You did the checks. The company was genuine, the owners were clear, the documentation all matched and the file duly closed with an ‘approved’ tick next to it. Then everyone moved on as you do once a deal is done. That’s the bit that nobody wants to admit: the approval had an expiry date and no one wrote that down.
The vast majority of the compliance effort is at the front door. The application, the docs, the screening, the sign off… all of it is focused on the moment the relationship commences. The relationship doesn’t end at onboarding though, that’s where it begins. The supplier you cleared in January is still your supplier in November and so is whatever’s happened to them in the interim. Onboarding tells you who that person was on the day you met them. It tells you absolutely nothing about who they’ve become since.
There’s a good way to think about this. An onboarding check is a photograph. Ongoing monitoring is a live feed. A photograph is perfectly accurate and perfectly static. The longer it sits in your drawer the less it has to do with the person in front of you now. This is all about the gap between the photograph and the live feed, why that gap is far more important than most teams realise and what it actually looks like to close that gap.
The onboarding snapshot goes stale the moment you take it
A point in time check has a shelf life and it’s shorter than you’d think. The data you collected was accurate on the day you collected it. The issue is that the world didn’t stop moving after that point. Ownership changes, people change, the circumstances change and none of that comes to you in a nice little email saying “please re-review this file”.
This is the rather unassuming flaw in the whole ‘due diligence as a gate’ concept. A gate is something you go through once and the assumption that comes with it is ‘we’ve cleared it, therefore we’re safe’. Risk isn’t a gate though. Risk is a state of being which exists for the duration of the relationship. A counterparty that was low risk at onboarding can quite easily drift or lurch into high risk over time without your file in any way at all reflecting that. Your file wasn’t designed to detect that. It was designed to make a decision once and then just sit there.
What actually changes after you’ve onboarded someone
It helps to make this concrete, because “risk can change” is easy to nod along to and easy to ignore. Here is what actually shifts underneath a relationship after the deal closes:
- Ownership and control. A clean company gets acquired, restructured or quietly sold and the new party behind it is nothing like the one you actually looked at. The name on the contract remains the same, the people in control are completely different.
- A new sanctions designation. The watchlists are in a state of constant flux and it’s entirely possible that a counterparty (or indeed one of its owners) can suddenly find themselves on a sanctions list. Sanctions can reach an entity via its ownership structure so it’s entirely possible that you could be in scope even if you never see the relevant change yourself.
- Fresh adverse media. A fraud investigation, a regulatory action, a serious allegation. The sort of thing that would have stopped you onboarding them completely, arriving six months too late to have any impact at all unless someone is still looking.
- Changes in the people. A disqualified director joins the board. A key owner with a troubled history steps in. The company is only ever as trustworthy as the people running it, and that cast list isn’t fixed.
- Financial distress. Insolvency filings, winding-up petitions, a business quietly failing. A supplier heading for collapse is a very different counterparty from the healthy one you signed.
- New litigation. A pattern of lawsuits tells you how a business behaves when things go wrong, and that pattern often only forms after you’ve already committed.
Any one of these can turn a relationship you were comfortable with into one you’d never have entered. And the uncomfortable truth is that with a point-in-time approach, you typically find out about them by accident, or by consequence.
Point-in-time versus ongoing monitoring
These are the two models, and the difference between them is the whole argument. Point-in-time screening checks a counterparty at a moment, usually onboarding, and then again, if at all, at a scheduled review perhaps every one to three years. In between, you’re flying blind, trusting that nothing material has happened in a window long enough for a great deal to happen.
Ongoing monitoring inverts the whole model. Rather than checking in on a calendar, you do it once at onboarding and then you’re continuously watching. You’re alerted to any material change as and when it occurs rather than at the next scheduled review. The industry has a term for the more mature version of this: perpetual KYC (continuous due diligence) where you effectively never ‘close’ a customer or counterparty file. It’s not really a new model at all, it’s just an acceptance that risk is ongoing and therefore the monitoring of that risk should be too.
The practical difference is in the timing. With the periodic model the question you’re asking is “when is this counterparty next due for review?” With continuous monitoring that question pretty much goes away because the answer is ‘at all times’. You’re not being alerted to a date coming up, you’re being alerted to a fact having changed. That’s the whole point of it really and that’s why continuous monitoring will pick things up weeks or months earlier than even a very well run periodic process.
Regulators already expect this
If this sounds like going above and beyond, it isn’t. Ongoing monitoring isn’t a premium add-on to due diligence; it’s part of the definition. The global standard, FATF Recommendation 10, explicitly includes conducting ongoing due diligence on the business relationship and scrutinising transactions throughout its course, not just at the start. It’s written into the baseline, not bolted onto the end.
The same expectation is present in the national rules. In the US, FinCEN’s CDD rule makes ongoing monitoring one of the key components of the requirements and the FFIEC examination manual treats continuous monitoring as a fundamental expectation of the regulator rather than an optional add-on. The industry bodies are all pointing in the same direction with the Wolfsberg Group for instance having for some time now described effective financial crime control as something that runs throughout the life of the relationship. On sanctions OFAC’s guidance on entities owned by blocked persons is a good reminder that exposure can come via ownership which you would only pick up if you were still actively monitoring. The trend across the board is the same and it’s clearly away from the one-off check.
The silent cost of not monitoring
What’s so dangerous about post-onboarding risk is that it’s silent. If the relationship goes south after you’ve cleared it, there’s nothing to indicate that. You just keep on invoicing, you keep on paying, you keep on shipping, you keep on trusting, because from your point of view it looks exactly the same. The file still says ‘approved’.
Exposure compounds. Every deal you do with a counterparty who’s quietly become sanctioned, insolvent or fraudulent adds to the pile and you’re building it up without realising. The first indication is rarely a warning at all; it’s the fallout. It’s a payment that’s just frozen, a regulatory enquiry, a loss, a headline with your name very close to someone else’s. By that stage the question isn’t ‘should we have onboarded them?’ It’s ‘why didn’t we see it change?’ and ‘we checked at the outset’ is not a satisfactory answer to a regulator, a board or yourself.
There’s a reputational aspect to this as well which will outlive the financial aspect. Being associated with a bad actor even if you were in no way at fault is damaging and “we had no idea” is going to sound very different depending on whether you could reasonably have known. A relationship you cleared years ago and haven’t looked at since is very difficult to defend. A relationship you were actively monitoring and acting on as soon as it turned is a story about a control that worked. The same event, the same counterparty, two completely different positions to be in, all down to whether or not you were still watching.
Why manual re-screening doesn’t scale
The obvious answer is to re-check everyone on a periodic basis and lots of teams do that. The problem with doing it manually is that it’s absolutely dreadful. It’s slow, it’s repetitive and it’s just the kind of work that you don’t do when there’s something more urgent on the desk. So the re-checking gets pushed, it gets pushed again and the gap between checks grows and grows.
Even if you do it properly there’s a fundamental structural flaw with periodic manual review in that it only picks up a change at the next review which could be months after the change has actually occurred. A counterparty gets sanctioned in March and your next review cycle doesn’t hit them until September and you’ve been exposed for half a year. It’s not that the manual re-screening is wrong, it’s just that it’s solving the wrong problem. Risk is constantly changing, a calendar is a discrete check. They never quite align.
What continuous monitoring looks like in practice
The alternative isn’t to be checking more frequently by hand; it’s to change what is doing the watching. With automated continuous monitoring you look at a counterparty once when you on board them and then the system continues to monitor the entity and the people behind it, flagging a change as it occurs rather than waiting until the next review date. The calendar is no longer the thing that determines when you look.
This is where Beady is built to establish its value. It verifies a company and resolves the true owner of that company across over 200 million legal entities and officers globally, then continues to monitor that counterparty over time. It does this by screening both the company and its people against sanctions and adverse media and will alert you when something material changes. Each alert is linked back to its source so you can see precisely what has changed and why it’s important. Onboarding is the beginning of the watch, not the end of it. For any team that is actually checking counterparties at scale, that’s the difference between a file that makes a decision once and a relationship you can actually have confidence in today. You can see the same engine in action at onboarding in our KYB automation so the onboarding and the ongoing watch are both powered by the same source of truth.
If you’d like to see what’s coming up in terms of ongoing monitoring on a counterparty that you’ve already got on board, book a demo and we’ll do one with you.
The deal closes; the risk doesn’t
A signed contract is the equivalent of the finish line. In that sense it is. The onboarding is complete, the decision has been made. The relationship it creates however is a living thing and living things change. The counterparty you’ve cleared is not a static fact that you can just file away. It’s a moving target that you’ve decided to be tied to and the only way you can know it’s still safe to be tied to is to keep watching it.
Onboarding answers one question very well: can we start this relationship? Ongoing monitoring answers the one that actually matters in terms of whether you’re going to get hurt: should we still be in it? The first is a snapshot. The second is the live feed. If the stakes are real you want both and you want that second one running well after the first has been taken.
