Build a business case for AML transaction monitoring software using CBN’s 2026 Baseline Standards, full cost of ownership, option comparisons, and a practical pilot plan.

You walk into a budget meeting with a request for AML transaction monitoring software. The first question comes quickly:

“Why do we need to spend this much on something that flags transactions?”

If your answer starts with a list of software features, you’ve already lost the room. Management wants to know what the investment protects, what it really costs, what happens if the institution delays, and how you’ll prove it works.

In Nigeria, the question has changed. Since March 2026, the Central Bank of Nigeria (CBN) has required every regulated financial institution to run an automated AML solution, and full-compliance deadlines are approaching. The decision in front of management is no longer whether to invest. It’s which approach meets the standards at the lowest total cost and the least risk.

Here’s how to build a business case your management team can evaluate and approve.

Start with what the CBN now requires

On March 10, 2026, the CBN issued its Baseline Standards for Automated AML/CFT/CPF Solutions. The standards set minimum functional, governance, and control requirements for the systems institutions use to detect, investigate, and report suspicious activity. The CBN states plainly that manual AML controls are no longer sufficient to manage evolving financial crime risks.

The roadmap deadline has passed. If your institution submitted one, your proposal should align with its milestones. If it didn’t, that needs immediate escalation.

The standards apply to all banks and other financial institutions under CBN supervision, including mobile money operators, international money transfer operators and payment service providers. The depth of implementation is proportionate to each institution’s size, products, transaction volumes and risk profile. Institutions in higher-risk sectors must apply enhanced monitoring regardless of their size.

Why a basic monitoring engine isn’t enough

Software that flags transactions doesn’t satisfy the standards on its own. The CBN expects monitoring to assess activity in the context of the full customer profile. A ₦5 million transfer may be normal for one customer’s business and highly unusual for a customer who usually receives ₦30,000 a month. The system can only tell the difference if it has customer context.

The standards are explicit. AML solutions without effective links to CDD, KYC, and KYB information and customer risk assessments won’t be regarded as compliant. For institutions rated High or Above Average risk in their subsector, the CBN considers it unacceptable to rely solely on standalone transaction feeds.

The standards also set requirements beyond the software itself, including:

• independent validation of any AI or machine learning models, at least annually and on significant change
• a documented governance framework, with periodic internal audit review of the AML solution
• documented training for teams who operate and oversee the system
• notifying the CBN of every AML solution in use, at deployment and on material change
• separate, automated fraud-monitoring capabilities appropriate to the institution’s fraud risk

Your budget should cover the complete monitoring process: software, integration, customer data, investigations, reporting and the governance needed to keep it all effective.

Show management the cost of doing nothing

Doing nothing isn’t a compliant option, but management still needs to see what delay or a weak implementation would cost. There are three costs to explain.

1. Regulatory and enforcement exposure

Under the standards, institutions that fail to comply, or whose AML solutions don’t work effectively, may face remedial directives, administrative sanctions and penalties. These can apply to the institution and, where appropriate, to accountable individuals. The relevant framework includes the Banks and Other Financial Institutions Act 2020, the Money Laundering (Prevention and Prohibition) Act 2022 and the CBN AML/CFT/CPF (Administrative Sanctions) Regulations 2023.

Ask Legal and Compliance to identify the provisions and penalty schedules that apply to your institution. Don’t put an arbitrary fine into the business case. Cite the actual provisions and explain the exposure they create.

2. The hidden cost of manual reviews

Manual monitoring consumes analyst time that rarely appears as its own budget line. Reviewers search for customer information, compare transactions and document decisions across spreadsheets, emails, and disconnected systems, and the cost grows with transaction volume.

Quantify it with a simple formula:

Daily analyst hours = Alerts reviewed × Average review time (minutes) ÷ 60

If your team reviews 150 alerts a day at 10 minutes each, that’s 25 analyst hours every working day, or about 6,500 hours across 260 working days. That excludes supervisory review, reporting, quality assurance, and time spent chasing incomplete customer information.

3. Suspicious activity that goes undetected

Manual reviews can miss activity that only looks suspicious when several transactions are viewed together. A customer moving a large sum through a series of smaller transfers may produce no single transaction worth a second look. An automated system can assess patterns, frequency, customer history, and risk indicators consistently across large volumes.

Build a three-year cost and value comparison

Because automated monitoring is mandatory, the most useful financial comparison isn’t the investment against doing nothing. It’s the full three-year cost of each compliant option, with productivity gains as a secondary benefit.

Calculate the full cost of ownership

Subscription fees are only part of the cost. The standards add recurring governance costs that many proposals leave out. Here’s an illustrative three-year model for buying a dedicated solution:

Illustrative figures. Replace them with vendor quotes and your own internal costs.

Build the same model for each option you’re considering. An internal build replaces the subscription with engineering salaries, infrastructure, and ongoing maintenance, and still carries the same governance costs.

Calculate the productivity benefit

Continuing the 150-alerts example, suppose better customer context and case management cut average handling time from 10 minutes to 6:

That’s 2,600 analyst hours recovered annually. At a fully loaded cost of ₦5,000 an hour, that’s ₦13 million a year, or ₦39 million over three years, assuming volumes and costs stay flat.

In this scenario, recovered capacity represents about 96% of the investment’s estimated three-year cost. That doesn’t mean the software pays for itself in cash, but it shows management how much operational value automation can create while helping the institution meet a mandatory requirement.

Two cautions belong in the proposal:

• Recovered hours aren’t automatically cash savings. If analysts use the time to clear a backlog or take on complex investigations, the benefit is capacity. It becomes a cash saving only if it reduces overtime, contractor spend, or planned hires. Finance should see these separated.
• Automated alert closure is tightly restricted. It’s permitted only for clearly low-risk scenarios that meet the CBN’s conditions: governance-approved rules, current customer information, an unchanged low-risk classification, and no unresolved alerts or cases. Institutions must also back-test automated closures, document approved thresholds, and notify the CBN. Don’t build productivity savings around automation your institution isn’t authorised to use.

Present the numbers management actually needs

Your financial proposal should include:

• Three-year cost of each option, including governance costs.
• Realised financial savings: costs that can genuinely be reduced or avoided.
• Recovered operating capacity: analyst time available for other work.
• Expected risk reduction: the monitoring gaps and patterns the new system will address.
• Assumptions: transaction volumes, integration effort, staffing, and rollout timeline.

Don’t claim that every flagged transaction is a prevented loss. A defensible business case is more persuasive than an inflated ROI figure.

Map your existing controls against the CBN standards

Once management understands the financial picture, show what the institution needs to build or improve. For each capability, record whether it’s fully covered, partially covered, or missing.

The gap assessment turns a regulatory document into a specific investment requirement. Instead of asking management to “buy an AML system”, you can show which controls are missing, what those gaps expose the institution to, and what the proposal will deliver.

Compare the available implementation options

Show management the available approaches, not just one vendor proposal.

Whichever option management chooses, the institution remains accountable for meeting the standards. Shared-service arrangements need prior CBN approval.

Ask vendors questions that affect cost and compliance

The standards require heightened due diligence on AML solution vendors. Your procurement assessment should establish:

1. Coverage: Which products, channels, and transaction types can the solution monitor?
2. Customer context: Can monitoring use KYC/KYB data, customer risk profiles, and transaction history?
3. Rule configuration: Can compliance teams adjust rules without engineering work, under change control?
4. Explainability: For any AI-driven alert, can investigators see the factors behind it?
5. Case management: Does it support maker-checker review, escalation, and complete audit trails?
6. Reporting: Which regulatory reports can it generate, and what work remains before submission?
7. Data location: Where is data processed and stored, and how does that arrangement meet Nigerian data protection and sovereignty requirements?
8. Audit and validation access: Will you have the access needed for model validation, internal audit, and CBN examinations?
9. Exit: How would you migrate data and records if you change vendors?
10. Pricing: How do costs change with transaction volume, customer growth, and added features?

Tailor the business case to the people in the room

The same investment means different things to different decision-makers. One proposal should answer each person’s likely questions.

Prove the value with a pilot

A pilot replaces assumptions with evidence. Rather than asking for a full rollout at once, propose a controlled implementation in three phases.

Phase 1: Set the baseline and test one channel. Choose one product, channel, or transaction type. Measure current alert volume, review time, false positives, backlog, and outcomes, then run the proposed solution against a controlled set of transactions and compare results.

Phase 2: Connect customer data and expand. Link KYC and customer risk information, add channels, and test the system at higher volumes. This phase exposes data gaps and integration problems early.

Phase 3: Tune and demonstrate. Review alert quality and processing times, adjust rules within approved risk thresholds, and document every change.

Alert volumes may rise when monitoring first goes live. This isn’t automatically a problem, but the team needs to establish whether the increase reflects improved detection or unnecessary false positives. That’s why the pilot must measure alert quality, not just alert volume.

Agree on success criteria before starting:

The goal isn’t the lowest possible alert count. Reducing alerts by ignoring suspicious activity isn’t an improvement. A successful pilot shows better detection, effective investigation, and a sustainable way of working.

Answer management’s objections before they come

“The software is too expensive.” Monitoring is mandatory, so compare it with the full cost of the alternatives, including building it yourself and the governance costs every option carries. Then show how the pilot will test your assumptions.

“Our manual process already works.” Show current alert volume, backlog, and workload, then model what happens if transaction volumes rise by 50% or double. And since the standards require an automated solution, a manual process isn’t a compliant long-term option.

“Can we wait until closer to the deadline?” Integration, data preparation, rule tuning, model validation, and training all take time. The CBN assesses whether controls are effective, not whether software has been bought.

“Won’t it block legitimate transactions?” Flagging a transaction doesn’t mean blocking it. A good process separates activity that can proceed, activity that needs review, and activity that needs immediate action, according to the institution’s risk appetite. Confirmed sanctions matches are handled according to legal requirements.

“We already have a fraud prevention tool.” That helps, but it’s a separate requirement. The standards require automated fraud monitoring and an AML solution. They can share a platform if rules are logically separated and AML controls aren’t weakened, or run separately if they exchange risk signals without blind spots.

“Why don’t we build it ourselves?” You can, but cost it fully: developers, monitoring logic, integration, testing, documentation, security, annual independent model validation, maintenance, and keeping up with regulatory change.

How Dojah helps institutions build AML transaction monitoring

Dojah’s EasyDetect provides real-time transaction monitoring, configurable risk rules, case management, and reporting. It helps teams identify suspicious activity and investigate it with customer context.

Real-time rules and decisions. EasyDetect evaluates transaction and user events against configured rules and thresholds, such as amount, frequency, and behaviour, and returns an Allow, Review, or Block decision. The institution sets its own rules, thresholds, and response procedures.

Rules without code. Teams can build and adjust rules in the visual Rule Builder. The AI Rule Assistant can suggest rules from plain-language descriptions. Every suggestion is reviewed and approved by the team before it goes live, so rule changes stay under the institution’s governance and change control.

Case management. Analysts can examine flagged activity, review risk indicators and customer context, document findings and record decisions in one place rather than across spreadsheets and email.

Reporting. EasyDetect generates structured reports, including profile summaries, Suspicious Transaction Reports (STR/SAR) and Cash Transaction Reports (CTR), from events, customer profiles and case data. Compliance teams remain responsible for reviewing and filing them.

Customer context and history. Customer profiles combine event history, behavioural indicators and risk information. Historical event ingestion lets institutions load past transactions to establish behavioural baselines before going live, which is especially useful during a pilot.

Screening. Dojah’s AML watchlist screening covers sanctions, PEP, and adverse media checks, bringing screening results into the wider monitoring process.

Your institution remains responsible for its monitoring policy, rule design, model governance and regulatory decisions, and for showing the CBN that its controls work in practice.

Turn the budget request into a decision management can make

A convincing business case isn’t built on software features. It combines the regulatory requirement, an honest assessment of current gaps, a full cost comparison of the compliant options, and a pilot plan.

Start with the CBN’s deadlines and the capabilities you must demonstrate. Cost every option in full, including governance. Show what automation can realistically improve, then use a pilot to prove it.

Before the meeting ends, ask management to:

• approve the selected implementation approach
• approve the three-year budget and first-phase funding
• assign an accountable executive and implementation team
• agree on pilot success criteria and regulatory milestones

Ready to build an AML monitoring business case backed by real results? Explore Dojah EasyDetect to see how real-time monitoring, configurable rules, and case management can support your pilot.

Frequently asked questions

• Is automated AML transaction monitoring mandatory in Nigeria?

Yes. The CBN’s March 2026 Baseline Standards require all CBN-regulated institutions to operate an automated AML/CFT/CPF solution, calibrated to their size and risk profile. The standards cover transaction monitoring, customer due diligence, screening, case management, reporting, and governance.

• What is the CBN deadline for automated AML compliance?

Deposit Money Banks must comply fully by September 10, 2027, and Other Financial Institutions by March 10, 2028. Implementation roadmaps were due by June 10, 2026.

• How can an institution calculate the ROI of transaction monitoring software?

Because monitoring is mandatory, compare the full three-year cost of each compliant option, including governance costs such as model validation and audit. Then add productivity value, separating cash savings from recovered capacity.

• Can AML transaction monitoring reduce false positives?

Yes. Customer risk context and regular threshold tuning can cut unnecessary alerts without weakening detection. Any automated alert closure must meet the CBN’s strict low-risk criteria, be back-tested and be notified to the CBN.

• Can a fraud detection platform also support AML monitoring?

Yes. The standards allow fraud and AML monitoring on the same platform if rules are logically separated and AML controls aren’t diluted, or on separate systems that share risk signals. Institutions need automated fraud monitoring either way.

• How does EasyDetect support AML transaction monitoring?

EasyDetect supports real-time monitoring, configurable rules, risk scoring, case management, customer profiles, reporting, and historical event ingestion. The institution remains responsible for its rules, governance and regulatory decisions.