AML Alert Triage Is the Most Expensive Workload Banks Still Do by Hand
The economics are upside-down. A senior compliance analyst at a regional bank reviews AML alerts at a fully-loaded cost of $80–120 per hour and processes 20–40 alerts per shift. A modern model can draft the entire narrative — sanctioning hits, transaction context, KYC reconciliation, disposition recommendation — in seconds at a cost measured in cents.
The financial-crime AI vendors that own this category — Quantexa, NICE Actimize AI, Hawk AI, ComplyAdvantage, Feedzai, SAS — know the economics. Per-alert fees of $0.50–2 are common; per-analyst seats can run $5,000–15,000/year. Either pricing shape captures the value of the analyst-hour replaced, not the cost of producing the narrative.
The cost of producing the narrative is small. The math is the post.
What an AML Alert Narrative Actually Costs Per Token
A typical AML alert narrative is about 800 input tokens (transaction context, customer history, sanctions hits, KYC summary) and 1,200 output tokens (the structured narrative with cited reasoning, disposition recommendation, and SAR-readiness flag). Cost-per-alert on the major models:
| Model | Input ($/MTok) | Output ($/MTok) | $ per alert | When to use it |
|---|---|---|---|---|
| Claude Opus 4.7 | $15 | $75 | $0.102 | Complex multi-hop sanctions investigations |
| GPT-5 | $10 | $30 | $0.044 | Mixed-complexity escalated alerts |
| Claude Sonnet 4.6 | $3 | $15 | $0.020 | Standard alert triage workhorse |
| Gemini 3 Pro | $3.50 | $10.50 | $0.016 | Long-context (multi-account) reviews |
| Claude Haiku 4.5 | $1 | $5 | $0.007 | Tier-1 routing, transaction tagging |
| Llama 4 / DeepSeek-R1 (self-hosted) | ~$0 | ~$0 | ~$0 | Inside the bank's VPC |
Frontier model: 10 cents per alert. Standard workhorse: 2 cents. Self-hosted: marginal cost is electricity.
Monthly Bills at Three Scale Tiers
- Community bank (500 employees): ~3,000 alerts/month
- Regional bank (10,000 employees): ~40,000 alerts/month
- Global bank / G-SIB: ~250,000 alerts/month
Monthly cost using Claude Sonnet 4.6 vs the per-alert and per-analyst alternatives:
| Approach | Pricing shape | Community (3K/mo) | Regional (40K/mo) | G-SIB (250K/mo) |
|---|---|---|---|---|
| Specialty AML AI vendor | Per-alert (~$1/alert) | $3,000 | $40,000 | $250,000 |
| Specialty AML AI (per-analyst) | ~$800/analyst/mo | ~$8,000 | ~$80,000 | ~$400,000 |
| ChatGPT Enterprise | $60/seat × all employees | ~$30,000 | ~$600,000 | ~$6,000,000+ |
| Direct API — Claude Sonnet 4.6 | Token-based | ~$61 | ~$816 | ~$5,100 |
| Direct API — GPT-5 | Token-based | ~$132 | ~$1,760 | ~$11,000 |
| ibl.ai self-hosted (Llama 4 / DeepSeek-R1) | Flat license + GPU | ~$2,000 | ~$5,000–10,000 | ~$15,000–25,000 |
At G-SIB scale, the specialty per-analyst vendor is ~20× more expensive than the all-in self-hosted line for the same alerts dispositioned.
SR 11-7 Is the Argument for Self-Hosting, Not Against It
The pitch from managed AML AI vendors often centers on regulatory comfort — "we're SOC 2, we have a BSA-trained model, we've been examined." That comfort is real, but it's marginal compared to the SR 11-7 question the bank's model-risk committee actually asks: can we validate and govern this model in our own MRM framework?
The honest answer with a managed vendor is "partially" — the bank can validate inputs and outputs, but the model itself, the training data, the inference path, and the change-control are all behind the vendor's curtain. SR 11-7's governance requirements implicate the whole stack; managed vendors give the bank governance over the half they touch.
Self-hosting flips the geometry. The model is inspectable. The change log is the bank's. The version pinning is in the bank's CI. The MRM team can swap Sonnet for Opus for a complex investigation tier and document it the same week. The validation pack is built once for the bank's stack, not redone every time the vendor ships a model update.
Why GLBA + FINRA Lock-In Compounds
GLBA scopes customer interaction data; FINRA examiners can subpoena the full reasoning behind any flagged transaction. Both pressures push the same direction: the reasoning has to live inside the bank's audit perimeter, not in a vendor's cloud.
A managed AML AI vendor with the best DPA in the industry still produces a chain-of-custody question at every regulator request. A self-hosted claw doesn't — the reasoning is produced inside the bank's environment, logged into the bank's SIEM, and reproducible against the exact model version the bank had pinned that day.
What Stays the Same, What Changes
Self-hosting AML triage AI doesn't mean rebuilding the bank's compliance tooling. The analyst-facing chat UI, the case dashboards, the audit logs, the model-routing-with-fallbacks, the multi-agent orchestration, the integration with the transaction monitoring system, Bloomberg / Refinitiv, and the bank's SIEM — all stays managed by ibl.ai. The compute, the model, and the transaction data move inside the bank's VPC.
What disappears: the $250–400K/month per-alert or per-analyst bill at G-SIB scale.
What appears: a self-hosted AML triage capability the bank owns and the MRM team can validate, with a model-routing recipe the compliance department designed:
- Opus for complex multi-hop sanctions investigations and escalated SAR-readiness cases
- Sonnet for standard alert triage (the bulk)
- Haiku for tier-1 routing and transaction tagging
- Llama 4 self-hosted for the highest-volume routine routing where pennies matter at 250K+ alerts/month
Run the Numbers for Your Bank
For the segment-wide cost-math context (not just AML), see AI Cost Math for Financial Services: Per-Seat vs Usage-Based in 2026.
For the deployment comparison side-by-side — including FINRA / SR 11-7 / GLBA posture and air-gapped options for trading and private-client desks — see Self-Hosted AI vs ChatGPT Enterprise for Financial Services.
For the full SEC / FINRA / SOX / PCI / SR 11-7 aligned architecture (Bloomberg / Refinitiv / FIS integration, model-output versioning, air-gapped tier), read Financial Services AI Reference Architecture on ibl.ai.
For the staged deployment recipe — Managed VPC for low-sensitivity workloads + air-gapped for trading and private-client — see Financial Services Blueprint: Air-Gapped AI in 90 Days.
For the broader pricing landscape across every model and per-seat vendor, the hub: What Does AI Actually Cost in 2026?.
Why Family-Owned and New York Matters Here
For a bank's AML program, the AI vendor relationship sits at the intersection of model-risk, third-party-risk, and operational-risk. ibl.ai is family-owned and operated from New York, NY — a long-term partner with a perpetual platform license and no investor exit pressure. The runtime is open source. The transaction data stays inside the bank's VPC. The math works at a 500-employee community bank or a 100,000-employee G-SIB.