How do you build an AML and KYC compliance software go-to-market motion in 2027?

What changes by company stage

The mistake most financial-crime vendors make is running one motion at every size. AML is not a single market; it is four markets stacked on top of each other, separated by who the regulator is, who signs, and whether the buyer has a consent order sitting on their desk. The go-to-market motion has to change shape at each transition or the unit economics quietly invert.

At pre-seed and seed, before there is a compliance-grade product, the only viable motion is founder-led and design-partner-driven. You are not selling software yet — you are selling co-development to two or three institutions willing to give you historical alert data under an NDA. The right design partners are almost never Tier 1 banks; they are community banks, credit unions, or a fast-growing fintech whose sponsor bank just told them their transaction monitoring is inadequate. Those buyers move in weeks rather than quarters, they have a named BSA Officer who will actually take a call, and their alert volumes (thousands per month, not millions) are small enough that your model can be evaluated honestly. Expect $10K–$80K contracts here, often structured as pilots with the explicit understanding that the reference and the data are the real consideration.

At Series A, the motion becomes repeatable mid-market selling. This is where you pick a wedge and refuse to leave it. The three durable wedges in this category are enterprise transaction monitoring and sanctions screening (where NICE Actimize, Oracle FCCM, SAS, FICO's Siron line, ACI Worldwide, FIS, and Fiserv already sit); crypto AML and FATF Travel Rule (Chainalysis, Elliptic, TRM Labs, Notabene, ComplyAdvantage's Travel Rule product); and modern API-first AML plus KYC plus fraud in one stack (ComplyAdvantage, Unit21, Hummingbird, Sardine, Alloy). A Series A company that tries all three ships nothing credible in any of them. Contracts move to $80K–$400K, the sales cycle stretches to four to seven months, and you hire your first non-founder AE — ideally someone who carried a bag at Verafin, ComplyAdvantage, or Abrigo and already knows how a community bank's exam cycle drives budget.

At Series B and beyond, the motion becomes committee selling with procurement, model-risk validation, and audit-committee review baked in. Cycles stretch to nine to twelve months. Contracts move to $500K–$2M. You now need an RFP function, because enterprise AML RFPs commonly run two hundred to four hundred questions and a founder answering them ad hoc becomes the bottleneck that kills Q4. You also need analyst air cover — Chartis Research, Datos Insights (formerly Aite-Novarica), Forrester, and Gartner all publish evaluations that gate shortlists, and a vendor absent from those grids gets screened out before the first call. This is also the stage where Big 4 financial-crime practices (Deloitte, EY, PwC, KPMG) stop being nice-to-have and become the primary source of enterprise pipeline, because remediation engagements under a consent order are where software gets selected.

At growth stage and public-company scale, the motion inverts: most new revenue comes from module attach inside the installed base rather than from logo acquisition. Transaction monitoring alone caps net retention in the low hundreds. Attaching sanctions screening, KYC, KYB, ultimate-beneficial-ownership discovery, crypto transaction monitoring, Travel Rule, and case management is what pushes net retention meaningfully higher. The comparable dynamic exists in adjacent compliance categories — trade compliance, third-party risk, and regulatory reporting all show the same pattern where the single-module vendor plateaus and the platform vendor compounds.

Stage-by-stage playbook

Here is what to actually do at each stage, in order, with the artifacts that unblock the next one.

Seed — earn the data. Sign two to four design partners. Give them the product free or near-free for twelve months in exchange for three things in writing: historical alert and case exports, a named reference willing to take peer calls, and permission to publish anonymized results. Build one thing well: a replay harness that ingests a bank's last twelve to twenty-four months of alerts and disposition outcomes, runs your detection logic against them, and produces a side-by-side comparison. That harness is not a feature; it is your entire go-to-market for the next three years. Everything downstream — the sandbox, the ROI model, the RFP answer, the analyst briefing — is generated from it.

Series A — productize the wedge. Turn the replay harness into a repeatable sixty-day sandbox engagement with a fixed scope document, a data-intake checklist, and a standard readout deck. Publish a reference architecture showing how you integrate with core banking (Fiserv, FIS, Jack Henry in the US mid-market), payment rails, and the screening data providers your buyers already license — World-Check from LSEG, Dow Jones Risk & Compliance, Moody's screening data, Sayari for ownership and supply-chain graph. Buyers do not want to re-paper their watchlist contracts to use you. Being data-provider-agnostic is a positioning advantage against incumbents that bundle.

Series B — build the three enterprise unlocks. First, an RFP response library covering the standard question set: model governance and validation documentation aligned to supervisory model-risk guidance, SOC 2 Type II, data residency, tuning-and-threshold-setting methodology, SAR workflow and audit trail, and independent-testing support. Second, a partner motion with Big 4 financial-crime practices and the sanctions bar — the law firms that run investigations and look-backs influence software selection more than most vendors realize. Third, an analyst relations cadence: two briefings a year minimum with Chartis, Datos Insights, Forrester, and Gartner, with customer references pre-warmed before each evaluation window opens.

Growth — industrialize expansion. Instrument module attach as a first-class metric per account. Build a customer-success motion staffed by former BSA Officers and MLROs rather than generalist CSMs, because the renewal conversation in this category is an exam-readiness conversation. Run a quarterly compliance-officer advisory council. Time outbound to regulatory calendar events — enforcement actions, new or expanded sanctions programs, and effective dates for regimes like the EU's AMLD package, DORA, MiCA, and UK payment-sector rules all create budget that did not exist the prior quarter.

The sequencing matters more than the speed. A company that reaches Series B without the replay harness has no compression artifact, so every deal reverts to a feature-by-feature bake-off against vendors with twenty years of reference customers — a fight you lose on paper regardless of how good the detection is.

The buying committee and how it shifts

Enterprise AML purchases above roughly $300K typically involve five distinct seats, and the composition shifts by stage in a way that changes your messaging.

The Chief Compliance Officer or Head of Financial Crimes owns the product decision. Their currency is examiner confidence. They are not buying efficiency; they are buying the ability to sit across from a regulator and defend how alerts are generated, tuned, and dispositioned. Lead with explainability and audit trail, not model accuracy.

The BSA Officer or MLRO co-signs and is often the most important seat, because in several jurisdictions the role carries personal accountability for reporting failures. This person will kill a deal over a workflow gap in SAR filing or an inability to document why a threshold was set where it was. Give them a dedicated track in the sandbox.

The Chief Risk Officer signs because enforcement exposure is a board-level risk item. Large AML penalties in this sector have run into the hundreds of millions and, in the most severe cases, billions of dollars — the CRO's frame is tail risk, not operating cost.

The CIO owns integration and has effective veto power. If you cannot articulate day-one connectivity to the core banking platform, the payment rails, and the screening data the institution already licenses, the deal stalls in architecture review regardless of who loves the product.

The General Counsel owns regulatory and contractual exposure — data processing, cross-border transfer, retention, and whether your model documentation survives an independent validation.

At seed and early Series A you will often sell to a single person wearing three of these hats at a community bank or fintech. That is a feature, not a limitation: it is how you get to a reference fast. The failure is assuming that motion scales. The first time you take that one-threaded approach into a regional bank, you lose six weeks discovering the CIO was never in the room.

Numbers that matter at each stage

Use one consistent segment definition or your board reporting becomes noise. The workable frame is three tiers.

Enterprise — Tier 1 and Tier 2 banks, global payment processors, and the largest fintechs. Sales cycle nine to twelve months. Annual contract value $2M–$5M or more at the top end, with $1M a realistic floor once you are through procurement and audit-committee review. Implementation services commonly run one and a half to three times first-year subscription, and you should price them honestly rather than discounting them into the subscription — understated services revenue is the most common cause of a blown gross-margin forecast in this category.

Mid-market — regional banks, larger credit unions, and mid-size fintechs. Cycle six to nine months. ACV $150K–$2M. This is where multi-year structure pays: three-year commitments close materially more often when paired with a ten to sixteen percent discount, and they stabilize the renewal base ahead of a Series B raise.

SMB — community banks, neobanks, smaller crypto exchanges and money services businesses. Cycle three to six months. ACV $10K–$150K. Per-check and per-screening pricing dominates here, and identity-verification vendors have anchored buyers to sub-dollar to low-single-dollar per-verification economics, so a platform floor above roughly $40K needs a clear justification.

Across the blended book, the operating targets that indicate a healthy motion: win rate in the low-to-mid twenties percent early, climbing toward the low thirties once analyst coverage and references compound; net revenue retention of 110% to 124%, driven almost entirely by module attach rather than seat growth; CAC payback of eighteen to thirty months, which is long by general SaaS standards and acceptable here because logo churn in regulated compliance categories is unusually low; gross margin of 76% to 86% depending on how much managed-service and alert-review work you take on.

The ROI model that closes deals has two halves. The operational half is analyst efficiency: legacy rules-based transaction monitoring generates very high false-positive rates, and every percentage point of reduction maps directly to review hours. Translate it into headcount — a bank running thirty alert reviewers at fully loaded cost understands "you free up nine analysts" far better than "we cut false positives by thirty percent." The second half is penalty avoidance, and it is the one the CRO responds to. You do not need to invent numbers here; the public enforcement record in this sector contains settlements ranging from tens of millions to multiple billions of dollars, and pointing the buyer at their own regulator's published enforcement actions is more persuasive than any slide you build.

One caution on pricing architecture: per-screening and per-alert usage pricing is attractive because it grows with the customer, but it also means your revenue rises exactly when your customer's compliance costs are rising — which is when they are most motivated to renegotiate. Cap the usage upside contractually, or offer volume tiers that step down, so the expansion conversation stays collaborative.

Decision framework

When a deal is ambiguous, run it through a fixed set of gates rather than debating it in pipeline review.

The single highest-signal qualifier is whether the buyer can hand you historical alert data. An institution that can export twelve months of alerts and dispositions has mature data governance, a real problem they can measure, and internal sponsorship strong enough to get legal approval. An institution that cannot is either not serious or is eighteen months from being able to buy — and either way, it should not be in your current-quarter forecast.

The second gate is the trigger. Compliance software rarely sells on aspiration. It sells on an examination finding, a consent order, a matter requiring attention, an expansion into a new jurisdiction, a new sanctions program, or an acquisition that brings an unfamiliar customer book onto the platform. Build your outbound calendar around published enforcement actions and regulatory effective dates rather than around a generic quarterly cadence, and route territory by regulator rather than purely by geography.

The five failure modes worth naming explicitly, because each one is recoverable if you catch it early: running demo-only deals with no replay artifact, which lengthens cycles substantially; ignoring the CIO until proposal stage, which produces late-stage architecture vetoes; missing documentation for model governance and validation, which the General Counsel and BSA Officer will both stop on; having no Big 4 or law-firm partner motion, which starves enterprise pipeline because remediation engagements are where selection actually happens; and having no analyst coverage, which quietly keeps you off shortlists you never learn you were considered for.

Adjacent motions worth borrowing from

AML and KYC does not exist in isolation, and some of the best plays in this category are imported from neighboring compliance markets.

From fraud prevention, borrow the shared-signal argument. The operational reality at most institutions is that fraud and financial-crime teams look at overlapping data with separate tools. Vendors like Sardine, Unit21, and Alloy have built real momentum on the convergence thesis. If you can credibly serve both, the buying committee expands to include the Head of Fraud, and the budget case improves because you are consolidating two line items rather than adding one.

From third-party and supply-chain risk, borrow the ownership-graph play. Ultimate-beneficial-ownership discovery is the same graph problem whether you are screening a customer or a supplier, and vendors with ownership data (Sayari, Moody's, Dow Jones) sell into both. A KYB product that resolves corporate ownership well has a natural second market in procurement and vendor risk, which is a cheaper way to expand than building a new detection engine.

From trade compliance and export controls, borrow the sanctions-list operations discipline. Both categories live on the same underlying lists and the same screening-quality problems — name matching, transliteration, fuzzy thresholds, list-update latency. If you already operate high-quality sanctions screening for AML, the export-controls buyer is a short walk, and the motion is nearly identical: same trigger structure, same General Counsel involvement, similar cycle length.

From regulatory reporting and model risk management, borrow the validation package. Institutions must independently validate the models they rely on. Vendors that ship a pre-built validation package — documentation of methodology, performance testing, threshold rationale, ongoing monitoring plan — remove weeks from the buying cycle and materially reduce the odds of losing to an incumbent on governance grounds alone. Almost no early-stage vendor does this, and it is one of the cheapest competitive advantages available.

From crypto compliance specifically, borrow the coverage-as-moat framing. Blockchain analytics vendors compete on attribution coverage — how many addresses, entities, and chains they can identify. That is a data moat rather than a software moat, and it compounds. If your wedge is crypto, your roadmap should be measured in chains and entity coverage, not features.

The connecting thread across all of these: in compliance markets generally, the winning motion is trigger-timed, evidence-led, and committee-mapped. The product wins on the strength of what you can prove against the buyer's own historical data, and the deal wins on whether you mapped every seat that can say no.

Related questions

What is a realistic first-year revenue target for an AML startup?

With two to four design partners converted plus a handful of SMB and lower-mid-market wins, $300K–$800K in first commercial-year ARR is a defensible target. Anything materially higher usually means the founder is selling services, not software, which distorts later gross margin.

Should we build transaction monitoring or start with KYC onboarding?

KYC onboarding is faster to sell — shorter cycle, clearer per-check pricing, less model-governance scrutiny. Transaction monitoring has higher contract values and stronger retention but demands validation documentation from day one. Most successful vendors enter through onboarding and expand into monitoring.

How much does analyst coverage actually matter?

Substantially at enterprise. Chartis, Datos Insights, Forrester, and Gartner evaluations gate RFP shortlists at large institutions. Below roughly $200K ACV it matters far less, which is why mid-market-first strategies can work for two to three years before analyst relations becomes urgent.

Do we need our own sanctions data or can we integrate?

Integrate. Buyers typically already license World-Check, Dow Jones, or Moody's screening data and do not want to duplicate that spend. Being data-provider-agnostic is a positioning advantage against incumbents that bundle their own list at a premium.

When is the right time to hire a former BSA Officer?

Before your first enterprise RFP, typically around $5M–$10M ARR. That hire converts on credibility more than on process — buyers grant enormous latitude to a vendor whose customer-facing lead has personally survived an examination.

FAQ

How long is a typical enterprise AML sales cycle?

Nine to twelve months for Tier 1 and Tier 2 institutions, six to nine for mid-market regional banks and credit unions, and three to six for community banks, neobanks, and smaller money services businesses. Procurement, legal, and audit-committee review alone consume ten to twenty weeks at the enterprise end, so build that into forecast dating rather than treating it as slippage.

What does the sixty-day sandbox actually consist of?

A scoped engagement where the institution exports twelve to twenty-four months of historical alerts, cases, and underlying transactions; you replay your detection logic against that dataset; and you produce a side-by-side readout covering false-positive reduction, true-positive recall against known confirmed cases, alert-to-case conversion, and the audit trail a examiner would ask for. The readout is the artifact that moves the deal, not the demo.

Who actually blocks these deals most often?

The CIO and the BSA Officer, for different reasons. The CIO blocks on integration with core banking, payment rails, and existing screening data feeds. The BSA Officer blocks on workflow gaps — SAR filing, case documentation, threshold-tuning rationale — because that role carries personal accountability in many jurisdictions. Engage both before proposal, not after.

How do you compete against entrenched incumbents like NICE Actimize, Oracle FCCM, or SAS?

Never head-on across the full platform. Pick a wedge where the incumbent is structurally weak: graph analytics and entity resolution (where Quantexa built its position), community banks and credit unions (Verafin's stronghold), API-first developer experience (ComplyAdvantage, Unit21, Hummingbird, Sardine), or crypto and Travel Rule (Chainalysis, Elliptic, TRM Labs, Notabene). Win the wedge, then expand sideways into modules.

Is usage-based pricing better than a flat platform fee?

A hybrid works best: a platform floor that covers your fixed delivery cost plus per-screening or per-alert tiers above it. Pure usage pricing creates revenue volatility and an adversarial renewal, since your bill grows precisely when the customer's compliance cost is spiking. Pure flat pricing leaves expansion on the table. Cap the usage upside or offer stepped-down volume tiers.

What drives net revenue retention above 110%?

Module attach, almost entirely. A vendor selling transaction monitoring alone tends to plateau. Attaching sanctions screening, KYC, KYB, ultimate-beneficial-ownership discovery, crypto transaction monitoring, Travel Rule compliance, and case management is what compounds — each module is a small incremental sale to a customer who already trusts you and has already absorbed the integration cost.

Sources

• https://www.fincen.gov/resources/statutes-and-regulations/guidance
• https://www.fatf-gafi.org/en/publications/Fatfrecommendations.html
• https://ofac.treasury.gov/recent-actions
• https://www.acams.org/
• https://www.wolfsberg-principles.com/
• https://www.fca.org.uk/firms/financial-crime
• https://www.federalreserve.gov/supervisionreg/srletters/sr1107.htm
• https://www.eba.europa.eu/regulation-and-policy/anti-money-laundering-and-countering-financing-terrorism
• https://www.mas.gov.sg/regulation/anti-money-laundering
• https://www.ffiec.gov/bsa_aml_infobase/default.htm

Related on PULSE

• [How do you build a trade compliance software go-to-market motion in 2027?](/knowledge/gp0054)
• [How do you build a compliance training platform go-to-market motion in 2027?](/knowledge/gp0069)
• [How do you build a medical device software / SaMD go-to-market motion in 2027?](/knowledge/gp0117)
• [How do you build a forestry management software go-to-market motion in 2027?](/knowledge/gp0122)
• [How do you build an aquaculture software go-to-market motion in 2027?](/knowledge/gp0121)
• [How do you build a livestock management software go-to-market motion in 2027?](/knowledge/gp0120)