What AML software cost on open source compared with commercial suites
For a compliance or finance leader comparing AML software options, the software license is usually the smallest visible line item. The total cost of a self-hosted Jube and yente stack or a commercial suite is set by the components around the software: watchlist data licensing, infrastructure to run screening and monitoring, rule and model tuning, integration with core systems, validation evidence, analyst time spent on alerts, and support. Commercial suites typically bundle some of these into a subscription, while an open-source deployment moves them onto line items that you or a partner must fund directly. Compare the two options on the same list of components, not on the headline license figure.
Several of these costs are one-time and several recur. Initial integration, rule and model tuning, data pipeline setup and independent validation are largely one-time for a given scope, though tuning and revalidation recur whenever typologies, products or list sources change. Infrastructure, watchlist data subscriptions, analyst capacity, patching and upgrades recur every year. Ask each vendor and partner to split their proposal into these two groups. Watchlist licensing deserves particular attention: confirm in writing whether the data you screen against may be used for your internal commercial purpose and at what volume, because that term can change the recurring cost more than any software decision.
DeployOpen does not publish a price list, and no DeployOpen figure appears on this page. Fixed-scope engagements are quoted from a written scope that names the systems, data sources, rule sets, environments, integrations and evidence deliverables involved. When you request a quote, ask for each component to be priced separately, state who holds the watchlist data license, specify who maintains rules and models after go-live, and define what support and upgrade coverage is included. A quote that cannot be read line by line against these components is difficult to compare with a commercial suite, whichever direction the decision goes.
Which cost components apply to in-house, partner and SaaS AML
This table compares who pays for each AML cost component under three models: building in-house on Jube and yente, implementing with a partner on self-hosted Jube and yente, and buying a commercial SaaS or suite. Read each row as a question to put to your team, your partner or your vendor, noting whether the cost is one-time or recurring. The main takeaway is that open-source software removes the license line, but data, tuning, validation and staffing costs remain under every model.
| Cost component | In-house build on Jube and yente | Partner implementation on self-hosted Jube and yente | Commercial SaaS or suite |
|---|---|---|---|
| Watchlist data licenses | Your organization pays data providers and confirms internal commercial-use terms for OpenSanctions data; recurring | Same as in-house; partner scope should name who holds the data agreement; recurring | Usually bundled in the vendor fee; confirm which lists, update frequency and redistribution limits; recurring |
| Infrastructure | You pay cloud or data center costs for hosting, storage, backups and high availability; recurring | Same, billed to you under your accounts; partner may add one-time setup; recurring | Vendor hosts most of it; check data location and any usage-based fees; recurring |
| Rule and model tuning | Internal staff tune typologies, thresholds and scoring; one-time build plus ongoing recurring tuning | Partner performs initial tuning under written scope; your staff must still own changes; one-time then recurring | Vendor provides default models; custom tuning may be a paid services item; one-time and recurring |
| Integration | Internal engineers build payment, customer and case feeds; one-time | Partner builds and documents interfaces; one-time, with maintenance recurring | Vendor connectors and professional services; confirm custom work is priced separately; one-time |
| Validation and documentation | Your model risk and compliance teams perform validation and write examiner-ready records; one-time and periodic | Partner can prepare evidence and test scripts; your validators still sign off; one-time and periodic | Vendor supplies documentation packs; your team still validates its configuration; one-time and periodic |
| Analyst time | Your investigators work alerts and cases; recurring and scales with alert volume | Same as in-house; partner may reduce false positives through tuning, not headcount; recurring | Same as in-house; vendor tooling may reduce manual steps; confirm what is measured; recurring |
| Support and upgrades | Internal platform team handles patches, version changes and incidents; recurring | Retainer or support agreement with the partner, scoped in writing; recurring | Included in subscription tiers; confirm response targets and upgrade timing in the contract; recurring |
| Retention of records | You store alerts, cases, decisions and rule versions for the required period; recurring storage | Partner designs retention and export; storage billed to you; recurring | Vendor retention settings and export rights vary; confirm who holds records at exit; recurring |
What moves AML software cost up or down
Most of the cost difference between self-hosted Jube and yente and a commercial suite comes from a few drivers that scale with your business. Each one shifts the balance of licenses, infrastructure, tuning effort and analyst time, so each should be sized in writing before any quote is compared.
Transaction volume and latency
Higher transaction volume and tighter real-time decision windows increase compute, storage and high availability needs for scoring in the payment flow. Batch monitoring after settlement is cheaper to run than scoring before authorization, which needs more capacity and failover. Ask each vendor for the peak transactions per second you must sustain, the maximum acceptable decision latency, and whether the price assumes a single node or a clustered deployment. Self-hosted costs follow your hardware and cloud choices, while commercial suites usually price on volume tiers.
Number of typologies and rules
Each typology you monitor adds rules, scenarios, test cases and threshold reviews. Commercial suites often charge for modules or scenario packs, while open source tooling moves that cost into your team's configuration and validation work. A narrow retail profile with a few typologies is far cheaper to tune than a multi-product bank covering trade, cards and cross-border payments. Ask how many typologies are in scope at launch, who writes and tests rules, and how changes are documented for examiners.
List sources and internal use licensing
Watchlist data is often the largest recurring cost in screening, and its license terms decide what you may do with it. Some commercial sources permit internal use only, others charge per user, per integration or per query volume, and some restrict redistribution or use inside products you sell. Before comparing platforms, confirm which lists you need, whether your intended internal commercial use is covered, the refresh frequency, and whether a commercial license is required for your use case. Free data does not remove the need to read these terms.
Jurisdictions and regulatory scope
Operating under US BSA and OFAC rules alone differs from also meeting EU obligations, because each regime adds its own list sources, reporting logic, retention periods and data protection constraints. Multi-jurisdiction programs need separate rule sets, screening configurations and evidence packs, which multiplies tuning and validation work. Ask each vendor which regimes its standard content covers, which requirements you must build yourself, and how cross-border customer data is handled and documented.
Case management load
Alert volume drives analyst hours more than any software line item. Lower false positive rates reduce triage time, while broad rules and weak thresholds create queues that need more staff and more quality review. Open source platforms shift the case workflow, evidence capture and audit trail design onto your implementation, so they carry more setup cost. Ask for expected alert volumes per thousand customers or per month, the disposition workflow, the average review steps per alert, and how cases are retained and exported.
Size of the analyst team
Team size determines how much of the cost is recurring people time: investigators, model and rule owners, data engineers and a reviewer who can sign off on changes. A small compliance team with a self-hosted stack may need an external partner for tuning and operations, which is a service cost, while a large team can absorb more of that work internally. Ask who will own rule changes, model governance, list refresh and incident response after go-live, and price those roles in the total cost comparison rather than only the license line.
How watchlist data licensing changes the total
Self-hosted yente screens against list data, and the OpenSanctions data it is typically paired with is published under its own license terms. The software license for yente does not automatically cover the data, so the cost question starts with what you are allowed to do with the bulk datasets. Your team, or a partner, pays for the pipeline that downloads, validates and refreshes those files. The license cost may be small or zero for some uses, but the operating cost of keeping the data current is recurring and sits in your budget.
- Data terms, not software terms: Confirm the current OpenSanctions license terms directly with the publisher, because the data license governs your use independently of the code license.
- Refresh pipeline: Budget for scheduled imports, checksum or change checks, and rollback when a bad file arrives. This labor recurs for as long as the screen is live.
- Source selection: Each list source you add may carry its own terms, so record which lists you use and why.
- Audit evidence: Keep dated copies of the license terms you relied on and the data versions loaded into each screening run.
- Ask the partner: Request a written statement of which data sources are in scope, who holds the license, and what happens to the pipeline if terms change.
Before comparing totals, get the publisher's current terms in writing for your exact use case.
Commercial AML and screening suites usually bundle watchlist content into the subscription, so the data cost appears as a line item in the vendor's pricing rather than as a separate license you negotiate. That bundle can simplify procurement and shift the refresh work to the vendor. It also means the price you see covers a defined data scope, and additional sources, higher volumes or extra regions may be priced as add-ons. Ask how the bundle is metered and renewed, because these terms often drive the multi-year total more than the base license does.
- Bundled scope: Identify which lists, risk datasets and jurisdictions the subscription covers, and which are extra.
- Usage metering: Check whether fees depend on screened records, users, modules or annual volume, and how overages are billed.
- Renewal and uplift: Ask for the annual increase mechanism and the notice period for list changes.
- Data retention on exit: Confirm whether you keep copies of screening results and match decisions if you leave the vendor.
- Written license scope: Require the vendor to state in writing what the license permits, including internal and affiliate use.
A bundled feed is easier to budget only when the vendor's written data license matches the way you plan to use the results.
Whether screening stays inside your organization or is exposed to customers, partners or third parties can change which license applies and how much you pay. Internal screening of your own customers and payments is a different use from a product that lets outside parties run checks, return results to clients, or embed the data in their own systems. Redistribution of list data is usually the point where terms tighten. Because the cost of a broader license can exceed the cost of the software itself, this decision belongs at the start of the budget, not at renewal.
- Internal use: Screening your own onboarding and payment flows is typically the narrowest scope, so confirm that it is covered.
- Affiliates and subsidiaries: Check whether group entities that use the screen need separate coverage.
- Customer-facing products: If clients or partners can query the data or see match details, treat it as a distinct licensing question.
- Resale or embedding: Passing list data or match output to third parties is commonly a separately licensed activity.
- Change triggers: Plan a license review when you add a sponsor bank, a partner integration or a new product line.
Before you commit, write down every party that will see or use screening output, and ask the publisher or vendor to confirm each one.
Which AML costs are one-time and which recur every year
The first cost question to settle is which items you pay once and which you pay again every year, because a self-hosted stack moves a large share of the spend into the second group. One-time costs cover the requirements definition, the reference architecture, the initial integration with your core systems and payment flows, the data pipeline that loads and normalizes watchlists and customer records, the first rule and model baseline, and the validation evidence that shows the baseline works as documented. Ask any partner to price these as separate line items with named deliverables, so you can see what is a project and what is a permanent capability you own.
Recurring costs are the ones that surprise budget owners. They include infrastructure for the transaction stream and the screening index, watchlist data refresh and any data license fees, tuning cycles for rules and thresholds, retraining and revalidation of models, support retainers, and analyst time spent on alert triage and case work. Watchlist licensing needs particular attention: confirm with the data provider whether internal commercial use is covered before you commit to a refresh cadence, and confirm whether your compliance team or a partner will own each refresh. Under the FTC Safeguards Rule, your Qualified Individual must keep logging activity and multi-factor authentication in place for anyone who accesses the system, and the annual penetration testing and vulnerability assessment cycle in 16 CFR 314.4(d)(2) applies unless effective continuous monitoring is in place. These are recurring evidence tasks, not one-off projects.
If your institution is an EU financial entity subject to DORA, the contract terms add a further recurring workload. Article 28(3) requires an up-to-date register of information on ICT contractual arrangements, and Article 30(2) requires each contract to state where services are provided and data processed, with advance notice of changes and data return on termination. Keeping that register, reviewing vendor notices and maintaining the exit strategy required by Article 28(8) are annual tasks with a named owner. Budget them explicitly, and ask any partner or software vendor to confirm in writing which of these evidence outputs they provide and which fall to your team.
How to build your own AML cost estimate
This sequence turns a vague budget question into a like-for-like comparison. Each step fixes one part of the scope so that a self-hosted Jube and yente stack and two or more commercial suites can be priced against the same requirements and the same written assumptions.
Define volume, latency and typologies
Compliance leads and the transaction monitoring owner set the expected transaction volume, peak rates, the latency each payment flow can tolerate, and the typologies the monitoring must cover, such as structuring, rapid movement of funds or unusual cross-border activity. Record each typology with the data fields it needs. The step is done when every rule and model in scope traces back to a documented typology and a volume figure, so that infrastructure and tuning effort can be sized from them rather than from a vendor's default tier.
List data sources and license terms
Legal and compliance staff list every watchlist and reference dataset the screening will use, including sanctions, PEP and company registry sources, and read the license terms for each one. Confirm in writing whether internal commercial use, on-premises hosting and redistribution inside the group are permitted, and whether a commercial license is needed. Include the refresh frequency and who maintains the update pipeline. The step is done when each dataset has a cost line, a license owner and a refresh process, because licensing is often the cost that differs most between options.
Size infrastructure and high availability
The platform engineering team converts the volume and latency targets into compute, memory, storage and network requirements for each option. Include production, disaster recovery and non-production environments, along with the backup and retention storage that records require. Ask commercial vendors to state which of these are included in their license or hosted fee and which are billed separately. The step is done when you have a sized architecture diagram and a monthly infrastructure estimate per option, with the assumptions written next to it.
Scope integration points
Architects list every system that feeds or receives alerts and screening results, including core banking or payment systems, customer onboarding, case management, sanctions blocking and regulatory reporting tools. For each connection, record whether it is a real-time call in the payment flow or a batch job, who builds the interface, and who tests it. Identify custom code that a commercial suite would need and that a self-hosted stack would also need. The step is done when the integration list is complete and each item has an owner and an estimated build and test scope.
Plan validation and documentation for examiners
Model risk, compliance and internal audit agree the validation approach for rules and models, the testing evidence examiners will expect, and the change control that records each tuning decision. Decide who writes the model and rule documentation and how it is kept current. Commercial suites may include some of this material, while a self-hosted deployment must produce it inside the client's own records. The step is done when a validation plan exists, its deliverables are listed, and each option's quote states which deliverables it covers.
Estimate analyst hours per alert and case
Operations managers estimate how many alerts the rules and screening will generate at the volumes from step one, how long triage takes per alert, and how long a case takes to close, including the time spent on false positive handling. This is usually the largest recurring cost and the one most sensitive to tuning quality. Ask each vendor or partner for its expected alert quality approach and what it has achieved in comparable settings, and ask for the basis of any figure. The step is done when you have an hours-per-alert model with stated assumptions and a range you can test.
Add support, upgrade and exit needs
Procurement and the platform owner list the support hours, security patching, version upgrades, data model changes and incident response expected for each option, and who performs them. For self-hosted options, this includes whether a retainer covers upgrades and testing after each release. Include exit terms, the format in which rules, cases and data can be returned, and the cost of moving away. The step is done when support and exit terms are written down for each option, with recurring fees separated from one-time implementation fees.
Compare three options on the same scope and request written quotes
Assemble one scope document from steps one to seven and send it to the self-hosted option built on Jube and yente, a commercial AML suite, and a third option, such as a hosted screening service or a second commercial vendor. Ask each to quote in writing against the same volumes, data sources, integrations, validation deliverables and support terms, and to show one-time and recurring costs separately. Ask DeployOpen for a fixed-scope quote based on the same document, since its prices follow from the written scope and are not published. The step is done when all quotes are in the same format and the differences trace back to named assumptions.
AML cost questions buyers ask before hiring outside help
Does open source AML software remove the license cost?
Open source removes the software license fee for Jube and yente, but it does not remove the other cost lines. Jube and yente are free to deploy, so the remaining spend sits in infrastructure, sanctions and PEP data, rule and model tuning, integration with core systems, validation evidence, analyst time and ongoing support. Commercial suites bundle some of these into a subscription, so compare the full set of components, not the license line alone. Ask any vendor or partner to list every recurring and one-time cost, including who pays for each one.
What does an implementation partner quote actually cover?
A partner quote should follow from a written scope that names the systems, data sources, rules, integrations, testing and documentation included. DeployOpen plans, implements, integrates, hardens, documents and supports self-hosted platforms in the client's own infrastructure, and most engagements are fixed-scope with deliverables and timelines agreed in writing before work starts. DeployOpen does not publish a price list, so a quote is built from that scope. Request line items for discovery, deployment, data pipeline setup, tuning, integration, validation support, training, handover and any retainer for upgrades or testing.
How long does an AML implementation take, and what drives it?
The duration depends on scope more than on the software itself. The main drivers are the number of data sources, the number of systems that send transactions or customer records, how many typologies and rules need tuning, how much historical data is available for calibration, and how much model documentation an examiner will expect. Integration with an existing core banking, payments or case management system is often the longest item. Ask the partner for a timeline tied to named milestones, and ask which assumptions about client data access, test environments and sign-off would move it.
How much work does the internal team need to contribute?
Expect the internal team to supply subject matter knowledge, access and decisions, even when a partner does the build. Compliance staff define typologies, thresholds and case handling. Data and platform staff provide data feeds, network access and hosting accounts. Engineering staff own the integration points and change control. Someone must approve rule changes and sign off model documentation. Ask the partner to produce a responsibility matrix in the statement of work so each role and time commitment is visible before work starts.
Can a small compliance team run self-hosted AML monitoring alone?
A small team can run it, but only if the routine work is small enough and the platform is supported. Day-to-day tasks include triaging alerts, managing cases, reviewing rule performance, refreshing sanctions data and keeping logs for examiners. Infrastructure tasks include patching, backups, monitoring, upgrades and access reviews. Many small teams keep the rules and case work in house and buy a retainer for platform operations and testing. Ask the partner which tasks transfer to your staff, which stay with them, and what response expectations apply, stated as written terms rather than assumptions.
How do watchlist data licenses change the total cost?
Watchlist data licensing can be one of the largest recurring items, and it depends on how the data is used. Sanctions and PEP datasets from OpenSanctions carry licensing terms that differ between non-commercial and commercial use, and internal commercial use of bulk data may require a paid license. Commercial suites often include list access in the subscription, which makes the comparison harder. Before comparing totals, confirm the license terms for each dataset, whether the data is used inside your network, how often it is refreshed and whether any third-party list providers charge separately.
How should a SaaS AML suite be compared fairly with self-hosted tools?
Compare both options over the same scope, the same volumes, the same data sources and the same retention period. Build a single model that includes subscription or license fees, infrastructure, data licenses, implementation, tuning, integration, validation, analyst time, training, upgrades and support. Ask the SaaS vendor to state which items are included, which are per-transaction, per-user or per-data-source charges, and what happens to records and configuration on exit. Under DORA, a financial entity must keep a register of ICT contractual arrangements and maintain documented exit strategies for services that support critical functions, so include exit and data return costs in the comparison.
How DeployOpen scopes an AML implementation at fixed price
Most DeployOpen engagements are fixed-scope, which means the scope, deliverables and timelines are agreed in writing before any work starts. For an AML stack, that written scope is where the cost comparison becomes concrete. It should name the Jube detection rules and models in scope, the yente screening configuration, the list sources and update cadence, the case management and reporting integrations, the environments (for example, development, validation and production), and the validation evidence the compliance team expects to receive. A commercial suite quote and an open-source quote can only be compared line by line if both describe the same functions, so ask every bidder to price against the same written list.
DeployOpen does not publish a price list. A quote follows from the written scope, so the reader's job is to check that the scope covers the cost components that usually surprise buyers: who licenses the watchlist data, who tunes thresholds and models after go-live, who prepares the documentation examiners will ask for, and who runs the infrastructure. Ask for the quote to separate one-time work (design, integration, data loading, validation) from recurring items (hosting, data subscriptions, upgrades, monitoring and support). Confirm with the vendor, the data provider and your own cloud or data center team which of these items sit outside the quote, because they change the total cost of ownership more than the license line does.
Ongoing support, upgrades and continuous testing are available as retainers, and that is the usual route for keeping an AML stack current after the fixed-scope project closes. Decide before signing whether you want the retainer to cover Jube and yente version upgrades, data refresh checks, rule and model review cycles, and periodic security testing of the screening and monitoring services. Ask how change requests after go-live are priced and how they are recorded, since a rule change that examiners later question needs the same documentation trail as the original build. A clear retainer scope prevents the two most common cost surprises: unplanned upgrade work and unbudgeted tuning cycles.
How DeployOpen delivers and supports self-hosted AML
DeployOpen plans, implements, customizes, integrates, hardens, documents and supports self-hosted open-source platforms inside the client's own infrastructure. For AML software cost, that means turning a rough budget into a written scope that separates licenses, data, infrastructure, tuning, integration, validation and support so the total cost of ownership can be compared on the same terms.
How we scope
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
- The written scope lists each cost component, including watchlist data licensing, hosting, tuning and analyst workflow changes.
- We confirm volumes, latency targets, list sources and internal commercial use terms with your team before quoting.
How we build
- We deploy Jube and yente inside your cloud accounts, data centers or air-gapped network under your control.
- We tune rules and models against your typologies and record the tuning decisions so cost estimates reflect real effort.
- We test integrations with core systems and document what each interface costs to build and maintain.
How we hand over
- Handover covers runbooks, configuration records, data refresh procedures and the documentation your team needs to run the stack.
- Validation evidence and model and rule documentation are prepared for your compliance and model risk reviewers.
- We agree in writing which recurring costs remain with your team after handover, such as data subscriptions and hosting.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers, priced separately from the build.
- Retainers can cover platform upgrades, backup checks and periodic tuning reviews, with the scope fixed in writing.
- We help you compare recurring retainer costs against commercial suite renewal terms using the same written scope.
