SaaS or In-House: The Real Cost Lines for Compliance Workflow Software
Updated October 2026. First published April 2024.
The 2024 version of this post said in-house software gives a firm control and SaaS gives it scale. Both are true, and neither helps you price the decision. This version lists the cost lines that usually decide it, on both sides, for compliance workflow software at a broker-dealer.
What a Build Costs Beyond the Project Plan
Start with people. The Bureau of Labor Statistics put the May 2025 median wage for software developers at $135,980, for software quality assurance analysts and testers at $104,300, and for information security analysts at $129,180. Wages were 70.0% of private-industry employer compensation costs in June 2026, according to BLS. If a developer's benefits run at that average, a $135,980 wage costs the firm about $194,000 a year. A compliance workflow tool needs some of all three roles, and it needs them after launch too.
Then the system becomes a records system. If it keeps records the firm is required to keep, Rule 17a-4(f) applies to it. The system has to store those records in a non-rewriteable, non-erasable format or keep a complete time-stamped audit trail, and it has to produce them in a reasonably usable electronic format on request. A designated executive officer or a designated third party has to sign an undertaking to furnish them to regulators. That's design work for the first sprint.
It goes into the business continuity plan. FINRA Rule 4370 requires the plan to cover data back-up and recovery and every mission critical system, and it defines mission critical to include systems for clearance and settlement. A tool that tracks the letters you need before a delivery can settle is close to that line.
And you supervise it. In March 2025 FINRA fined Robinhood Financial and Robinhood Securities $26 million combined. Among the findings, FINRA said Robinhood Securities "failed to reasonably supervise its clearing technology system" (FINRA news release). Technology a firm runs is an activity it supervises, with procedures, reviews, and evidence that the reviews happened. Our look at recent FINRA fines covers that case in more detail.
Budget for a second person who can read the code, so the tool doesn't depend on one developer staying.
What Buying Costs Beyond the Subscription
The subscription is the visible number. These are the others:
- Due diligence and ongoing oversight. FINRA's Regulatory Notice 21-29 says outsourcing "does not relieve members of their ultimate responsibility" and lists what firms review, including a vendor's financial condition, information security controls, SOC 2 reports, and business continuity plans. Someone at your firm does that before signing and keeps doing it.
- Regulation S-P. If the vendor maintains a customer information system for you, your policies must require it to notify you within 72 hours of becoming aware of a breach of that system (17 CFR 248.30(a)(5)). Notice to your customers stays your job.
- Records the vendor holds. If a third party prepares or maintains your required records, Rule 17a-4(i) requires it to file a written undertaking that it will permit examination of them and furnish copies. Ask whether the vendor acts as your recordkeeper or keeps its own copies of what it processes, because the paperwork differs.
- Integration. A nightly batch file brings a narrower security review than a live API into your back office. Our self-clearing post covers that choice.
- Exit. Notice 21-29 says contracts may address "ownership and disposition of firm and customer data at the end of the Vendor relationship." Price the exit when you sign.
The Line That Decides Most Cases
Ask who's on the other side of the workflow.
If the workflow is internal, a build can do the whole job. An approval chain, your own surveillance logic, or a reconciliation of your own records fits that description. If the work is also specific to how your firm makes money, building is often the right call.
If the workflow is an exchange with other firms, a build gives you your half. A Letter of Free Funds to a custodian, a 17a-13(b)(3) confirmation to a lender, and an F1SA from a prime broker all need the counterparty to answer. Someone also has to keep a directory of where each counterparty wants its requests. Unless your counterparties connect to the system you built, it sends email and tracks the replies by hand, and the costs spread across IT, operations, and compliance where no budget shows them. A vendor that runs a network has already connected the other side, or much of it.
So our position is plain. Build the internal workflows that set your firm apart. Buy the standardized exchanges with counterparties.
A Worksheet
| Cost line | Build | Buy |
|---|---|---|
| People | Developers, testers, and security staff, during the project and after it | Vendor management and internal administration |
| Rule 17a-4(f) records | Your design, and your undertaking | The vendor's design, which you check; a Rule 17a-4(i) undertaking if the vendor keeps your required records |
| Business continuity under Rule 4370 | Your system in your plan | The vendor's plan reviewed, and your plan covering the dependency |
| Supervision and testing | Procedures and reviews for your own technology | Ongoing oversight under Notice 21-29 |
| Security incidents under Regulation S-P | Your incident response program | Your program, plus the vendor's 72-hour notice |
| Counterparty access | You connect each counterparty, or fall back to email | Included if the vendor runs a network |
| Exit | Retire or rewrite the system | Data return or destruction terms in the contract |
Loffa sells the buy side for three counterparty workflows, so we're not neutral here. Our vendor due diligence page lists what we can evidence and what we don't claim.
This post is for informational purposes only and does not constitute legal advice. For guidance on specific regulatory obligations, consult your counsel or compliance advisor.