What an AML program actually costs, broken down by line item
FinCEN’s own two headline numbers, about 120 hours to build a program from nothing and about $17,000 a year to test it, are averages across every covered adviser, not a receipt. FinCEN’s own regulatory impact analysis breaks both numbers into smaller pieces most summaries never quote: a separate hour estimate for updating an existing program instead of building one from scratch, a dollar cost for the board approval step, an hour estimate for building a training program versus running one, and a per-employee training cost benchmark. This page walks through all of it, one-time costs first, then the costs that repeat every year, all sourced to the same Federal Register pages FinCEN itself priced them on.
One-time costs: what the 120 hours is actually made of
FinCEN’s 120-hour estimate is specifically for a firm with “a limited number of existing AML/CFT measures in place” building a program from nothing. A firm that already has some AML measures, most commonly because it is dually registered as a broker-dealer or already runs some voluntary AML process, does not start from zero: FinCEN assumes the update burden is “approximately 25 percent of the estimated burden for entities without an existing AML/CFT program, or about 30 hours” (89 FR 72156, regulatory impact analysis, p. 72229, September 4, 2024). Whichever bucket a firm falls into decides most of the difference between a light lift and a heavy one. Two more one-time pieces sit inside that same estimate and rarely get quoted separately. First, the written program has to be approved by the firm’s board, sole proprietor, or equivalent: FinCEN estimates “approximately 4 hours for a trustee or director to review and approve a written AML/CFT program the first year it is implemented,” and prices that time at the fully loaded executive labor rate of $172.42 an hour, for “an estimated labor cost for program review and approval [of] approximately $690 for a new AML/CFT program” (89 FR 72156, p. 72229-72230). Second, the training program itself has to be built before anyone can be trained on it: FinCEN estimates “it will initially take 50 hours to develop an AML/CFT training program” for a firm without one already, or “10 hours” to review and update existing training materials for a firm that has some (89 FR 72156, p. 72230).
Recurring costs: the four things that repeat every year
The independent test is the biggest recurring line by far. FinCEN’s own estimate: “the average cost of such testing will be approximately $17,000,” described explicitly as “a new recurring cost for all RIAs and ERAs” except dually registered firms that already use independent auditors (89 FR 72156, p. 72230). See the dedicated page on who is allowed to perform this test and how often, linked below. Three smaller recurring costs sit underneath that one. Maintaining the written program itself is cheap by FinCEN’s own estimate: “approximately 1 hour to maintain and update the existing AML/CFT program plus an average of 10 minutes to store and produce upon request” it, every year (89 FR 72156, p. 72229). Board re-approval repeats too, at a lighter touch than the first year: “approximately 2 hours each subsequent year to review the program,” priced at “approximately $345 for an existing AML/CFT program” (89 FR 72156, p. 72229-72230). And training itself is not a one-time event: FinCEN “estimates approximately two-thirds of employees will need to be trained on the AML/CFT program requirements” every year, at “approximately 1 hour for each employee” (89 FR 72156, p. 72230). None of these three individually competes with the $17,000 test, but they do not disappear after year one either.
What a real per-employee training cost looks like, not just the hour count
FinCEN’s own impact analysis does not price the training hour in dollars company-wide; it instead cites an outside benchmark for what training actually costs per person once you count materials and delivery, not just the trainee’s own time: a 2020 GAO report on bank Bank Secrecy Act costs found “the average cost per employee trained ranged between $20 and $400 with a mean estimate of approximately $116 per employee,” in 2022 dollars, drawn from actual bank compliance programs (GAO, Anti-Money Laundering: Opportunities Exist to Increase Law Enforcement Use of Bank Secrecy Act Reports, and Banks’ Costs to Comply with the Act Varied, GAO-20-574, September 2020, cited at 89 FR 72156, p. 72230, footnote 359). That same GAO report, reviewing a small, non-generalizable sample of 11 banks, found total direct Bank Secrecy Act compliance costs across those banks ranging from about $14,000 to about $21 million in a single year (2018 dollars): a reminder that FinCEN’s $17,000 test estimate and 120-hour build estimate sit deliberately at the light end of what AML compliance can cost a financial institution, scaled down for an adviser’s typical size and risk profile, not an industry ceiling.
What moves your own firm off the average
FinCEN’s estimates are built for a firm with “a limited number of existing AML/CFT measures in place” and an otherwise ordinary risk profile. Among the 7,277 in-scope firms on this site’s own roster with 10 or fewer staff, 4,748 of them, 65.2 percent, already report at least one of the five risk factors that add real work beyond that baseline: private funds, direct or related-party custody of client cash or securities, a wrap fee program, a foreign regulator, or paid solicitors. Each of those adds a real, separate piece of diligence work FinCEN’s baseline hour counts do not price in specifically. Check which of them apply to your own firm below before treating any average on this page, or anywhere else, as your firm’s actual number.
FAQ
Is $17,000 a year the total cost of an AML program, or just the test? Just the test. FinCEN’s own estimate separates the build (about 120 hours, one-time, or about 30 hours to update an existing program) from the test (about $17,000 a year, recurring). The smaller recurring pieces, maintaining the written program, re-approving it each year, and re-training staff, add real but much smaller amounts on top of the test. Does a small firm get a lighter cost estimate than a large one? Not automatically. FinCEN’s average assumes a limited, ordinary risk profile. A small firm with private funds, direct custody, or a wrap fee program does not get a discount for being small; those factors add cost regardless of headcount, and 65.2 percent of the small firms (10 or fewer staff) in this site’s own scope already carry at least one of them. Where does the $17,000 figure actually come from? A 2020 GAO study of bank Bank Secrecy Act compliance costs (GAO-20-574), which FinCEN cited and adapted for the investment adviser population in its own regulatory impact analysis, not a number FinCEN invented from scratch for this rule. Do these numbers include AML software? No. FinCEN’s cost estimate is a labor-hour and professional-fee estimate for the program’s minimum requirements. Software is a separate, optional purchase some firms make to carry part of the ongoing monitoring and recordkeeping work; see the comparison of build paths (in-house, outsourced CCO, law firm, software) linked below for how that choice is typically priced on the market today. Cta: See which of these risk factors apply to my own firm Whether your own firm is in scope, and which risk factors apply to it, is what the checker at normfin.com reads off the SEC’s own adviser roster.
Sources
- FinCEN, final rule, “Anti-Money Laundering/Countering the Financing of Terrorism Program and Suspicious Activity Report Filing Requirements for Registered Investment Advisers and Exempt Reporting Advisers,” 89 FR 72156, regulatory impact analysis, pp. 72229-72230 (September 4, 2024). RIN 1506-AB58. Retrieved 2026-08-23 via a stealth fetch of https://www.govinfo.gov/content/pkg/FR-2024-09-04/html/2024-19260.htm (HTTP 200; every quoted sentence located by direct text search in the retrieved document, not summarized by a fetching tool alone). Same primary source and same page range already cited on the site as COST_ANALYSIS_CITE in lib/fincen/citations.ts, extended here with additional sentences from the same two pages that file does not currently quote. - FinCEN, final rule, 89 FR 72156, p. 72190 (September 4, 2024): the four-pillar minimum program requirement, used here to frame the cost sections. Referenced in more depth on the page-6 draft. - U.S. Government Accountability Office, “Anti-Money Laundering: Opportunities Exist to Increase Law Enforcement Use of Bank Secrecy Act Reports, and Banks’ Costs to Comply with the Act Varied,” GAO-20-574 (September 22, 2020), cited by FinCEN at 89 FR 72156, p. 72230, footnote 359, for the per-employee training cost benchmark ($20-$400, mean approximately $116, 2022 dollars) and for the $14,000-to-$21-million range of total direct BSA compliance costs across a non-generalizable sample of 11 banks (2018 dollars). Retrieved 2026-08-23 via WebSearch summary of https://www.gao.gov/products/gao-20-574; the full PDF (gao.gov/assets/gao-20-574.pdf) was not fetched directly (size), so the exact bank-level table figures (Tables 111 and 113) are cited at the level FinCEN’s own document quotes them, not re-derived independently. - ~/Code/normfin/data/firms.json and data/meta.json: SEC investment-adviser roster, roster date 2026-08-03, 11,223 firms in scope, computed 2026-08-23 (see command and output above). - ~/Code/normfin/app/compare/page.tsx and lib/copy.ts (lines 268-291): read directly to confirm no line item below duplicates either page’s existing content.
Published by Neige AI, Inc., last reviewed August 25, 2026. See the method and sources.
This page is independent research, not legal advice. It quotes FinCEN’s own rulemaking with pinpoint citations. Verify anything load-bearing against the Federal Register text itself before acting on it.