iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
KYC should continue after onboarding, but a trigger should lead to a proportionate review—not an automatic repeat of every identity check. Treat the information gathered at onboarding as a baseline, then use relevant changes, unusual activity, and doubts about existing records to decide what needs reassessing and what evidence, if any, must be refreshed.
What ongoing KYC is meant to do
Customer due diligence (CDD) is not just an identity check at account opening. FATF Recommendation 10 describes an ongoing relationship-level process: identify and verify the customer and beneficial owner, understand the purpose and intended nature of the relationship, and conduct continuing due diligence that includes scrutiny of transactions. The extent of measures can be risk-sensitive. FATF’s recommendations are a standards baseline; the applicable legal duties and supervisory expectations depend on jurisdiction and sector.
For operations teams, the practical question is not simply “Has the customer been checked before?” It is whether the information and evidence on file remain adequate for the customer’s present identity, ownership, activity, and risk profile.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What should trigger a customer review?
Build triggers around signals that could make existing information incomplete, unreliable, or inconsistent with the relationship. HMRC’s UK guidance and the UK Money Laundering Regulations identify several of these signals; FinCEN’s US CDD FAQs address risk-related changes and beneficial ownership updates. The response below is an operating-design approach, not a universal legal timetable.
| Trigger | Examples | Proportionate review |
|---|---|---|
| Identity or ownership change | An indication that the customer’s or beneficial owner’s identity has changed; a possible change in beneficial ownership. | Confirm the changed identity information. Where ownership may have changed, identify and verify new beneficial owners as applicable. |
| Activity no longer fits the profile | Transactions that are unusual or inconsistent with expected activity or what the institution knows about the customer. | Investigate the activity, reassess risk, and refresh information relevant to the new or unexplained activity. |
| Relationship purpose or circumstances change | A change in the purpose or intended nature of the relationship, customer circumstances, or business model. | Reconfirm expected use and the information needed to assess the changed relationship. |
| External risk changes | A change relating to a high-risk third country or another matter that affects the customer’s risk assessment. | Reassess exposure and apply due diligence proportionate to the facts and local framework. |
| Information reliability is in doubt | A discrepancy, expired document, or other reason to doubt the accuracy or adequacy of previously obtained information. | Resolve the discrepancy with reliable, appropriate evidence; escalate if the risk cannot be mitigated. |
A trigger is a reason to assess, not proof that the customer’s identity has changed or that a legal breach has occurred. The assessment may conclude that existing evidence remains adequate, or that a limited part of the record needs updating.
How to scope the review
Start with the signal and the affected information
Record what happened, when it was detected, and which facts it calls into question. A change to one contact detail does not, by itself, imply that every onboarding check must be repeated. A credible indication of new ownership, by contrast, may require identifying and verifying the new beneficial owners.
Reassess risk before choosing evidence
Consider whether the event changes the customer’s expected activity, ownership, geography, relationship purpose, or other relevant risk factors. Then decide what information would resolve the specific concern. Use reliable evidence suited to the attribute being checked and the risk involved; do not collect broader or more sensitive information merely because a review has opened.
Choose an outcome and escalation path
Close the review when the concern is resolved and the existing file remains adequate, update and verify the affected information, or escalate where uncertainty or risk remains. The decision should also identify any follow-up needed under the institution’s procedures and applicable law.
Designing an event-driven operating process
Event-driven review works only when signals have clear owners and lead to consistent decisions. The following are recommended workflow controls, not a regulator-prescribed universal checklist.
- Define signal sources. Depending on the institution and applicable regime, sources may include transaction monitoring, customer self-reports, corporate ownership or registry changes, screening results, document expiry or reliability concerns, and relevant geographic or business changes.
- Map each trigger to a response. Specify the severity, data potentially affected, evidence needed, decision owner, service-level target, and escalation route. Set targets according to risk and operational capacity rather than presenting one interval as a universal legal requirement.
- Separate review from reverification. Require an assessment of whether evidence needs refreshing before asking the customer to repeat checks. A review can end with no change, a targeted data update, or a more extensive verification when the facts justify it.
- Connect monitoring and case handling. Make sure the relevant event reaches the team that can assess it, that related information is available, and that the decision and any customer follow-up are recorded.
- Keep a review trail. Preserve the trigger, evidence considered, scope chosen, rationale, information refreshed, verification performed, outcome, and follow-up. Treat this as sound operational practice and validate recordkeeping duties against the applicable regime.
What the rules say in the UK and US
United Kingdom
HMRC’s all-sector ongoing-monitoring guidance, updated 16 July 2026, says businesses must continue monitoring business relationships, review CDD information and records—including expired documents—review corporate beneficial ownership, and monitor transactions against what they know about the customer and the customer’s risk profile. It identifies changes in customer circumstances, unusual or inconsistent transactions, high-risk third-country changes, and doubts about information as matters that can call for action.
Regulation 27(9) of the UK Money Laundering Regulations 2017 says that deciding when CDD is appropriate for existing customers includes considering indications of a change in the identity of the customer or beneficial owner; transactions not reasonably consistent with the business’s knowledge of the customer; changes in the purpose or intended nature of the relationship; and other matters affecting money-laundering or terrorist-financing risk. This is a UK-specific framework, not a global refresh schedule.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchUnited States
FinCEN’s CDD Rule FAQs, updated 6 May 2026, say customer information should be maintained and updated on a risk basis. They also clarify that periodic review alone does not require a covered institution to solicit or update beneficial ownership information absent specific risk-based concerns. A relevant risk-related change identified through normal monitoring can trigger an update, and the information updated should reflect what changed.
Best Value
FinCEN’s exceptive relief order FIN-2026-R001, issued 13 February 2026, gives covered financial institutions discretion to avoid collecting beneficial ownership information at every new account opening in specified circumstances. It does not eliminate other applicable AML obligations or ongoing monitoring and risk-based updating, and it should not be generalized beyond its US scope.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Where digital identity and authentication fit
Digital identity and continuing authentication can contribute to risk-based assurance that the person using an account is the person identified and verified during onboarding. FATF’s Guidance on Digital Identity (2020) describes this as an assurance option within ongoing due diligence, not a blanket substitute for CDD or a single required technical method.
Before relying on an authentication or identity method, assess whether its assurance level and source reliability fit the case, whether it is legally appropriate in the relevant jurisdiction, how it affects privacy and inclusion, and whether its results can be explained and recorded. Authentication that links a current user to an earlier verified identity does not, on its own, establish that ownership, business purpose, or risk information remains current.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsQuick Recap
Common design mistakes to avoid
- Turning every review into a full onboarding replay. This can create unnecessary customer friction and collect information unrelated to the trigger. Match the scope to the concern.
- Treating a calendar review as proof that beneficial ownership data must be refreshed. FinCEN’s US FAQ says periodic review alone is not such a trigger; risk-based policies may still use a periodic cadence for their own review purposes.
- Closing a case without resolving the signal. Document why the concern was resolved, what information supports that conclusion, or why escalation remains necessary.
- Applying one country’s approach everywhere. FATF provides an international standards baseline, while local requirements and interpretations differ. Confirm the rules for the institution’s jurisdiction, sector, and customer relationship.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
