An AML remediation plan is the bank's schedule for fixing an anti-money-laundering failure, and for the customer-file part of it, the KYC remediation, its cost is driven less by the price per file than by the number of months it runs. Every month adds the run-rate of an analyst desk, quality review and programme oversight, keeps non-compliant files on the books, and brings the bank closer to deadlines that regulators enforce with new orders. That makes the useful number for a CFO or chief compliance officer not "what does the programme cost" but "what does one more month cost". Botminds' KYC Remediation is built to shorten the month count, by closing what it can from records the bank already holds and keeping a burn-up that shows the date moving.
We found no public, independent source for contractor rates or a cost per remediated file, so the money figures on this page are estimates, built from public pay data and stated assumptions you should replace with your own. The examples use a fictional sample institution, Norrell Federal Credit Union.
Why customer due diligence is where the money goes
29%
of direct BSA/AML cost went to customer due diligence, on average, at 11 banks GAO studied
15–59%
the range of that share across the banks
2%
of operating expense spent on BSA compliance at the three smallest banks
0.6%
at the three largest
What is an AML remediation plan, and what drives its cost?
An AML remediation plan sets out what the bank will fix, how, by when, and how it will show progress; for KYC, it is the scope, the standard, the plan line in files per week and the date. Its cost is driven by duration because most of the cost is people paid by the month: analysts, quality reviewers, a programme office, a share of the BSA officer, and the contact center hours the outreach creates. A plan that finishes two months earlier saves two months of all of them.
The ongoing cost base explains why remediation hurts. GAO found that customer due diligence was already the costliest area of BSA compliance at the banks it studied, with estimated costs that "ranged from about 15 percent to about 59 percent of total direct BSA/AML costs" (GAO-20-574). A remediation adds a temporary second CDD function on top of the permanent one, and smaller institutions feel it most: the Conference of State Bank Supervisors reports the smallest banks spending roughly 11% to 15.5% of payroll on compliance, against 6% to 10% at the largest (CSBS, 2025).
What one month of a remediation desk costs, estimated, built up role by role
Analysts: 10 people
+$94,200
Quality reviewers: 2 people
+$18,840
Programme manager and BSA officer time: 1.5 people
+$14,130
One month of the desk
$127,170
Not priced here, but real: contact center hours, systems and data work, the exposure of files still below standard, and any penalty or restriction a missed deadline brings.
Price the plan per month of delay
Price the plan per month of delay by adding up everything that is paid by the month and everything that grows with time, then asking which plan choices move the end date. The first part is arithmetic; the second is where the decisions are. Search-first or ask-everyone, how many customers each cohort must contact, how fast checkers can approve batches and what happens to customers who never answer each move the date by weeks.
The cost of one month of delay in an AML remediation plan
Desk run-rate
analysts × cost per person-month
The largest line on most plans; contractors are often priced by the head.
Programme sponsor
Oversight
(quality reviewers + programme office + BSA officer share) × cost per person-month
Does not shrink as the book does; the last month costs as much as the first.
Chief compliance officer
Contact center
messages that month × calls per message × cost per call
On the sample programme, 14 calls per 100 consumer messages and 31 per 100 business.
Contact center
Exposure carried
files still below standard × the risk they carry
Rarely priced, always examined; higher-risk files should leave the book first.
BSA officer
How long does a BSA remediation take?
A BSA remediation takes as long as its plan line and its customers allow, and orders set the outer limits where they apply: FDIC gave Sutton Bank 120 days for a CIP lookback; FinCEN's order against TD Bank requires its SAR look-back report "no later than April 2027", about two and a half years after the order (FinCEN Consent Order No. 2024-02). Inside those limits the duration is throughput: files that can be closed per week, against files still open.
The same remaining book at three paces: weeks to finish, and what the extra weeks cost
- Remaining 30,560 files27.8 wk
- Remaining 30,560 files31.3 wk
- Remaining 30,560 files31.3 wk
- Weeks over plan, about $120,000+6.9 wk
The arithmetic shows why throughput is a financial lever. On the sample programme a desk of eight costs, on our estimate, about $17,400 a week; a programme that slips from 975 files a week to 800 runs about seven weeks longer and costs about $120,000 more in desk time alone, before the contact center, the oversight and the exposure. The same arithmetic in reverse prices any change that raises throughput.
What happens if you miss a consent order deadline?
Missing a consent order deadline usually turns a remediation cost into a penalty and a longer order. USAA Federal Savings Bank had made commitments in 2018 to develop adequate customer due diligence and risk processes; FinCEN's 2022 order found the bank "failed to make adequate progress to meet the March 31, 2020 deadline", and FinCEN and the OCC imposed $140 million and $60 million in penalties (FinCEN Consent Order No. 2022-01). Bank of America's 2024 cease-and-desist order was followed in October 2026 by a $750 million OCC penalty that cited insufficient progress since it was issued (OCC AA-ENF-2026-41).
Neither penalty was the price of the original failure alone; both were priced partly on the delay. That is the term a cost-per-month model must carry even though it cannot be priced in advance: the probability that a slipping plan meets an examiner before it meets its date. The consent-order casebook sets out what each of these orders required.
FinCEN's April 2026 proposal for AML programmes would change the enforcement calculus for banks with a properly established programme, focusing actions on "significant or systemic failures" to implement it (FinCEN NPRM, 91 FR 18704). It is a proposal, not final, and a remediation that is running late under an existing order is unlikely to be what it has in mind.
Three costs that compound as the months pass
Some remediation costs do not just accumulate month by month; they grow, because a long programme creates more work for itself. The first is the book going stale behind the desk. Identification expires, owners change and businesses file new annual reports while the programme runs, so a file closed in month two can need attention again by month eighteen. On the sample programme the largest cohort, 14,200 files, is expired or missing identification; every month the programme runs, more IDs in the "done" column reach their own expiry dates.
The second is the front book. If onboarding still collects to the old standard while the back book is being fixed, every new account joins the remediation population. A plan that does not fix the front door first is pricing a stock that keeps growing, and an order that finds the bank's new policy had not reached its existing customers will find the same about its new ones.
The third is the look-back. When a regulator decides an earlier effort was not enough, the scope widens. The OCC's 2024 order against Blue Ridge Bank replaced a 2022 agreement and required a revised plan "to conduct an expanded review" of suspicious activity monitoring, reaching back to September 1, 2022 (OCC AA-ENF-2023-68). A longer window means more transactions, more customers touched and more files whose profiles the look-back depends on. None of the three appears in a cost-per-file quote; all three appear in a cost-per-month model if someone asks what grows with time.
What does AML remediation cost? The inputs you can actually find
AML remediation cost can be estimated from inputs most banks already hold, even though no public benchmark exists for cost per file. The table lists each input, where to get it, and what the sample programme or a public source says about it.
What to price in a KYC remediation plan, and where each number comes from
| Input | Where it comes from | Reference point |
|---|---|---|
| Files in scope, by cohort | The gap analysis | Sample: 38,400 files in four cohorts |
| Files that can close from the bank’s own records | A pilot search on a few hundred files | Sample: 3,982 of 5,614 business files |
| People-minutes per file, by cohort | A timed pilot | Solution estimate for one business file: 95 by hand, 21 with agents |
| Cost per person-month | Your payroll or contract rates | BLS median for compliance officers: $80,730 a year |
| Calls per message | The first weeks of outreach | Sample: 14 per 100 consumer, 31 per 100 business |
| Share answering within the window | The first weeks of outreach | Sample: 58% within 14 days |
| One-time setup | Systems, data access, training | GAO: one very large bank spent about $3.7 million adding beneficial ownership, with two senior staff over two years |
The month count on one page: cohorts, files done, and days ahead of the plan line
How a bank shortens the month count
A bank shortens the month count by removing files from the outreach path, asking each remaining customer once, and keeping checkers from becoming the queue. Each of those is a design choice, not a staffing one. On the sample programme, one search of business loan files closed 3,982 files from the credit union's own records, and approving that one batch moved the programme from 32 to 61 days ahead of its plan line: 29 days, about a month of the sample desk’s run-rate, or roughly $75,000 on the estimate above for six analysts and two reviewers.
Outreach is the second lever. Every customer asked is a file that waits, on the sample programme's settings, up to 44 days before anyone can decide about silence. Pacing messages to the contact center keeps that wait from producing a second queue at the phones. The third lever is approval: checkers who can read a sampled file's sources in one view approve batches in a morning, not a week, and the sampling guide shows what they need to see.
Outreach paced to the phones: messages a week against calls the team can take
Where KYC Remediation fits in an AML remediation plan
KYC Remediation fits the customer-file part of an AML remediation plan: the cohorts, the search, the outreach, the batches and the burn-up. It does not run a transaction lookback, rebuild monitoring rules or write the plan a regulator approves. Where the plan's cost is driven by months, it changes the inputs that set the month count: files closed from the bank's own records with every source cited, one paced message per customer for what is left, batches approved on a stated sample, and a Program Forecaster that keeps the burn-up against the plan line and drafts the monthly board report from the same numbers the desk works from.
The way to price it is the way to price any remediation: run it on a pilot of your own files, measure the share that closes from records, the minutes per file and the calls per message, and put those numbers into the formula above. To start from the programme page and the burn-up, see KYC Remediation; for the week-by-week version of the plan, see clearing a KYC backlog.
Questions people ask
What is a BSA remediation plan?
It is the bank's written plan to fix Bank Secrecy Act failures: what will change, who is responsible, the milestones and the evidence of completion. Under an order, it usually goes to the regulator for non-objection. Evolve's 2024 order, for example, required a plan with intermediate timelines and milestones to remediate due diligence on existing customers.
How do you budget a KYC remediation?
Budget it by month: people paid monthly, times the months the plan line implies, plus one-time setup and contact center load. Measure minutes per file and the share that closes from internal records on a pilot before fixing the budget. Then price the cost of each extra month, because that is where overruns come from.
Why do AML remediation programmes go over budget?
Mostly because they run longer than planned: customers answer more slowly than assumed, every customer is asked for every gap, checkers become a queue, or the scope changes midway. Each adds months, and most costs are monthly. Missing a regulator's deadline can then add penalties, as USAA's 2022 orders show.
Is it cheaper to hire contractors or use automation for remediation?
It depends on which tasks each would do. Contractors priced per head scale the searching and writing that agents can take off people's hours; automation does not remove the decisions, calls and checks, which still need people. Most programmes are cheapest with a smaller desk doing judgment work and agents doing the mechanical tasks.
Does a remediation plan need board approval?
Orders typically require board oversight of the remediation, and credit unions' BSA programmes must be approved by the board and reflected in its minutes under 12 CFR 748.2. In practice the board or a committee approves the plan and receives progress reports against it. On the sample programme, the Program Forecaster drafts the monthly board report for the BSA officer to sign.