The obligation layer at small banks

About this paper

This is the longer analysis behind the note Where compliance spend pays off at small banks.

The framing and assertions are my own, except where a source is cited. The appendix lists what isn't sourced, including inferences drawn from sourced facts, and gives full citations.

This paper contains no confidential or proprietary information from any previous or current employer or working relationship. I invest in a company that works in this layer. It is not named here.

The argument

1. Compliance technology has two layers. The control stack runs controls. The obligation layer decides which controls are owed and proves it.
2. The control stack gets the attention and most of the vendor effort.
3. At small banks and credit unions, the obligation layer pays off more, because every rule change, exam, product, and vendor passes through it.
4. That layer used to need consultants. AI-native tools can now run it end to end, and core providers have started to sell such tools through their marketplaces.
5. Whether small institutions buy it is not yet evidenced. The last section sets out what would have to be true.

Two layers

	Control stack	Obligation layer
What it does	Runs a control: screens a name, scores a transaction, works a case, files a report	Decides which controls are owed, to which regulator, under which version of which rule, and holds the evidence
Sells against	A transaction or a customer	A rule
Buyer	BSA officer, head of fraud, operations	Chief compliance officer, second line
Demand scales with	Volume of activity	Rate of regulatory change
Proof of value	Alerts cleared, losses avoided	An exam passed on evidence the system produced
Competitors	Screening, monitoring, and case management vendors	GRC platforms, regulatory content owners, change specialists

The control stack has five parts: data and lists, identity and onboarding, screening, detection and monitoring, and case work. Each part assumes somebody already decided the control was owed.

The chain

The obligation layer is a chain of six links. At many small institutions, each link is in a different place.

Link	What happens	Where it usually is at a small bank
Rule text	A regulator publishes or amends a rule	Email alerts, trade association bulletins
Applicability	Does the rule reach this entity, product, and state	A consultant's memo, or one person's judgment
Obligation	The rule becomes a testable statement of what the bank must do	A spreadsheet row
Control	The obligation maps to a control someone owns	Policies and procedures documents
Evidence	The control produces artifacts, and someone checks they are current	Shared drives, the core system, vendor reports
Examination	The file shows the chain backward, from artifact to rule	Assembled by hand before each exam

The product in this layer is lineage: the link from each artifact back to the rule that required it.

The cost at small banks

CSBS surveyed community bankers every year from 2015 to 2024 and compared compliance cost by asset-size quartile (CSBS).

Expense	Compliance share, smallest quartile	Compliance share, largest quartile
Payroll	11% to 15.5%	6% to 10%
Data processing	16.5% to 22%	10% to 14%
Consulting	50% to 64%	19% to 30%
Accounting and auditing	5 to 17 percentage points above the largest quartile	Baseline for comparison

The smallest quartile was banks under $121M in assets in 2015 and under $188M in 2024 (CSBS Working Paper 25-01).

At the smallest banks, most consulting spend is compliance work. So the money for obligation mapping already exists, and today it goes to people.

The population is large and mostly small. There are 3,852 community banks among 4,278 FDIC-insured institutions (FDIC, Q1 2026), and 4,250 federally insured credit unions, 90% of them under about $1.1B in assets (NCUA, Q1 2026). It's a volume market at a small ticket.

Why the payoff is in the obligation layer

Every change event passes through the obligation layer:

• A new or amended rule
• An exam, and the findings after it
• A new product or a new state
• A new vendor, whose controls the bank now relies on

When the layer is weak	When the layer is strong
The bank pays to rebuild the map for each event	The map exists, and each event updates it
Controls pile up that nobody can trace to a rule	Each control points to the rule that requires it
The exam file is assembled by hand	The exam file is a report
Knowledge leaves with one or two people	Knowledge stays in the system

The other view. The case for putting money into the control stack first is also strong:

• A missed sanctions hit or an unfiled SAR is what draws enforcement. A weak map rarely does on its own.
• US enforcement has turned toward sanctions and cartel designations, which are control-stack problems.
• Alert volume is a daily operating cost that a CFO can see. Obligation work is episodic and harder to price.

Rate of change

Demand in this layer tracks how often rules change, rather than how many exist. Loosening is change too.

Date	Event	Effect on the map
26 March 2025	FinCEN's interim final rule removes beneficial ownership reporting for US companies and US persons	Obligations removed; related controls to retire or re-scope (Treasury)
2 January 2026	FinCEN final rule delays the investment adviser AML program rule to 1 January 2028	A dated obligation moves; plans keyed to 2026 change (Federal Register)
10 July 2027	EU AMLR and AMLD6 apply	New obligations for EU-regulated entities (Regulation (EU) 2024/1624)

For a US community bank, the EU date matters little directly. It matters for vendors, who build to the strictest regime.

Who sells into this layer

Group	Examples	Strength	Gap at small banks
GRC platforms	MetricStream, Archer, IBM OpenPages, Workiva, Diligent, ServiceNow IRM	Own the budget line and the seat at larger institutions	Built for control and audit workflow; heavy for a two-person team
Regulatory content	Wolters Kluwer (OneSumX); Thomson Reuters Regulatory Intelligence, now owned by CUBE	Decades of curated rule content	Content without the map to the bank's own controls
Change specialists	CUBE, Corlytics, Ascent	Rule change tracking	Mostly sold to larger firms
AI-native entrants	A small field, mostly unnamed here	The whole chain, end to end, with lineage	No installed seat, no content library, no procurement history

Vendor lists are representative.

CUBE shows the incumbent route to the same end. It completed its purchase of Thomson Reuters Regulatory Intelligence and Oden in January 2025, bought Kodex AI (agentic AI for compliance) in October 2025, and bought 4CRisk (compliance and risk mapping) in February 2026 (CUBE, Jan 2025; PRNewswire, Oct 2025; CUBE, Feb 2026). That puts content, change tracking, and agents under one owner. Whether a content owner or an AI-native entrant wins the small-bank segment is open.

What has changed

The work can be automated end to end. Language models can read rule text and draft applicability and obligations. A structured map links each obligation to the bank's own controls and evidence. People review the judgment calls. Before this, each link needed a person or a consultant.

The distribution exists. Core providers have started to sell agents through their own marketplaces.

• Fiserv launched agentOS on 14 May 2026, with 4 Fiserv agents and 9 from third parties. Launch uses include AML triage, regulatory reporting, and financial crimes compliance (Fiserv).
• Banks buy credits and spend them across the catalog, per query, per outcome, or by subscription. They test an agent with their own data in a sandbox, then certify and promote it themselves, with "no integration project to stand them up." (Fiserv agentOS page, retrieved September 2026. Vendor description)

Core provider	Share of banks (2022)	Credit union clients (mid-2025)	Third-party agent marketplace
Fiserv	42%	1,155	Yes, agentOS
Jack Henry	21%	535	None announced that I found
FIS	9%	Outside the top three	None announced that I found; FIS built its financial crimes agent with Anthropic as a first-party product (FIS)

Sources: bank shares from Kansas City Fed, March 2024, using 2022 ABA survey data; credit union counts from Callahan via CreditUnions.com, mid-2025. The two columns come from different studies and years. The marketplace column reflects public announcements.

61% of banks have stayed with their core provider for more than 10 years (Kansas City Fed). A purchase through that relationship skips a cold procurement.

What would have to be true

For small institutions to buy the obligation layer as software:

Condition	Status
Exam pressure opens a budget, with no new rule behind it	Unproven
Banks that have paid consultants for a decade switch to software	Unproven
A two-person compliance team has time to implement and run it	Unproven
Marketplace credits get spent on compliance when they could go to agents with a clearer revenue case	Unknown
GRC platforms don't move down-market once the segment buys	Holds today
The population doesn't shrink faster than it converts	At risk: credit unions fell from 4,460 (mid-2025, Callahan) to 4,250 (Q1 2026, NCUA); the sources differ, so the gap is indicative

The supply side (tools, marketplaces) is documented. The demand side (small institutions buying) is not.

Open questions

1. Does exam pressure alone open a budget at a small bank, or does it take a new rule?
2. At this size, is the competitor another platform, or the consultant already being paid?
3. Does a core marketplace reach the compliance buyer, or only the technology buyer?
4. Is the lasting advantage in the reasoning pipeline, or in the rule content under it?
5. Does consolidation among content owners, such as CUBE's, close the window for AI-native entrants?

Not sourced

Judgment and framing:

• That the money for obligation mapping already exists at small banks, in consulting spend (inference from CSBS data).
• That a purchase through a long core relationship skips a cold procurement (inference from Kansas City Fed data).
• The two-layer framing and the buyer split.
• Where each link of the chain usually is at a small bank.
• That the obligation layer pays off more at this size, and the weak and strong comparison.
• The case for the control stack first.
• That demand tracks the rate of change.
• The strength and gap columns in the vendor table, and that GRC platforms are heavy for small teams.
• That AI-native tools can run the chain end to end.
• The marketplace column in the core provider table.
• Every condition and status in "What would have to be true."

Exists, but not used or not found:

• Buyer-side evidence that small institutions buy compliance software through a core marketplace. I found no survey.
• agentOS adoption, attach rates, or credits spent by institution. Not published.
• The cost of exam preparation at small banks. I found no study.
• US anti-money-laundering operations spend and alert false-positive rates. Figures circulate, but I found none with a published method.
• How many of Fiserv's 1,155 credit union clients an agentOS listing reaches, by core platform. Not published.

Sources

Claim	Source
Compliance share of payroll, data processing, consulting, and accounting by quartile	CSBS, Siems and Ross, "Too Small to Scale: What 10 Years of Data Say About Community Bank Compliance Costs," 13 November 2025. Annual surveys 2015 to 2024.
Smallest quartile under $121M (2015) and $188M (2024)	CSBS Working Paper 25-01, Table 1
4,278 insured institutions; 3,852 community banks	FDIC, Quarterly Banking Profile, Q1 2026
4,250 federally insured credit unions; 90% under $1,122.5M	NCUA, Quarterly Credit Union Data Summary, Q1 2026
Beneficial ownership reporting removed for US companies	US Treasury press release, 26 March 2025
Investment adviser AML rule delayed to 1 January 2028	Federal Register, 2 January 2026 (FinCEN final rule)
AMLR applies 10 July 2027	Regulation (EU) 2024/1624
CUBE acquisitions: Thomson Reuters Regulatory Intelligence and Oden, Kodex AI, 4CRisk	CUBE news releases, January 2025 and February 2026; PRNewswire, 16 October 2025
agentOS launch, 4 Fiserv and 9 third-party agents, launch uses	Fiserv press release, 14 May 2026
agentOS credits, pricing models, sandbox and self-certification	Fiserv agentOS product page, retrieved September 2026. Vendor description.
Core shares: Fiserv 42%, Jack Henry 21%, FIS 9%; 61% with the same provider 10+ years	Federal Reserve Bank of Kansas City, "Market Structure of Core Banking Services Providers," 27 March 2024, using 2022 ABA survey data
Credit union cores: Fiserv 1,155, Jack Henry 535; 4,460 credit unions	Callahan & Associates via CreditUnions.com, mid-2025
FIS financial crimes agent built with Anthropic	FIS press release, "FIS Brings Agentic AI to Banking with Anthropic, Starting with Financial Crimes," May 2026