Enhanced due diligence software, outsourced EDD reports and in-house analysts solve different parts of the same job, and comparing them on license fee or report price alone misses most of the cost. The work of an EDD file is gathering evidence, comparing activity with what the customer declared, writing a memo and getting it approved, and it recurs every review cycle for every high-risk customer. In-house analysts do all of it by hand. An outsourced investigative report covers part of the gathering, usually background and adverse media, and leaves the rest with the bank. Software that assembles and drafts the file shifts the hours from gathering to judging. Botminds’ Enhanced Due Diligence (EDD) Review is that third kind: agents build each file and draft a cited memo, and the bank’s analysts and approvers decide. The full comparison has to include one more option banks choose often: exiting the customer instead.
The numbers behind an EDD budget decision
80%
of Southwest-border banks terminated accounts for BSA/AML risk reasons
GAO survey, ±11 points
2,700 h
of analyst time a year for about 600 hand-built annual reviews at 4.5 hours each
Botminds estimate for a community bank
$80,730
median annual pay of compliance officers, all industries, 2025
BLS; before benefits
What are the options for enhanced due diligence software and services?
Three operating models, often mixed. In-house by hand: analysts pull statements, licenses, visit notes and activity from the bank’s systems, rebuild the declared-versus-actual comparison in a spreadsheet, and write the memo, sometimes inside a case management tool that stores the file but does not build it. Outsourced reports: a third party researches the customer or its owners, typically identity, corporate history, litigation and adverse media, and delivers a report the analyst then uses. Agent-assisted files: software reads the bank’s own systems and documents, does the comparison, drafts the memo with sources and leaves the questions it cannot settle, and the decisions, to people.
The models are not exclusive. A bank with a handful of foreign private banking clients may still commission on-the-ground research for those, while using agents for the hundreds of domestic cash-intensive and money services businesses whose files are mostly the bank’s own data. The useful question is which model fits which part of the EDD population, and what each leaves the bank to do.
The full cost of an EDD file under each model
| Cost component | In-house by hand | Outsourced reports | Agent-assisted files |
|---|---|---|---|
| Gathering the bank’s own data (activity, alerts, prior memo, statements) | Analyst hours, every cycle | Still the bank’s: a third party cannot see the core | Agents, from read-only connections |
| Outside research (background, adverse media, registrations) | Analyst hours plus data subscriptions | The report fee | Agents use the bank’s own media and lookup services |
| Declared against actual activity | Spreadsheet rebuilt by hand | Not covered | Drawn automatically; each gap needs a cited cause |
| Memo drafting | Analyst hours | Analyst hours, using the report | Drafted with a source per sentence; analyst edits |
| Review and approval | Checker reads the whole file | Same | Checker sees what approval would change |
| Cadence | Full cost repeats each review | Fee repeats if the report is refreshed | Each cycle starts from the last approved file |
| Setup and oversight | Training, templates | Vendor due diligence under third-party guidance | Connections, templates, policy settings, agent governance |
| What stays with the bank | Everything | Everything except the research | Every decision and signature |
What does an EDD file cost in-house?
The main cost is analyst time multiplied by the number of files and the review cadence, and it is easy to estimate from a bank’s own numbers. No government source measures hours per EDD file; GAO’s cost study of customer due diligence at account opening, $15 an account on average, explicitly excluded EDD and ongoing monitoring (GAO-20-574). Banks interviewed by GAO described high-risk diligence, such as reviewing months of prior statements or sending staff across the border to verify businesses, as a heavy load on compliance staff (GAO-18-263).
Botminds’ estimate for one annual review of a money services business built by hand is 4.5 hours of analyst time. At a fictional community bank with about 600 annual EDD reviews, that is 2,700 hours a year. Priced at the median pay of compliance officers, $80,730 a year or about $38.80 an hour before benefits (BLS), each file costs about $175 in analyst wages alone and the year about $105,000. That is our arithmetic on our estimate, and it leaves out benefits, overhead, the checker’s time and the second-line signature.
The share matters more at small banks. GAO found total direct BSA/AML costs were about 2% of operating expenses at the three smallest banks it studied against about 0.6% at the three largest, and customer due diligence was the costliest BSA area overall (GAO-20-574). A ten-year study by state bank supervisors found the smallest banks spend roughly 11% to 15.5% of payroll on compliance tasks, against 6% to 10% at the largest (CSBS, 2025).
Where an analyst’s hour goes on one EDD file, by hand and with agents
By hand: 4.5 hours
- Gathering · 33%
- Memo · 22%
- Declared vs actual · 17%
- Licensing · 11%
- Media · 11%
- Review, approvals · 6%
Agent-assisted: 0.75 hours
- Memo: read, answer, edit · 33%
- Review, approvals · 20%
- Gathering check · 13%
- Declared vs actual · 13%
- Licensing · 14%
- Media · 7%
A worked comparison: 600 annual reviews at a community bank
Put the three models side by side on one bank’s volume and the gap is mostly gathering hours. Take the fictional community bank from the solution’s sample data, with about 600 annual EDD reviews, and Botminds’ per-file estimates from the split above. By hand, 600 files at 4.5 hours is 2,700 analyst hours a year. An outsourced background report could at most remove the adverse media half hour from each file, leaving about 2,400 hours plus the report fees, because the activity analysis, the memo and the approvals still sit with the bank. With agents assembling and drafting, 600 files at three quarters of an hour is about 450 hours.
The difference between the first and third, about 2,250 hours, is a little more than one full-time analyst’s year at 2,080 hours, or roughly $87,000 of wages at the median compliance officer pay before benefits. That is our arithmetic on our estimates, not a customer’s result, and the software’s own cost and oversight sit against it. A bank should redo the sum with its own file count, its own hours per file and its own quotes; the method matters more than the figures.
Analyst hours a year for about 600 annual EDD reviews, by model
What does an outsourced EDD report buy, and what does it leave?
An outsourced report buys research the bank may not be able to do itself: background on foreign owners, corporate registries abroad, litigation and adverse media in other languages, sometimes on-the-ground inquiries. For private banking clients and foreign correspondents that can be worth the fee. What it cannot buy is the part of the file built from the bank’s own data: the customer’s actual activity against its declared expectation, the alerts, the prior decisions. A third party does not see the core, so the analysis that most often decides an EDD file stays in-house.
It also does not move responsibility. The banking agencies’ 2023 guidance on third-party relationships is direct: “the use of third parties does not diminish or remove banking organizations’ responsibilities to ensure that activities are performed in a safe and sound manner and in compliance with applicable laws and regulations” (Interagency guidance on third-party relationships, June 2023). The same applies to software. Whichever model a bank chooses, the memo and the decision are the bank’s, and the vendor is a third party to be overseen.
Is de-risking cheaper than EDD?
On a narrow cost line it can look that way, which is why so many banks have done it. GAO’s survey found that an estimated 80% of Southwest-border banks terminated accounts for BSA/AML risk reasons, and about 80% limited or did not offer accounts to customers considered high risk “because the customers drew heightened regulatory oversight” (GAO-18-263). Nationally, 18 banks reported closing 1,098 money transmitter accounts in 2016, 89% of them at six very large banks (GAO-20-46), and correspondent banks fell by 20% between 2011 and 2018 (BIS Quarterly Review, 2020).
Treasury’s 2023 de-risking strategy found that profitability, more than anything else, drives banks’ decisions to exit customers (US Treasury, April 2023). In other words, banks exit customers when the cost of diligence exceeds the revenue, so a lower cost per EDD file changes which customers are worth keeping. FATF calls de-risking and financial exclusion contrary to the risk-based approach (FATF, 2021).
Policy has also moved against blanket exits. Executive Order 14331 of August 2025 requires banking decisions to rest on an objective, risk-based look at each customer (Federal Register, August 12, 2025), the OCC and FDIC removed reputation risk from supervision in June 2026, and FinCEN’s April 2026 program proposal, not yet final, aims to reduce the risk that banks are improperly pushed into closing customers’ accounts (FinCEN NPRM). An exit still needs an individual, documented reason. The rules on which customers need EDD at all are set out in when enhanced due diligence is required.
About 600 annual reviews a year is a capacity question before it is a software question
What to look for in enhanced due diligence software
Look for what it does with your data, not what it says about the customer. The questions below are about cost, control and fit; the governance questions specific to AI are in AI enhanced due diligence: who decides.
Seven questions that decide the total cost of EDD software
- Does it read our core, monitoring system and document imaging directly?
If the analyst still exports and uploads, most of the gathering hours remain.
- Does it use our templates and our EDD policy?
Per category: which customers, what the file contains, who approves, how fast.
- Does each cycle start from the last approved file?
The declared range and prior decisions should carry forward, so year two costs less than year one.
- What does it write back, and when?
Expected activity and thresholds should change only after approval, with the old value kept.
- What does the examiner get?
One export with the memo, sources, approvals and reason codes saves exam preparation time every cycle.
- Can we test it on our own past files first?
Agreement with decisions you already approved is the cheapest proof of fit.
- What will vendor oversight cost us?
Third-party risk management applies; budget for due diligence on the vendor itself.
Where Botminds’ Enhanced Due Diligence (EDD) Review fits, and where it does not
It fits banks whose EDD population is mostly recurring files built from the bank’s own data: money services businesses, cash-intensive businesses, charities, payment processors, nonresident aliens and politically exposed persons reviewed on an annual or event-driven cycle. For those, the hours are in gathering and comparing, which the agents take over, and the value is in a cited memo an examiner can follow.
It does not replace the transaction monitoring system, which it reads and writes thresholds back to after approval; the adverse media service, which it searches; sanctions and PEP screening, which run elsewhere; or specialist investigators for on-the-ground research on foreign individuals, which a bank may still buy for its most complex relationships. And it does not decide: the analyst, the BSA Officer and, where policy says so, the Chief Risk Officer sign, and nothing is written to a system before they do.
The cost that does not move: people signing, after which the systems are updated
Budget for the enhanced due diligence program, not just the tool
Whatever the model, four costs sit outside the tool or the report fee. A written EDD policy that says which customers enter EDD, what each file contains and who approves; templates by customer category; a quality control routine, ideally a periodic double review of a sample of files, as described in measuring reviewer agreement; and, for software, governance of the agents themselves, since the interagency model risk guidance issued in April 2026 excludes generative and agentic AI. What a bank needs to have ready before starting is listed in EDD automation: the inputs to have ready.
The cheapest model is the one whose total cost per file, multiplied by the review cadence the bank’s policy sets, is lowest while every file still supports its decision. On most community banks’ numbers that comparison is decided by gathering hours, which is where the models differ most.
Questions people ask
What is enhanced due diligence software?
Software that helps a bank build and maintain EDD files on high-risk customers: gathering evidence from the bank’s systems and outside sources, comparing activity with expectations, drafting the memo and routing it for approval. The defensible versions leave every risk decision to people and cite the source of every statement.
What does an EDD report cost?
No independent survey publishes market prices for outsourced reports. In-house, Botminds estimates about 4.5 analyst hours for a hand-built annual review of a money services business, about $175 in wages at the 2025 median for compliance officers, before benefits and approval time.
Is it better to outsource enhanced due diligence?
For research the bank cannot do itself, such as background on foreign owners, often yes. For the activity analysis, the memo and the decision, no: those depend on the bank’s own data, and the 2023 interagency guidance says using a third party does not diminish the bank’s responsibilities.
Is de-risking cheaper than doing EDD?
It can look cheaper per customer, which is why Treasury found profitability to be the main driver of de-risking. But exits forgo revenue, need individual documented reasons under current policy, and run against the risk-based approach FATF and US agencies endorse.
What is an enhanced due diligence program?
The written policy, procedures, templates, people and controls a bank uses for its higher-risk customers: which customers enter EDD, what each file must contain, how often it is reviewed, who approves and how quality is tested. Tools and outsourced reports sit inside it; they do not replace it.
How long does it take to see the cost change?
Gathering hours fall from the first file the agents build. Later cycles are designed to cost less again, because each review starts from the last approved file and its declared range rather than from an empty folder. A pilot on past files shows the effect on a bank’s own numbers before it commits.