The wall shows up right on schedule
Every payment institution I've worked with hits the same wall. Somewhere between 80 and 150 new KYC cases a week, the queue stops behaving. SLAs that held fine at 40 cases a week start slipping. The compliance officer who used to review every file personally can't anymore, so shortcuts creep in. Nobody planned for this. It just happens, and it happens at almost the same volume every time, because the underlying math is the same everywhere.
Why the number is 100, not 1,000
At low volume, one experienced ops person can read a file, check the documents, run the sanctions check, and make a call. That works because volume and headcount grow at roughly the same pace. Past a certain point, they stop growing together. Each new case still takes the same amount of attention, but the rules the case has to pass keep getting heavier.
The EBA's revised guidelines on money laundering and terrorist financing risk factors, EBA/GL/2023/03 and EBA/GL/2023/04, added sector specific guidance for account information service providers, payment initiation service providers, and crowdfunding platforms, on top of tighter enhanced due diligence expectations for high risk third countries. That is more work per case, not less. And the EU's new Anti-Money Laundering Regulation, Regulation (EU) 2024/1624, becomes directly applicable across all 27 member states from 10 July 2027, lowering the customer due diligence threshold for occasional transactions to EUR 10,000. The bar keeps rising while the queue keeps growing. Something has to give, and it's usually turnaround time.
The false positive tax nobody budgets for
Sanctions and PEP screening make the queue worse than the raw case count suggests. Industry reporting on screening alerts, covered by Retail Banker International among others, puts false positive rates on sanctions alerts as high as 99%. Almost every hit an analyst clears is noise, but each one still needs a human to look at it, document a decision, and leave an audit trail. At 100 new cases a week, the screening layer alone can generate several times that number in alerts that need eyes on them. Volume doesn't add up in this business, it compounds.
What actually breaks first
It's rarely the KYC policy itself that fails. It's the process around it: how cases get assigned, how missing documents get chased, when something gets escalated, and whether any of that is written down anywhere an auditor could find it. When that lives in shared inboxes and spreadsheets, the backlog is invisible until someone asks for it, usually a regulator or an investor during due diligence.
AMLA is raising the floor for everyone
The EU's new Anti-Money Laundering Authority took up operations on 1 July 2025 and is based in Frankfurt. From 1 January 2028 it will directly supervise around 40 of the highest risk financial institutions in the EU. Most PSPs won't be in that pool, but national regulators calibrate their own expectations against AMLA's standards. What counts as an acceptable KYC file today will look thin in two years.
Three levers that actually move the queue
First, standardize the case file. If the checklist depends on which analyst picked it up, you don't have a process, you have a habit. Second, triage before a human ever opens the file. A risk based approach, which is the whole point of the EBA's guidance, means low risk cases should take less time, not the same time as everything else. Third, automate the repetitive 80 percent: document extraction, initial screening passes, evidence logging. Let analysts spend their attention on the judgment calls, not on retyping data.
The economics back this up. Fenergo's research puts the average customer due diligence check at around 69 dollars, climbing to 136 dollars for complex or high risk cases. At 100 cases a week, that's real money leaking out of ops every month, on top of client relationships lost to slow onboarding. Reporting from Lorikeet and fintech.global points to 70 percent of financial firms losing clients to slow onboarding in 2025 alone.
The wall is a design problem, not a headcount problem
Hiring more analysts buys you a few more weeks before you hit the wall again at a higher number. Fixing the process is what actually moves the ceiling.
At Novafin, we've built and cleaned up these queues from both sides, as regulators and as operators. If your KYC queue is starting to control your growth instead of the other way around, talk to us. We'll map where the backlog actually comes from and design the automation that gets your team back to reviewing cases instead of chasing them.