Where compliance spend pays off at small banks

US community banks under about $190M in assets spend 11% to 15.5% of payroll on compliance. The largest community banks spend 6% to 10%. At the smallest banks, 50% to 64% of consulting spend is also compliance work (CSBS, "Too Small to Scale," Nov 2025).

Two layers compete for that money.

The control stack runs the controls: screening, monitoring, and case work. It gets the attention. Alerts arrive every day, vendors sell against them, and the cost of a missed one is easy to picture.

The obligation layer decides which controls are owed. It links each rule to whether it applies, what it requires, which control meets it, and what evidence proves it. At many small banks it's a spreadsheet, a consultant, and the memory of one or two people.

At this size, the obligation layer pays off more. Every rule change, exam, new product, and new vendor goes through it. When it's weak, the bank pays to rebuild the map each time, and controls pile up that nobody can trace to a rule. When it's strong, a change touches only the controls it should, and the exam file already exists.

Rule change doesn't stop when rules loosen. The US dropped beneficial ownership reporting for most domestic companies in March 2025 and moved the investment adviser AML rule to 2028. Each change still has to be mapped. In the EU, AMLR and AMLD6 apply from July 2027.

This layer no longer has to be a consulting project. AI-native tools now run the whole chain: they read the rule text, map it to the bank's own controls, and keep the link from each rule to its evidence current. Core providers have started to sell such tools through their own marketplaces, so a two-person compliance team can buy one without a separate procurement.

Open question: at your last exam, how much of the cost went into rebuilding the map, and who holds that map now?