Perpetual KYC: event-driven reviews versus periodic refreshes
Perpetual KYC is not a demand to ask every customer for every document every day. It is the discipline of keeping your understanding of a relationship current when new information changes the risk picture, while using periodic refreshes where your policy and risk assessment say they add value.
Start with the relationship, not the calendar
When someone says “perpetual KYC”, I ask what they want the process to notice. If the answer is only “the review date”, the process is probably a calendar with a customer file attached. A useful programme begins with the nature and purpose of the relationship, the customer’s expected activity and the information that would make that understanding stale.
For a US bank, the FFIEC BSA/AML examination manual describes risk-based ongoing due diligence: understand the relationship, monitor activity and maintain customer information, including beneficial ownership information. It also says ongoing monitoring does not impose a categorical requirement to update information continuously or on a fixed periodic schedule. That is a US supervisory reference, not a universal rule. Other jurisdictions set their own duties.
What should trigger an event-driven review?
I would define triggers in terms of a material change, not a long list of alarming words. Examples include a significant unexplained change in account activity; a change in ownership, control, employment or business model; new adverse information that is relevant and credible; a law-enforcement request; or a transaction pattern that no longer fits the customer’s stated purpose.
A trigger is a prompt to reassess, not a verdict. A new director may reflect an ordinary succession. A new country may reflect a real expansion. The analyst’s job is to connect the new fact to the existing profile and decide what needs to be verified.
Where periodic refreshes still help
Periodic reviews are useful when they are risk-based and purposeful. They can catch stale identity documents, old ownership information, outdated expected-activity descriptions and changes that never generated an event. They also give a team a controlled way to contact customers whose activity has been quiet but whose records have not been tested for years.
The mistake is treating the period as the risk decision. A high-risk customer may need more frequent attention, but the interval must come from the institution’s applicable rules and risk assessment. A low-risk customer may not need the same evidence pack as a complex cross-border structure. Do not copy a fixed interval from another institution and call it a methodology.
A practical triage sequence
- Write down the new fact and the source date.
- Compare it with the customer’s stated purpose, ownership and expected activity.
- Decide whether the change is material enough to refresh information or reassess risk.
- Ask the narrowest questions that can resolve the uncertainty.
- Record the evidence received, what remains unknown and who made the decision.
- Escalate, restrict, continue or close only under the institution’s policy and authority.
Illustrative example
Illustrative case
A fictional payments customer originally described a domestic design business with two owners and modest monthly receipts. Six months later, activity increases sharply, most incoming payments come from a new region, and a registry search shows a new controlling person. I would not label the customer suspicious from those facts alone. I would compare the activity with contracts and invoices, verify the ownership change through the relevant registry, ask what changed commercially and record why the answer did or did not change the risk assessment.
What good records look like
A reviewer should be able to see the trigger, the source, the customer’s explanation, the corroboration and the decision. “KYC completed” is not a rationale. Neither is “no change” when the file contains a new owner and a new business model. If no update was needed, say why the new information did not materially change the profile.
Keep event-driven review separate from transaction monitoring. Monitoring may identify the change, but it does not replace customer due diligence. Equally, a periodic refresh should not become a second investigation with no defined question.
Keep the jurisdiction visible
FATF Recommendation 10 sets an international standard for ongoing due diligence, but countries implement it through their own laws, supervisory expectations and privacy frameworks. Check the rule that applies to the institution and relationship under review. This note does not create a universal review interval, reporting deadline or automatic restriction.
CasePilot is a practice environment for this kind of judgement. It is not a certification, legal advice or a production KYC system.
Worth remembering: Perpetual KYC means keeping the relationship current when the evidence changes. It does not mean replacing judgement with a timer.