What an Empty AML Seat Costs | The Real Cost to Hire, Part 2
When an anti-money laundering (AML) analyst hands in their notice, the finance view of the next few months is simple: one salary fewer. In the illustrative Vilnius model from Part 1, twelve weeks without that analyst means about EUR 8,450 of salary and employer contributions that never leaves the account.
The compliance view is less comfortable. The periodic reviews, alerts and onboarding files that analyst cleared every week keep arriving. They wait, they land on colleagues who were already busy, or they get done faster and with less care. None of that shows up in the budget. It shows up later, in an audit finding or a regulator's notice.
This is Part 2 of The Real Cost to Hire. Part 1 priced a filled seat. The cost of a vacant AML role is harder to pin down, which is exactly why it gets ignored. Two UK enforcement cases and a long-running German one show where that cost ends up, and it is rarely the fine that hurts most.
The salary you save is the smallest number in the room
Here is an illustrative model with deliberately round numbers. A know-your-customer (KYC) team of four analysts each completes 25 periodic reviews a week. New reviews come due at 100 a week, so the team is exactly at capacity. One analyst resigns, and between the notice period, the search and the start date, the seat stays empty for twelve weeks.
The remaining three complete 75 reviews a week. The queue grows by 25 every week, so when the replacement walks in there are 300 overdue reviews. At an assumed 1.5 hours per review, that is 450 analyst hours, more than eleven full-time weeks of work on top of normal flow. The replacement only brings capacity back level with inflow, so that backlog does not shrink on its own.
So the honest comparison is EUR 8,450 saved against 450 overdue hours, plus whatever risk sits inside those 300 files. If some belong to high-risk customers whose reviews were due months ago, hours stop being the right unit.
In practice, many teams keep the dashboard green by shortening the work instead: thinner notes, fewer source checks, quicker alert closures. That is how a staffing gap turns into a quality problem, and quality problems are what supervisors find.
Starling Bank: controls that did not keep pace
Starling grew from roughly 43,000 customers in 2017 to 3.6 million in 2023, according to the UK Financial Conduct Authority's press release. The FCA's Final Notice, dated 27 September 2024, puts the problem in one sentence: "Its financial crime controls, however, failed to keep pace with its growth."
From 17 September 2021, Starling was subject to a voluntary requirement (VREQ) not to open accounts for high or higher risk customers while it fixed its AML framework. Between then and the end of November 2023 it opened more than 54,000 accounts for over 49,000 such customers anyway. Its automated sanctions screening had also been checking customers against only a fraction of the names on the UK's consolidated list of sanctions targets since it went live in 2017.
The notice is specific about resourcing. An external review found the financial crime function "under-resourced at the time of the VREQ implementation and during 2022" and short of key AML experience. By November 2022 Starling had raised its own financial crime risk rating to red, partly because of a backlog of high-risk customer reviews and screening alerts. The penalty was GBP 28,959,426. Without the 30% settlement discount it would have been GBP 40,959,426.
Monzo: the same pattern, a different entry point
Monzo's Final Notice of 7 July 2025 has a similar shape. The FCA says the bank grew almost tenfold, from around 600,000 customers in 2018 to over 5.8 million in 2022. Between October 2018 and August 2020, it found, Monzo's onboarding, customer risk assessment and transaction monitoring were not adequately designed, implemented or maintained.
A VREQ from 5 August 2020 barred new accounts for high-risk customers. By the FCA's account, Monzo repeatedly failed to comply with it until June 2022, including signing up over 34,000 high-risk customers. The notice refers to "consistent backlogs in the assessment of PEP [politically exposed person] flags", to "insufficiently experienced or trained staff performing key transaction monitoring tasks" and to "limited specialist staff".
The fine was GBP 21,091,300, again after a 30% settlement discount. In the FCA's announcement, Therese Chambers, joint executive director of enforcement and market oversight, said Monzo had onboarded customers "on the basis of limited, and in some cases, obviously implausible information".
Neither notice blames a single empty seat. Both describe a financial crime operation too small, too thin on experience and too loosely managed for the business being written. That is the empty-seat problem at scale.
The bill that arrives first is a cap on growth
In both UK cases, the first consequence was a restriction on onboarding, years before any fine.
Germany shows the same mechanism with a hard number attached. In May 2021, Germany's financial supervisor BaFin ordered N26 to fix deficiencies in IT monitoring and customer due diligence, to "ensure that it has the adequate personnel, technical and organisational resources" for its AML obligations, and appointed a special commissioner to monitor the work. Later in 2021, a further order capped new customers at 50,000 a month, so the bank could put more of its resources into customer identification, transaction monitoring and suspicious transaction reporting.
When BaFin extended the measures in March 2023, it required suitable technical, organisational and staffing measures, with the focus on suspicious activity reporting, and a suitable quality assurance function. In May 2024 it fined N26 EUR 9.2 million for systematically filing suspicious activity reports late in 2022.
For a growth-stage electronic money institution (EMI) or neobank, this is the uncomfortable lesson. A supervisor that doubts your control capacity can, in effect, set your onboarding capacity to match it. A fine is paid once. A growth cap rewrites the business plan for as long as it lasts.
Same failure, different supervisory playbooks
Where you are licensed changes how that cost arrives, something founders building EU teams from abroad often underestimate. The FCA used VREQs, then published final notices describing the failings paragraph by paragraph, resourcing gaps included. Anyone can read them, including your next investor. BaFin used formal orders, a numeric monthly cap and a special commissioner.
In Lithuania, the Bank of Lithuania fined Revolut Bank EUR 3.5 million in April 2025 after an inspection found deficiencies in monitoring business relationships and transactions, LRT reported. It closed through an administrative settlement Revolut requested, with a remediation plan, and no confirmed money laundering was found. The monitoring gap was enough. Our notes on preparing for a Bank of Lithuania inspection cover what it looks at first.
How long a seat stays empty also varies by country, because notice and probation rules differ across the Baltics, Poland, Germany, the Nordics and the UK. Part 6 covers that.
How to put a number on an empty seat
Measure weekly inflow and output per analyst for each queue: reviews, alerts, onboarding, enhanced due diligence. The gap, multiplied by the weeks the seat will be empty, is your backlog.
Estimate time to fill honestly: both notice periods, the search and ramp-up.
Price the backlog in hours, not salary, and decide where those hours come from: overtime, contractors, outsourcing or slower growth.
Decide in advance what gets protected. High-risk reviews, sanctions alerts and suspicious activity reports should not wait behind low-risk refreshes.
Report backlog size and ageing to management weekly. The FCA criticised the poor quality and inconsistency of the management information at Starling. A backlog the board cannot see is a backlog nobody funds.
If the backlog already exists, our piece on what happens when AML backlogs build up covers the remediation side.
Where outsourced capacity fits
A vacancy is a clear case for external capacity because the need is defined and time-limited. CAML's analysts have more than five years of AML experience and work under ACAMS-certified Team Leads, with four-eyes review on critical tasks. A one-week onboarding period sets the key performance indicator (KPI) baseline, and work can be priced hourly, per finished case or per processed item. Accountability stays with the regulated firm. What changes is how quickly the backlog stops growing.
Frequently asked questions
What is an FCA VREQ?
A voluntary requirement is a restriction on its permissions that a firm agrees to, usually after the FCA raises concerns. Starling's and Monzo's VREQs stopped new accounts for high-risk customers while controls were fixed.
How do you calculate the cost of a vacant AML role?
Multiply the weekly gap between incoming work and what the remaining team clears by the weeks the seat stays empty, convert that backlog into hours, and set it against the salary saved.
Do regulators penalise firms for being understaffed?
Not for headcount as such. They act on control failures. But resourcing appears in the findings: the Starling notice records an under-resourced financial crime function, and BaFin ordered N26 to ensure adequate personnel for its AML obligations.
The cheapest week to act is the week someone resigns
Most of the cost of an empty AML seat is created early, while the queue is still small enough to ignore. The banks above were well known and growing fast. Their control capacity fell behind the business, and the supervisor noticed first.
If you are about to lose an analyst, or growing faster than your team, talk to CAML about covering the gap while you hire.
About this series. The Real Cost to Hire is an eight-part series on what AML hiring decisions leave out. Part 1 worked through the fully loaded cost of an AML analyst. Part 3 looks at ramp-up: the months you pay for before a new hire produces at full speed.
Comments