Ongoing Monitoring & Periodic Review
CDD/KYC does not end when a customer is onboarded. Ongoing monitoring is the control that checks whether the relationship continues to make sense as facts, ownership, activity and risk context change.
1. Why onboarding is not enough #
At onboarding, the firm forms an initial understanding of the customer. After onboarding, that understanding can become outdated. The customer may change ownership, start using new products, enter new markets, send unusual payments, appear in adverse media or become exposed to sanctions/PEP-related risk.
2. Ongoing monitoring in plain language #
| Control | Question it answers | Example signal |
|---|---|---|
| Relationship monitoring | Does the customer still match what we understood at onboarding? | New business activity, new geographies, changed source of funds. |
| Transaction monitoring | Does observed activity make sense for the customer profile? | Unexpected volume, unusual counterparties, unexplained routes. |
| Event-driven review | Has something happened that requires a refresh? | Ownership change, sanctions alert, adverse media, new high-risk exposure. |
| Periodic review | Should the customer file be refreshed according to risk and policy? | Scheduled review cycle based on risk rating. |
3. Event-driven review triggers #
Event-driven review happens because something changes or new information appears. Common trigger categories include:
- change in ownership, directors or control;
- new sanctions, PEP or adverse media alert;
- material change in products, volume or transaction behaviour;
- new jurisdiction, route, counterparty or sector exposure;
- expired or inconsistent documents;
- internal quality finding, audit issue or unresolved discrepancy.
These are trigger categories, not universal legal thresholds.
4. Risk-based periodic review #
Periodic review is normally risk-based: higher-risk relationships are usually reviewed more closely or more frequently than lower-risk relationships. The exact timing is set by local law and internal policy.
A periodic review should not simply re-collect the same documents. It should check whether the customer profile, ownership, purpose, risk rating, source evidence and monitoring assumptions remain valid.
5. What to document #
- what changed or why the review was triggered;
- which sources were checked and when;
- which facts were confirmed, updated or contradicted;
- whether the risk rating remains appropriate;
- whether escalation, EDD or remediation is required under policy.
6. Source basis #
- FATF Recommendation 10 for CDD and ongoing due diligence concepts.
- Transaction Monitoring Sources for monitoring concepts and source boundaries.
- Evidence Weight for how to record source limits.
See Also#
References#
- FATF risk-based approach and AML/CFT programme concepts listed in the Source Register.
- Wolfsberg/Basel-style governance and control-quality framing where applicable.
- Editorial & Source Policy for source hierarchy and reviewer-accountability boundaries.