How to choose compliance software

Step 1 — Write the obligation map first

List the regulations you are actually supervised against, the supervisory authority for each, and the specific evidence they ask for at inspection. This becomes your requirements baseline. If a requirement is not traceable to an obligation or an internal risk decision, it is a nice-to-have.

Step 2 — Quantify the operational load

• New customers or suppliers onboarded per month, and peak versus average.
• Percentage that are corporate entities requiring UBO resolution.
• Jurisdictions involved, and which registries those imply.
• Current alert volume, false-positive rate and average handling time.
• Number of analysts, and the review model (maker-checker, four-eyes).

Step 3 — Test data coverage in your markets

Ask for coverage evidence per country you operate in, not global averages. For each market, confirm the source of company registry data, refresh frequency, whether UBO data is derived or registry-sourced, and how gaps are handled. A platform with excellent US coverage can be near-useless for Cyprus, Malta, Greece or the Gulf.

Step 4 — Measure screening quality on your own data

Supply a sample of real historical records containing known true positives, known false positives and a few deliberately fuzzy names with transliteration variants. Compare recall (did it catch every true hit?) and precision (how much noise?) across vendors on the same sample. Ask how fuzzy matching thresholds are tuned and whether you can tune them per risk band.

Step 5 — Check monitoring, not just onboarding

• Is rescreening event-driven or batch, and at what latency after a list update?
• Are corporate structure changes and adverse media monitored, or only sanctions lists?
• Can risk scores be recalculated automatically when an input changes?
• What happens to alerts raised on customers who are already offboarded?

Step 6 — Interrogate the evidence trail

Ask to see a real export of everything the system would hand a regulator for a single customer: the checks run, the source records retrieved, the matched and discounted hits, the reviewer, the timestamp and the rationale. If the vendor cannot produce that in the demo, assume you will be assembling it manually later.

Step 7 — Map the integrations

• APIs for onboarding flows, with documented rate limits and sandbox access.
• Webhooks for alerts and status changes.
• Connectors or export paths to your CRM, core banking or case system.
• SSO, SCIM and role-based access aligned to your segregation of duties.
• Data residency and retention controls that satisfy GDPR and local rules.

Step 8 — Score the vendors consistently

Step 9 — Model total cost of ownership

Include the platform fee, per-check and per-report charges at realistic volumes, implementation and data migration, integration engineering, training, and the analyst hours consumed by false positives. A cheaper licence with a 30% higher false-positive rate is usually the more expensive system.

Step 10 — Plan the first 90 days before signing

• Agreed success metrics: alert volume, handling time, onboarding turnaround.
• A migration plan for existing customers and their historical evidence.
• A parallel-run period against the current process.
• Named implementation contacts and an escalation path in the contract.

Common mistakes

• Buying on demo polish rather than tested match quality.
• Ignoring UBO depth until the first complex corporate structure arrives.
• Skipping the proof of concept because timelines are tight.
• Underestimating integration effort into the onboarding funnel.
• Choosing a global vendor with thin coverage in your actual operating markets.

Frequently asked questions