. (Source 2) ### The evidence, in four numbers $1.3 billion · AUSTRAC civil penalty against Westpac · ordered October 2020; the Federal Court declared breaches on over 19 million occasions (AUSTRAC) ~100,000 · businesses AUSTRAC expected to regulate from July 2026 · close to 100,000, up from around 19,000, as professions including lawyers, accountants and real estate professionals join (AUSTRAC, March 2026) 17,403 · UK staff in financial crime roles (full-time equivalent) · firms filing the FCA's REP-CRIM return, 2019/20; the FCA estimates about £1.1 billion a year in staff time 60%+ · fewer alerts at HSBC, vendor-reported · Google Cloud launch release, June 2023; self-reported by vendor and client, not independently verified ## What improves, and why In the US sample, verifying customer identity and reporting suspicious and other activity were generally the two costliest areas, at 29% and 28% of total compliance costs on average. (Source 4) In our reading, both are largely human work: documents to check, alerts to clear and justify, reports to write. AUSTRAC already expects an automated monitoring system wherever a business cannot effectively monitor transactions by hand, for example at high volumes. (Source 2) For larger firms, then, automation is a given. The open question is whether smarter automation, models that score and rank alerts or read identity documents, shrinks the human queue enough to lower the total bill. The only named-bank figures we found are vendor material. Google Cloud reported that its client HSBC saw alert volumes fall by more than 60% after adopting its AML product, while detecting two to four times more true positive risk, measured by suspicious activity reports filed, than under its earlier rules. (Source 7) In the same release, HSBC's financial crime head said the time to analyse billions of transactions fell from several weeks to a few days. (Source 7) > Automation can shorten the queue of alerts. It cannot shorten the list of people who answer for what the queue missed. ## What the evidence actually says Adoption is broad and cautious. In a 2024 Bank of England and FCA survey of 118 firms, 75% were already using AI, and anti-money laundering and combating fraud ranked among the highest perceived current benefits; only 2% of use cases were fully autonomous. (Source 5) ASIC's review of 624 consumer-affecting AI use cases at 23 Australian licensees found AI generally augmented rather than replaced human decisions. (Source 8) The cost evidence is much thinner than the adoption evidence. A landscape review prepared for ASIC notes that public examples of AI compliance monitoring tend to be described at a high level, though they point towards fewer low-quality alerts; its own example is the HSBC figure from Google Cloud's launch materials. (Source 7) We found no independent study that measures a firm's net compliance cost after adopting AI, counting model validation, data remediation and the oversight regulators require. The one peer-reviewed bank study we know of on alert ranking is covered in our [fraud detection review](https://bfcs.ai/articles/can-ai-detect-fraud-better). In our reading, the evidence supports something modest: models can reduce the number of low-value alerts reaching investigators. Whether that becomes a lower total cost depends on what the firm spends to prove the model works, and on whether freed analyst time is cut or redeployed to harder cases. ## Where it falls short - **Automation fails quietly.** In January 2023 Starling Bank found that its automated sanctions screening had, since 2017, checked customers against only a fraction of the full list. The FCA fined it £28,959,426 over this and a breach of limits on opening high-risk accounts. (Source 6) - **Growth outruns controls.** Starling grew from about 43,000 customers in 2017 to 3.6 million in 2023, and the FCA found its financial crime controls did not keep pace. (Source 6) - **Monitoring is not due diligence.** Reviewing six challenger banks in 2021, the FCA found inconsistent or inadequate rationale for discounting alerts, and some banks relying on monitoring instead of onboarding checks. Due diligence still applies "no matter how good a transaction monitoring system is." (Source 6) - **Bought models, borrowed understanding.** In ASIC's review, 30% of AI use cases used third-party models, four licensees relied on third parties for all their models, and not all had governance to match. (Source 8) - **Fixed costs fall on the small.** Direct compliance costs were about 2% of operating expenses at the three smallest banks in the US sample and under 1% at the three largest. (Source 4) In our assessment, the firms newly regulated in Australia may face the same scale problem. ## Where governance decides the outcome Under AUSTRAC's rules and guidance, responsibility does not pass to a model or a vendor. A senior manager must approve the risk assessment, the AML/CTF policies and any update to either, and records must show how senior managers met those duties. (Source 3) AUSTRAC expects relevant senior managers to approve monitoring changes that may affect compliance, and firms to check regularly that monitoring works and that alerts are answered. (Source 2) Where monitoring is outsourced, the business remains responsible, and AUSTRAC expects it to document how the governing body and senior management will oversee and resource the arrangement. (Source 3) For APRA-regulated banks, insurers and super funds the chain runs higher. Under APRA's CPS 230, in force since July 2025, the board is ultimately accountable for oversight of operational risk, including service providers, and the Financial Accountability Regime has applied to deposit-taking institutions since March 2024 and to insurers and super trustees since March 2025. (Source 3) Name the person who owns each automated control, test it against known cases, and record why each tuning change was approved. ## How to think about adoption Start by measuring the queue you have: alerts raised, the share cleared without action, the time each takes, and how many become reports. That is the baseline any saving must beat. Pilot alert scoring in parallel with existing rules before switching anything off, and judge it on missed cases as well as on alerts removed. Budget for validation, data work and the senior manager time the law requires, because those costs do not shrink when alerts do. Treat a vendor's alert-reduction figure as a hypothesis to test on your own data. In our assessment, simpler tools and clear ownership will matter more than sophisticated models for the newly regulated professions. ## How we read this evidence BFCS.ai does not fabricate figures. We found no Australian regulator figure for what firms spend on financial crime compliance, so cost figures here come from a US sample of 11 banks and a UK regulator's staffing estimate. The only alert-reduction figure we found for a named bank is vendor-reported. Penalties are context for the cost of failure, not a measure of what automation saves. ## Sources 1. Australian Transaction Reports and Analysis Centre (AUSTRAC), "Enforcement actions taken" (last updated 30 October 2026): [austrac.gov.au](https://www.austrac.gov.au/about-us/record-our-actions/enforcement-actions-taken) AUSTRAC, "AUSTRAC and Westpac agree to penalty," media release, 24 September 2020: [austrac.gov.au](https://www.austrac.gov.au/news-and-media/media-release/austrac-and-westpac-agree-penalty) AUSTRAC, "Federal Court makes ruling in Crown matter," media release, 11 July 2023: [austrac.gov.au](https://www.austrac.gov.au/news-and-media/media-release/federal-court-makes-ruling-crown-matter) **What we took from it:** Federal Court penalties of $1.3 billion against Westpac (21 October 2020, AML/CTF Act breached on over 19 million occasions), A$700 million against Commonwealth Bank of Australia (20 June 2018), $450 million against Crown Melbourne and Crown Perth (11 July 2023) and $67 million against SkyCity Adelaide (7 June 2024). Westpac admitted contravening the Act on over 23 million occasions, including failing to properly report over 19.5 million international funds transfer instructions amounting to over $11 billion, and to appropriately assess and monitor correspondent banking risks; the CEO cited its failure to implement effective transaction monitoring programs. Crown admitted its programs lacked appropriate systems and controls and were not subject to appropriate Board and senior management oversight; AUSTRAC gave as an example that Crown failed to appropriately monitor billions of dollars in transactions. 2. AUSTRAC, "AUSTRAC opens enrolment for new professions in next step for AML reforms," media release, 31 March 2026: [austrac.gov.au](https://www.austrac.gov.au/news-and-media/media-release/austrac-opens-enrolment-new-professions-next-step-aml-reforms) AUSTRAC guidance, "How to monitor your customers" (last updated 19 October 2026): [austrac.gov.au](https://www.austrac.gov.au/industry-and-business/obligations-and-guidance/your-amlctf-program/customer-due-diligence/ongoing-customer-due-diligence/how-monitor-your-customers) **What we took from it:** from 1 July 2026 lawyers, accountants, conveyancers, real estate professionals and dealers in precious stones and metals must comply with AML/CTF obligations, and on that date the number of businesses regulated by AUSTRAC "will grow from around 19,000 to close to 100,000" (a projection made in March 2026). AUSTRAC expects an automated transaction monitoring system where a business cannot effectively monitor transactions manually, for example at high volumes; businesses must regularly check monitoring is operating effectively and that they are appropriately responding to alerts; relevant senior managers approve monitoring changes that may affect AML/CTF compliance. 3. AUSTRAC guidance, "Senior manager" (last updated 25 March 2026): [austrac.gov.au](https://www.austrac.gov.au/industry-and-business/obligations-and-guidance/your-amlctf-program/develop-your-amlctf-programs/step-1-establish-your-governance-framework/senior-manager) AUSTRAC guidance, "Using outsourcing to help meet your obligations" (last updated 13 July 2026): [austrac.gov.au](https://www.austrac.gov.au/industry-and-business/obligations-and-guidance/additional-guidance/using-outsourcing-help-meet-your-obligations) Australian Prudential Regulation Authority, "Prudential Standard CPS 230 Operational Risk Management" (APRA Handbook): [handbook.apra.gov.au](https://handbook.apra.gov.au/standard/cps-230) and [handbook.apra.gov.au](https://handbook.apra.gov.au/standard/cps-230-superseded) APRA, "Financial Accountability Regime (FAR)": [apra.gov.au](https://www.apra.gov.au/cross-industry/financial-accountability-regime-far) **What we took from it:** a senior manager must approve the risk assessment, AML/CTF policies and any updates to either (Act section 26P), and records must show how senior managers met their obligations. a business that outsources remains responsible for its obligations under the Act and Rules; AUSTRAC expects it to document how the governing body and senior management will be responsible for the oversight, accountability and resourcing of outsourcing risks, and suggests reviewing random samples of the provider's work. the Board of an APRA-regulated entity is ultimately accountable for oversight of operational risk management, including the management of service provider arrangements; the original instrument commenced on 1 July 2025 and the current version commences on 1 July 2026. commenced for authorised deposit-taking institutions from 15 March 2024 and for insurers and superannuation trustees from 15 March 2025, jointly administered with ASIC. 4. US Government Accountability Office, "Anti-Money Laundering: Opportunities Exist to Increase Law Enforcement Use of Bank Secrecy Act Reports, and Banks' Costs to Comply with the Act Varied," GAO-20-574, 22 September 2020. [gao.gov](https://www.gao.gov/products/gao-20-574) **What we took from it:** A nongeneralizable sample of 11 banks; estimated direct compliance costs in 2018 ranged from about $14,000 to about $21 million (US dollars); about 2 percent of operating expenses for each of the three smallest banks and less than 1 percent for each of the three largest; requirements to verify a customer's identity and to report suspicious and other activity accounted for 29 and 28 percent of total compliance costs on average. Figures are taken from the GAO product page summary; the full report PDF refused automated access and was not read. 5. UK Financial Conduct Authority, "Financial Crime: analysis of firms' 2017-2020 REP-CRIM data" (last updated 3 December 2025): [fca.org.uk](https://www.fca.org.uk/data/financial-crime-analysis-firms-2017-2020) Bank of England and FCA, "Artificial intelligence in UK financial services - 2024," 21 November 2024: [bankofengland.co.uk](https://www.bankofengland.co.uk/report/2024/artificial-intelligence-in-uk-financial-services-2024) **What we took from it:** firms submitting the return employed around 17,403 full-time equivalent staff in financial crime roles in 2019/20; the FCA does not collect costs and estimates around £1.1 billion a year in dedicated staff time (ONS median earnings plus 50% overheads), excluding IT systems and other staff. 118 responding firms; 75% already using AI; the highest perceived current benefits are data and analytical insights, anti-money laundering and combating fraud, and cybersecurity; 55% of use cases have some automated decision-making and 2% are fully autonomous. 6. UK Financial Conduct Authority, "FCA fines Starling Bank £29m for failings in their financial crime systems and controls," press release, 2 October 2024: [fca.org.uk](https://www.fca.org.uk/news/press-releases/fca-fines-starling-bank-failings-financial-crime-systems-and-controls) FCA, "Financial crime controls at challenger banks" (multi-firm review of six challenger retail banks covering over 8 million customers, reviews conducted in 2021): [fca.org.uk](https://www.fca.org.uk/publications/multi-firm-reviews/financial-crime-controls-at-challenger-banks) **What we took from it:** penalty of £28,959,426; in January 2023 Starling became aware that since 2017 its automated screening system had screened customers against only a fraction of the full sanctions list; customers grew from approximately 43,000 in 2017 to 3.6 million in 2023 while financial crime controls did not keep pace. found ineffective management of transaction monitoring alerts, including inconsistent or inadequate rationale for discounting alerts, and some banks relying on monitoring instead of due diligence at onboarding. 7. Vendor case study (self-reported, not peer-reviewed). [googlecloudpresscorner.com](https://www.googlecloudpresscorner.com/2023-06-21-Google-Cloud-Launches-AI-Powered-Anti-Money-Laundering-Product-for-Financial-Institutions) Digital Finance Cooperative Research Centre, "Innovation in Financial Technology and RegTech: A Landscape Review," prepared for ASIC, May 2026: [download.asic.gov.au](https://download.asic.gov.au/media/rzvkf3el/rep834-published-21-may-2026.pdf) **What we took from it:** Google Cloud, "Google Cloud Launches AI-Powered Anti Money Laundering Product for Financial Institutions," press release, 21 June 2023: HSBC saw alert volumes decrease by more than 60% and detected two to four times more true positive risk, measured by suspicious activity reports filed, against its earlier rules-based monitoring; HSBC's Group Head of Financial Crime Risk and Compliance said the processing time required to analyse billions of transactions across millions of accounts fell from several weeks to a few days. public examples of AI compliance monitoring tend to be described at a high level; cites the HSBC figure from Google Cloud launch materials; Australian RegTech activity is concentrated in AML/CTF compliance, transaction monitoring and regulatory reporting. 8. Australian Securities and Investments Commission, "Report 798: Beware the gap: Governance arrangements in the face of AI innovation," 29 October 2024: [download.asic.gov.au](https://download.asic.gov.au/media/mtllqjo0/rep-798-published-29-october-2024.pdf) Financial Stability Board, "The Use of Supervisory and Regulatory Technology by Authorities and Regulated Institutions," 9 October 2020: [fsb.org](https://www.fsb.org/uploads/P091020.pdf) **What we took from it:** 624 AI use cases that directly or indirectly affected consumers, at 23 licensees, as at December 2023; AI generally augmented rather than replaced human decision making; 30% of use cases had models developed by third parties, and for four licensees all models were third-party; not all had appropriate governance arrangements for those risks. regulated institutions are adopting AI-based tools to reduce compliance costs in due diligence and anti-money laundering; strong governance and skilled human oversight is needed, and black-box models raise questions of explainability. Putting this to work ## Working through this in your own organisation? BFCS.ai is published by Inhouse CX. We help small and mid-sized organisations decide where AI earns its place, and put the governance in place that makes it safe to use. [Talk to Inhouse CX →](https://inhouse.cx/engage/) Continue the thread - [Can AI Detect Fraud Better?](https://bfcs.ai/articles/can-ai-detect-fraud-better/): More in Finance · FINANCE · BETTER · 7 min · Read → - [Can AI Make Lending Fairer?](https://bfcs.ai/articles/can-ai-make-lending-fairer/): More in Finance · FINANCE · SAFER · 7 min · Read → - [Can AI Reduce Administrative Costs?](https://bfcs.ai/articles/can-ai-reduce-administrative-costs/): Also Cheaper · GOVERNMENT · CHEAPER · 7 min · Read → --- Canonical page: https://bfcs.ai/articles/can-ai-cut-compliance-costs/ This is the Markdown version of the page, generated from its HTML at build time. Site guide for agents: https://bfcs.ai/llms.txt · Every page: https://bfcs.ai/sitemap.xml