Keep KYC in-house when your team has the expertise and capacity to own the work. Consider managed services when you need people to deliver a defined workload. Consider AI software when capable reviewers spend too much time preparing files. Combine them when different parts of the workload need different support.
These choices overlap. An internal team can use AI, and a managed provider can use the same software. The useful comparison is between complete operating models: who gathers evidence, investigates gaps, checks quality and makes decisions, using which tools.
This guide is for compliance leads, COOs and procurement teams comparing customer or investor due diligence, including entity ownership, onboarding, periodic reviews and remediation. An identity-verification API alone may cover only part of that work. Transaction monitoring, regulatory reporting and statutory officer appointments need their own scope.
AgentKYZ sells both KYC software and managed services. The criteria below are our buying recommendations, not an independent vendor ranking. Apply them to us as well as other providers.
Download the free comparison scorecard (CSV) to record your own evidence, costs and priorities as you read. No registration required.
Define what you are buying
In-house KYC means your employees run the process. They may use spreadsheets, case-management systems, purchased data and automation. Keeping delivery internal does not require building your own software. Building a platform adds engineering, security, maintenance and model-governance responsibilities to the staffing decision.
Managed KYC services means a provider performs agreed operational work, such as document review, ownership analysis, screening investigation or remediation. Distinguish a service with responsibility for deliverables and quality from staff augmentation, where you still manage individual analysts. Clarify whether document chasing, enhanced due diligence (EDD) and quality assurance are included.
AI KYC software supplies capabilities that may include extracting documents, tracing ownership, screening and drafting assessments. The term does not tell you which tasks are covered or who handles exceptions. An internal reviewer still needs to understand the evidence and the applicable policy.
The market already combines these models. KPMG describes managed KYC delivery both on a client’s systems and with its own AI-based platform. That is evidence of different delivery options, not independent proof of the performance or savings claimed on a supplier’s page.
Technology readiness also matters. PwC’s 2024 UK AML survey covered 35 UK financial institutions, mainly payment institutions, banks and asset managers. It reported that 68% identified data sharing with external providers as an AI constraint, while 50% said their processes were not mature enough for effective AI implementation (pages 5 and 33). These are respondents’ assessments from a small UK sample, not global adoption rates or a comparison of delivery-model outcomes.
Compare the models on nine criteria
Use the table to identify what you need to demonstrate in a pilot or contract. It describes typical tradeoffs, not guaranteed properties of every team or supplier. The in-house column assumes your existing tools; the AI column assumes your team will run the new software.
On a narrow screen, scroll the table horizontally. Keyboard users can focus the table area and use the arrow keys.
| Criterion | In-house delivery | Managed services | AI software + your team |
|---|---|---|---|
| Control | Direct control of priorities, staffing and exceptions. Internal processes still need discipline. | Control depends on the service scope, access to files and escalation rights. | Your team runs reviews; verify policy configuration and recorded overrides. |
| Expertise | Build and retain knowledge of your clients and risk appetite. Cover absences and specialist gaps. | Buy relevant capacity and experience. Check the actual delivery team, not just the firm's credentials. | Automate preparation where it works. Keep people who can challenge findings and resolve complex cases. |
| Implementation | May be simplest if a capable team already exists. Hiring and training take time if it does not. | Requires due diligence, scope agreement, access and calibration. Migration may still be needed. | Requires data preparation, policy mapping, integration, testing and reviewer training. |
| Scalability | Limited by productive reviewer capacity and management cover. | Can add capacity if contracted. Check surge limits and staff availability. | May increase processing capacity; human exception queues and data limits can remain bottlenecks. |
| Quality assurance | Own sampling, second review, training and correction. Familiarity can hide recurring errors. | Check supplier QA and perform your own oversight. Speed targets must not reward incomplete files. | Test missed facts and unsupported conclusions, as well as human review and software changes. |
| Data handling | Control internal access and retention; purchased tools can still involve third parties. | Map delivery locations, subcontractors, document transfers and access rights. | Map hosting, model providers, logs, training use, retention and international transfers. |
| Total cost | Staff, management, training, tools, data and unused capacity between peaks. | Service fees plus retained oversight, out-of-scope work, minimums and transition costs. | Licences or usage, data, integration, validation, reviewers, support and ongoing change costs. |
| Oversight | Monitor case quality, backlogs and internal controls. Separate delivery from assurance. | Monitor files and service levels, challenge findings and retain decision capacity. | Monitor system performance, exceptions, model changes and reviewer dependence on automation. |
| Exit risk | Key-person dependence and undocumented processes can make handover difficult. | Provider dependence, lost expertise and inaccessible records can obstruct transition. | Proprietary data formats, workflows and missing audit-history exports can create lock-in. |
There is no automatic winner on cost or quality. A well-run internal team can outperform a poorly governed service, and adding software to a broken workflow can make the same mistakes at greater volume.
Keep accountability separate from delivery
Do not buy any of these models on the premise that it transfers your firm’s regulatory obligations. The UK FCA states that firms remain responsible and accountable for the regulatory responsibilities applying to outsourcing and third-party arrangements. It also distinguishes outsourcing from other third-party supply while requiring appropriate risk management for both.
Outsourcing is also different from third-party reliance. In its 2023 Q&A on the EU AML framework, the EBA distinguishes a provider applying your procedures on your behalf from reliance on another regulated party’s own due diligence and customer relationship. A managed-service contract does not, by itself, establish statutory reliance.
Those are jurisdiction-specific sources, not a universal legal checklist. Confirm your entity’s applicable AML, outsourcing, privacy and AI requirements, including any notification or approval needed before appointment.
For every option, name who owns the policy, requests missing evidence, investigates alerts, reviews the file, accepts risk and escalates suspicious activity. Identify the authorised customer-acceptance, high-risk approval and reporting roles under your governance and local rules. A software status of “complete” should never be mistaken for an approval that has not occurred.
When each model, or a hybrid, makes sense
Keep delivery in-house when knowledge and control dominate
An established team with manageable volumes, good quality results and deep knowledge of unusual customers may have little reason to outsource. Improve its tools or remove duplicate data entry before replacing a process that works.
Check whether the apparent capacity includes leave, training, quality checks and escalations. A small team dependent on one experienced reviewer may need cover even if its average workload looks comfortable.
Use managed services for a defined capacity or expertise gap
A remediation deadline, recurring review workload or temporary onboarding surge can justify buying delivery capacity. Relevant jurisdiction, language and entity experience may matter more than the size of the provider.
Managed services are a weaker fit if the proposed team cannot apply your policy, access the evidence lawfully or explain a difficult decision. They also cannot resolve an internal approval bottleneck unless you assign people to receive and act on escalations. Our fund administrator selection guide covers broader provider due diligence.
Add AI software when capable reviewers need better preparation
Software is worth testing when reviewers repeatedly extract the same facts, reconcile ownership documents or assemble assessments. It may free time for investigation, but the size of that benefit depends on document quality, integrations and the proportion of exceptions.
It is a weaker starting point when nobody can validate the output, the policy is unresolved, or the missing input is evidence that no system can infer reliably. Measure reviewer time after correction, not just how quickly a draft appears.
Use a hybrid where the handoffs are explicit
Several combinations are sensible:
- Internal team + AI + surge support: your reviewers run normal volumes; a managed team takes a defined backlog. Use the same policy and completion standard, and reconcile returned cases.
- Managed preparation + retained decisions: the provider gathers and reviews evidence; your authorised team investigates escalations and makes reserved decisions. Define who chases missing information and when unresolved files return.
- Routine internal reviews + specialist complex-case support: route agreed structures, jurisdictions or risk indicators to specialists. Specify whether they advise, investigate or approve within an authorised role.
- Administrator delivery + separate oversight: retain the administrator’s operational role and commission file testing to challenge quality. Assess independence; routine QA or file testing is not automatically a substitute for a required independent AML audit.
Give each open case one accountable owner. Agree a shared case identifier, handoff evidence, response deadlines and a route back when the receiving reviewer disagrees. Avoid a hybrid that requires three teams to maintain conflicting versions of the same file.
Calculate total cost on the same scope
Start with the same case population, review standard and planning period. Split straightforward individuals from layered entities, trusts, higher-risk cases and incomplete legacy files. An “average case” price can conceal a different workload in each quote.
For a chosen period, add implementation and transition + internal people + managed-service fees + software and data + oversight and QA + rework and exceptions + exit costs. Show one-off costs separately from recurring costs, and do not double-count work already included in a service fee.
Include the following items before comparing totals:
- For internal delivery: fully loaded compensation, management, recruitment, training, leave cover, tools and productive capacity. Salaried time remains a resource cost even if no new hire is approved.
- For managed delivery: setup, minimum commitments, case or hourly fees, complexity bands, document chasing, EDD, repeat reviews, audit support and your retained team.
- For AI software: licences, usage, screening and registry data, integrations, migration, configuration, validation, reviewer time, corrections and model-change testing.
- For every model: security and procurement work, parallel running, records retention, export and handover. Record service interruption and regulatory risks separately rather than inventing an expected fine.
Ask what makes a case billable, what counts as completed, who pays for corrections and what pauses the service-level clock. A first-pass analysis, a reviewed file and a customer-acceptance decision are different deliverables.
Use cost per case meeting the agreed QA standard alongside total spend. That denominator can include properly documented rejection decisions; it should not incentivise approving customers. Keep unresolved and abandoned cases visible rather than quietly dropping them from the calculation.
Run a low-volume case, an expected-volume case and a backlog or high-complexity case. Separate cash savings from released capacity: if your employees remain in place, time saved may improve service without reducing payroll.
Download the editable KYC delivery-model scorecard and cost worksheet (CSV). It includes blank columns for all four models, evidence checks and cost categories. Set your own assumptions; it contains no supplier prices or preselected winner.
Test quality with a representative pilot
Agree expected outcomes under your policy before providers see the test set. Use lawfully shared, suitably redacted or synthetic files. Include straightforward cases to measure normal work, plus layered ownership, missing documents, transliterated names, possible screening matches and contradictory evidence. Keep some cases out of initial configuration and training so the test measures more than familiarity.
Have qualified reviewers establish and adjudicate the reference answers. Test the proposed managed team or internal workflow as well as the software. A sales demonstration conducted by a different team is not the same as a delivery pilot.
Measure:
- Material misses: missing owners, relevant alerts or evidence gaps that should prevent a case from being treated as ready. Count critical failures separately from minor defects.
- Unnecessary escalations: false matches and unsupported concerns that consume reviewer time. Confirm that reducing them does not increase material misses.
- Evidence quality: whether each material conclusion can be traced to the right document, source, date and reviewer. A linked document must actually support the claim.
- Effort and time: preparation, human review, correction and customer waiting time. Report end-to-end turnaround and unresolved queue age as well as hands-on minutes.
Set acceptance thresholds by risk before the pilot. Compare results by case type rather than relying on one “accuracy” percentage. For example, near-perfect extraction of addresses does not compensate for a missed beneficial owner. Small pilots establish limited evidence, not a universal performance guarantee.
For generative AI, NIST’s voluntary AI 600-1 profile identifies confidently false output and fabricated supporting logic or citations as risks (section 2.2). It recommends verifying sources and citations in testing and ongoing monitoring, and avoiding extrapolation from narrow assessments (MS-2.5-001 and MS-2.5-003).
Ask the system to handle an unreadable page and a missing ownership link. It should expose the gap rather than invent an answer. Check recorded human overrides, restricted approval permissions and what happens after a model, screening source or policy changes. Agree retesting and a fallback process before live use.
Check data handling and rehearse the exit
Internal delivery does not necessarily keep data inside your infrastructure, and outsourced delivery does not necessarily require a provider-owned platform. Map the actual flow of identity documents, ownership evidence, screening results and decision records.
Before transferring files, request written answers on:
- Processing and storage locations, remote staff access, subprocessors and any model providers. Include logs, backups and support tools, not just the primary database.
- Data-protection roles, permitted purposes and international-transfer arrangements. Ask whether customer data, prompts or outputs are used for training or retained by an upstream provider.
- Access controls, authentication, encryption, incident notification and continuity testing. Read assurance-report scope and exceptions; a badge alone does not validate KYC file quality.
- Retention, legal holds, deletion and audit access. Match contractual promises to applicable AML recordkeeping and privacy requirements.
- Export formats, costs, assistance and access after termination. Test the documents, relationships, screening decisions, reviewer notes and history, not just a customer list.
Where the UK GDPR applies, the ICO’s contracts guidance explains processor terms covering documented instructions, security, subprocessors, assistance, audit rights and return or deletion of data, subject to legal retention requirements. The ICO flags this guidance as under review following the Data (Use and Access) Act; confirm the current position for your arrangement.
Rehearse a handover before signing a long commitment. Have another reviewer reconstruct a decision from an exported file without relying on the outgoing provider’s interface. Reconcile the case inventory, outstanding requests and next review dates. Keep access until the receiving team has verified the transfer, subject to the agreed terms.
Exit risk exists internally too. Keep procedures and decision reasoning out of individual inboxes, and ensure somebody can take over when the lead analyst leaves.
Use a scorecard without averaging away a failure
First apply pass/fail gates: lawful data handling, required expertise, usable evidence and records access, workable oversight, and a credible continuity and exit arrangement. Mark a requirement not demonstrated if all you have is a promise. Do not allow a low price to offset a failed mandatory gate.
For options that pass, weight the nine comparison criteria to total 100 before reviewing final proposals. Score each from 0 (no evidence) to 5 (demonstrated fit), multiply each score by its weight divided by five, then add the results. Keep the evidence reference and assumptions next to every score. This is a procurement aid, not a regulatory rating.
Test whether a modest change in your priorities changes the preferred option. If it does, document the tradeoff rather than presenting the result as objective certainty. Compare a hybrid as a complete fourth option, including handoff costs and retained staffing.
Before launch, record who approves policy changes, reviews management information, resolves repeat defects and can pause the service. Review backlog age by risk, QA failures and correction times after launch. Include periodic file testing and independent assurance where required; a supplier’s monthly dashboard is not enough on its own.
Where AgentKYZ fits
AgentKYZ supports both sides of the delivery decision. Its AI KYC software reads case documents, maps ownership, screens sanctions, politically exposed persons and adverse media, and prepares assessments for your reviewers. Its managed KYC service adds specialists to perform agreed onboarding, periodic review and remediation work using the same platform, with human-reviewed findings and unresolved gaps returned to your team.
That makes AgentKYZ worth evaluating if you want to keep review in-house, buy delivery capacity or combine the two. It does not mean every workload needs a new provider. If your existing team meets its quality and service targets at an acceptable cost, retaining that model is a reasonable outcome of the comparison.
For administrator oversight, Shadow KYC can separately test files against your policy. Agree scope and independence; file testing does not by itself replace a programme-wide AML audit.
Bring your jurisdictions, case mix, approximate volumes, review deadlines and preferred division of work to a scoping discussion. Ask us to demonstrate a representative case and confirm pricing, data handling, reviewer responsibilities and exit terms. You do not need to send identity documents to request a quote. Your firm retains final approval and compliance responsibility.