A payments startup doubles its transaction volume over a year and watches its AWS bill nearly triple. Finance asks engineering what happened, and the honest answer is usually unflattering. The servers that process payments aren’t the problem. The growth hides in logs, data transfer, encryption calls, and a handful of services nobody thought of as expensive when they were first switched on.
Fintech companies feel this more than most. Regulators, auditors, and fraud teams all want data kept, copied, and encrypted, and every one of those requirements runs on a meter.
The Line Items Nobody Budgeted
Open a fintech’s Cost Explorer and sort by service, and a few surprises tend to sit near the top.
NAT Gateways charge for every gigabyte they process. A service in a private subnet that calls a card network, a KYC vendor, or a fraud scoring API sends all that traffic through one, and the fee is per gigabyte on top of the hourly charge. Pulling container images through the same path makes it worse. Adding VPC endpoints for S3 and ECR takes much of that traffic off the meter, and it’s one of the cheapest fixes available.
CloudWatch Logs is the other usual suspect. Ingestion is billed per gigabyte, and a payment service left at debug logging after an incident can quietly generate more spend than the compute it runs on.
Cross-AZ data transfer and KMS request charges round it out. Neither looks large per unit. At millions of transactions a day, both show up.
Compliance Sets a Floor
Some of these costs can’t be cut, only managed.
PCI DSS requires audit logs to be kept for at least a year, with the most recent three months immediately available. That’s a storage question, not a logging question. Keeping a year of logs in CloudWatch is expensive. Exporting older logs to S3 and moving them to Glacier tiers through lifecycle rules meets the same requirement for a fraction of the price.
Multi-AZ databases are similar. Running a payments ledger in a single availability zone to save money is the kind of decision that looks smart until an outage, and then gets discussed with a regulator. Pay for the redundancy and look for savings elsewhere.
Consumption Pricing Runs Both Ways
Fintechs buy on consumption terms constantly. Identity verification vendors charge per check, data warehouses like Snowflake bill per credit, observability platforms like Datadog bill partly by host and partly by gigabytes ingested. Many fintechs then sell to their own customers per transaction too.
Understanding how consumption models work on both sides is where margins get decided. If a startup charges merchants a flat fee per payment, but its own costs per payment include a variable fraud check, a KYC call for new accounts, logging, and data transfer, then a shift in customer mix can erase the margin without anyone changing a price.
The metric that ties this together is cost per transaction. It’s harder to calculate than total spend, because it requires tagging resources by service and allocating shared costs, but it’s the number that tells you whether growth is actually profitable.
The Tools That Actually Help
AWS’s built-in options are free and underused. Cost Explorer breaks down spend by service and tag. AWS Budgets sends alerts when spend crosses a threshold. Cost Anomaly Detection flags unusual jumps, like that debug logging change, within a day or so instead of at the end of the month. Compute Optimizer recommends smaller instance sizes based on actual usage.
None of them work well without consistent tags. A tagging policy that labels every resource by service, environment, and team should come before anything else.
Third-party cost optimization tools for AWS earn their keep later. CloudZero focuses on unit costs, such as cost per customer or per transaction, which suits fintechs trying to understand margins. Vantage offers clear reporting across AWS and other providers like Datadog and Snowflake. ProsperOps automates the buying and managing of Savings Plans and Reserved Instances.
A company spending a few thousand dollars a month probably doesn’t need any of them yet. Once the bill reaches six figures and several teams are deploying independently, they start to pay for themselves.
Commitments Come After Clarity
Savings Plans and Reserved Instances offer real discounts in exchange for committing to a level of usage over one or three years. The mistake is committing before the architecture settles. A startup that locks in three years of EC2 spend and then moves to containers on Fargate or serverless functions has prepaid for capacity it no longer uses the same way. Compute Savings Plans are more flexible than instance-specific reservations, which makes them the safer first step.
A Bill That Explains Itself
The most useful thing a fintech can do about cloud costs is make its bill readable. When every dollar maps to a service, a team, and ideally a transaction, cost conversations stop being arguments about whose fault the spike was. They become product decisions, like whether a particular feature, customer segment, or vendor is worth what it actually costs to run.
