Some good points - I agree with hs saying 'do the scariest thing'. While you're young. I think this means either the startup or the PhD. But you sound more interested in the startup - you didn't even mention your intended research area!

A PhD is lots of really hard and thankless work, and if you're not really excited about it at the beginning, you won't finish, and that's the worst thing you can do.

So - unless you're hiding your passion for research in your post, I recommend the startup.

I'm sure you know about them, but just in case: the AML field as represented in the Wikipedia article (and the sales report PDF it linked to) missed one company I know of who's been doing AML services 'since 1993', called Logica: http://www.logica.com/risk+and+compliance/350234053