1. [Insights](/insights/) 2. [Technology](/insights/category/technology/) 3. [How AML compliance became a pile of workarounds no...](/insights/insights-compliance-workarounds/) [Technology](/insights/category/technology/)[AML Compliance](/insights/category/aml-compliance/)[Lawyers](/insights/industry/lawyers/)[Estate Agents](/insights/industry/estate-agents/) # How AML compliance became a pile of workarounds nobody designed Published August 27, 2026 ![NMW Blog 1](/_next/image/?url=https%3A%2F%2Fa.storyblok.com%2Ff%2F171201%2F2450x1633%2F35d4d3e843%2Fnmw-blog-1.JPG&w=3840&q=75) Spend time with enough compliance teams and a pattern starts to show. Not every firm, but a lot of them, each with its own quirks and systems. For many, what holds their client due diligence together is a set of workarounds, built up quietly over years, that the team now leans on. The drawer full of highlighters. The four systems that never quite talk to each other. A client's name, date of birth and address, typed by hand into a second system because the first one will not pass them across. A valid passport the system flags as "expired", checked by hand to be sure. The reviews that stack up, because every one has to clear the same small team. None of it is in the job description. All of it is the job. ## What a compliance workaround actually is A workaround is what you reach for when the system is not built to work for you. It is rarely a bad decision. More often it is a capable person solving a real problem with whatever is to hand, on a Tuesday, with six other matters waiting. Take a simple one. A new tool is brought in to run identity checks but does not connect to the case management system, so someone starts a spreadsheet to track who has been verified and who has not. It works, it is sensible, and within a month it is load-bearing, because that spreadsheet is now the only place the full view exists. This is how it happens. Enough of them, layered up over years, quietly become the process, the one nobody actually designed and everybody is now stuck with. No one sat down and decided to run client due diligence on highlighters and re-typing the same client details between systems. It accumulated, one reasonable shortcut at a time. ## How the pile builds up This is not because firms have no technology. Almost every regulated business runs some kind of provider for know your client (KYC) and anti-money laundering (AML) checks. The gap is rarely the tools themselves; it is how well they fit together. Two versions of the same problem come up again and again. In the first, a firm chooses on price, and the cheaper provider runs the check but does not integrate with the wider workflow, so the saving on the invoice is paid back many times over in manual effort. In the second, a firm invests in good software for one part of the job. But it doesn't join up with the systems around it, or stretch to cover the full CDD process, so they add another tool for the next task, and another again, until a single client onboarding runs across several platforms. Together they leave seams between them, and every seam is somewhere a risk can slip through. In this case, can you be confident in presenting evidence of a trail when a regulator asks? It’s how compliance often becomes the join. They are the integration the software never provided, moving information by hand from one system to the next, chasing the client for the check that lapsed, and holding the whole picture in their head because there is nowhere else for it to live. ## What the workarounds quietly cost The cost is easy to miss, because it never appears as a line item. It appears in the hours instead. In our latest research of 201 senior compliance leaders, 85% say the demand on their compliance function has grown over the past 12 months, and 63% are already working overtime to keep up with AML compliance at least once a week. The work keeps growing, the people doing it are already stretched, and so the workarounds fill the gap - and the gap keeps widening. It shows up as risk, too. When a firm's client due diligence is spread across four systems and one person's memory, no single, current view of it exists. And the regulator is looking. In its [November 2025 thematic review of source of funds and wealth](https://www.sra.org.uk/sra/research-publications/thematic-review-source-funds-wealth-compliance/), the Solicitors Regulation Authority (SRA) examined 5,873 files across 833 firms and found that 11% of the files that needed a source of funds check had none at all, with a further 18% showing inadequate scrutiny. The SRA said it remains concerned about continued non-compliance and that firms need to strengthen their approach. Manual, stitched-together processes are exactly where those gaps open up. The stakes behind that work are not small. UK Finance reported that criminals stole [£1.28 billion through fraud in 2025](https://www.ukfinance.org.uk/news-and-insight/press-release/fraud-report-2026-press-release). That is what compliance teams are holding the line against, and far too much of the defence still runs on highlighters and memory. ## The people holding it together Here is the part worth saying plainly; the workarounds are not a failing of the people who use them. They are the reason anything holds together at all. Day after day, compliance professionals quietly absorb the gap between what the systems do and what the regulations demand, and they close it well enough that most of the firm never sees the effort it takes. But heroics should not be the business as usual. Ask what happens to all of it when they are on holiday, or the day they leave. The reliance on individual brilliance is the risk, not the safeguard. The people carrying this feel it, too. In our [UK Compliance Paradox research](https://www.thirdfort.com/lp/uk-compliance-paradox-report/), 51% said compliance is not respected within their firm, and only 15% believe their work is seen as critical and valued. The professionals keeping firms on the right side of their obligations are also the ones most likely to feel unseen. The system, not the person, is what needs fixing. ## What changes when client due diligence works as one None of this needs heroics. It needs the tools to do the joining, so the people can do the judgement. That is what we set out to build. Thirdfort's Client Due Diligence Platform brings the checks that confirm who your clients are and where their money comes from into one place, with the oversight to see everything and the control to decide how it runs. Intelligent client due diligence, with you in control. In practice that looks like three things: 1. **Cut the back and forth.** KYC, AML and Source of funds in one flow, instead of four tabs and a highlighter. 2. **Clear oversight, zero blind spots.** Every check, client and risk across your firm in one live view, instead of every decision routing back to one desk. The Firm-wide insights dashboard keeps that picture on, each figure clicking straight through to the case behind it. 3. **Risk you can see.** Politically exposed person (PEP) and sanctions matches, monitored and connected to the case, instead of being spread across multiple systems. The legwork clears and the judgement, the part only _your team_ can bring, is where the hours go instead. ## No more workarounds Most firms did not choose their due diligence process. It built up around them, one workaround at a time, until the shortcuts were the system. Naming that is the first step to changing it. Your firm has held compliance together with workarounds for long enough. It is worth seeing what it looks like without them. See how Thirdfort takes the workarounds out of client due diligence. We're ready when you are. [Book a demo](/request-demo/) ## Subscribe to our newsletter Subscribe to our monthly newsletter for recaps and recordings of our webinars, invitations for upcoming events and curated industry news. We’ll also send our guide to Digital ID Verification as a welcome gift. Subscribe Our [Privacy Policy](/privacy/) sets out how the personal data collected from you will be processed by us. ## Related articles * ![MLR blog 2](/_next/image/?url=https%3A%2F%2Fa.storyblok.com%2Ff%2F171201%2F3953x2791%2F5d98ba3f15%2Fmlr-blog-2.jpg&w=3840&q=75) TechnologyAML ComplianceRegulations ### [The three-part test for a file note that’ll survive an SRA review](/insights/the-three-part-test-for-a-file-note-that-ll-survive-an-sra-review/) Read more * ![MLR blog 1](/_next/image/?url=https%3A%2F%2Fa.storyblok.com%2Ff%2F171201%2F3950x3104%2Fbb836c91ab%2Fmlr-blog-1.jpg&w=3840&q=75) TechnologyAML ComplianceRegulations ### [Enhanced due diligence after the 2026 MLR reforms: two mistakes firms are making](/insights/enhanced-due-diligence-after-the-2026-mlr-reforms-two-mistakes-firms-are-making/) Read more * ![Phone screen showing options to share bank statements: "Open banking" (recommended), "Upload a PDF," and "Take a photo."](/_next/image/?url=https%3A%2F%2Fa.storyblok.com%2Ff%2F171201%2F750x532%2F1710b7fb2c%2Fssof-mobile-share-open-banking-default-other-options-secondary.png&w=3840&q=75) OpinionTechnology ### [What we've learned from implementing digital Source of funds verification in hundreds of firms](/insights/implementing-source-of-funds-in-hundreds-of-firms/) Read more