When Jamaican microcredit and money-service firms spoke publicly about tightening their anti-money-laundering systems, the recurring theme was not resistance to the rules. It was the split between what a policy costs and what monitoring costs.
Policy is cheap. A risk assessment, a customer due diligence procedure and a nominated officer can be documented in weeks. Screening against sanctions and PEP lists, transaction monitoring, and keeping records retrievable for years is where the money goes — and that spend recurs annually.
The second lesson is sequencing. Operators that bought monitoring capability first and wrote the manual around it ended up with documents that described reality. Those that wrote the manual first ended up rewriting it.
The third is independent testing. The reviewer cannot be the party that built the programme, so budget for a separate audit-grade firm at the end of the first cycle rather than assuming your implementation consultant can sign it off.