A customer clears KYC at onboarding. Their identity checks out, they’re not on any sanctions list, the file is clean, and you open the account. Everything about that moment is correct.
Eighteen months later, that same customer is added to a sanctions list. Or becomes a politically exposed person. Or is named in a fraud investigation that’s all over the local press. And your next scheduled KYC review for them is still a year away. For that entire window, you’re serving a customer you would reject today, and nothing in your process is set up to tell you.
This isn’t an edge case. It’s how periodic KYC is designed to work. Picture a customer who starts moving money in suspicious patterns in month three of a twelve-month review cycle. Under a calendar-based model, nobody is actively looking between reviews, so the behaviour isn’t flagged until month twelve, and the suspicious activity report you eventually file rests on information nine months out of date. By the time you act, the chance to prevent the harm has passed, and all you can do is document it.
The issue isn’t that anybody failed to carry out KYC properly; it’s that carrying out KYC just once addresses the wrong question. When you verify a customer at the time of onboarding, you find out who they are on the first day. What you actually need to know, each day afterwards, is whether they are still someone you can safely deal with. This represents a shift from verification—which is a single moment—to assurance—which is a continuous state—and it’s exactly what separates simply checking a box from actually managing risk. And as we shall see more and more, it’s also the difference between fulfilling your regulatory duties and merely appearing to do so.
KYC checks for a moment while risk continues to move.
The onboarding process for KYC is essentially a snapshot, recording who the customer is, where they come from, and whether they are a known risk on the day the check is carried out. Such a snapshot is necessary and, in most cases, legally mandatory. However, something being legally required does not mean that it is actually sufficient, and this is precisely the case with KYC, where the requirement and true adequacy gradually come apart the day after onboarding. The problem is that the snapshot begins to become outdated the moment it is taken, since the customer does not remain unchanged at the point when they have been verified.
For investees and portfolio companies we have also developed a similar argument in Beyond Onboarding. In this case the focus is on your customers, but the logic is identical: diligence carried out once only covers the past, while risk exists in the present. The aim is not to provide an improved snapshot but a live one. The question that onboarding addresses — who is this — is not the same as the one that keeps you safe over time, which is whether they are still the people you thought them to be and still safe to serve.
What actually changes after onboarding
It’s worth being specific about what a one-time check can’t see, because “risk changes” is easy to nod along to and easy to underestimate.
A customer may become a politically exposed person as a result of a new appointment. They can be placed on a sanctions list either directly or via one of the entities that they control. They can also acquire adverse media, an investigation, an indictment, or a fraud allegation, all of which were not present when they were originally onboarded. The beneficial ownership of a corporate customer can change, so the individuals who were previously cleared are no longer the ones in control. Their business might move into higher-risk activities or jurisdictions. Moreover, their transactions can begin to tell a different story from what was promised in their onboarding profile. All of these situations are not visible to a check that you carried out once and then filed, and any one of them could turn a customer that was justified to accept into one that you would now refuse. A common and painful example is when a customer who was originally onboarded as an ordinary private individual is later appointed to a position in public office and thus becomes a politically exposed person all at once, even though your file still shows the low-risk account that you opened two years earlier.
A blind spot, in slow motion
It is helpful to observe the gap causing damage in sequence, since the failure is usually not dramatic at the time in question. For example, a payments company takes on a corporate customer; the directors are checked and turn out to be clear, the beneficial owners are free of any issues, there are no sanctions hits, and the account is classified as medium risk with a two-year review period. All the necessary steps have been carried out correctly.
Four months in, one of the beneficial owners is quietly added to a sanctions list after their home country is hit by a new regime. Nothing in the firm’s process is watching for this, so the account keeps operating normally. Payments continue to flow, some of them, as it later turns out, connected to the sanctioned party. The firm isn’t ignoring a warning. It simply never received one, because it wasn’t looking between reviews.
Eighteen months later the planned review takes place and the sanctions are finally imposed. At that point the firm has already dealt with sixteen months’ worth of transactions which it had no right to handle, is facing a remediation programme and has a backdated suspicious activity report to deal with, and has to account to the regulator for the fact that it took almost two years to spot something that had been known within days. Each of the individual actions could be defended. The outcome was a serious failure, the only deficiency being the lack of someone keeping an eye on things in between. That continuous supervision was the one aspect the firm had not provided for, since the review timetable had led it to believe that such supervision had already taken place.
The periodic review was always a compromise
If one-time KYC is clearly not enough, the usual backstop is the periodic review: re-check each customer every one to five years, more often for higher-risk ones. It’s better than nothing, and for a long time it was the only practical option, because every check was manual and you couldn’t possibly do them all, all the time.
But the periodic model has the blind spot built into its design. Between reviews, by definition, nobody is looking, so a change that lands the month after a review sits undetected until the next one comes around, which could be years away. The reviews themselves are among the most manually intensive and expensive work in all of compliance, and they tend to arrive as a wave of blanket re-documentation requests that irritate exactly the low-risk, long-standing customers you least want to annoy. A process that is slow, costly, and friction-heavy, and that still leaves long gaps of blindness, is not a process anyone would design from scratch today. It also puts compliance teams in the awkward position of certifying, at each review, a customer they haven’t actually looked at since the last one.
The regulators already expect more than a checkbox
Here’s the part that settles the question. Ongoing monitoring isn’t a nice-to-have that forward-thinking firms adopt early. It’s already the expectation. FATF Recommendation 10 calls for ongoing due diligence and for keeping customer due diligence information current, not merely running a check at onboarding. In the UK, Regulation 28(11) of the Money Laundering Regulations 2017 requires ongoing monitoring of the business relationship and keeping CDD records up to date, and the FCA treats ongoing monitoring as a distinct, substantive duty separate from onboarding. US regulators take the same line: FinCEN’s customer due diligence rules include an ongoing-monitoring component. And the EU’s incoming Anti-Money Laundering Regulation pushes harder still, with a harmonised framework that, from 2027, leans heavily on continuously updated customer risk profiles rather than static records.
Here, one point is important since so much of the writing on this issue is careless. The term “perpetual KYC”, which the industry uses to describe ongoing, event-triggered re-screening, is not actually required by any regulation. What has been included in the regulations is the obligation to maintain up-to-date customer due diligence. Continuous or perpetual KYC is merely the way in which companies fulfill that obligation in practice. Therefore, the real issue had never been whether or not to continuously monitor customers; it was about the method to be used. When the question is put like this, continuous KYC no longer appears to be an upgrade for early adopters and instead seems to be a straightforward interpretation of the rules that are already in place.
From verification to assurance: what continuous KYC looks like
Continuous KYC substitutes the calendar with the event; rather than periodically checking for any changes among all the individuals, you monitor only the changes that matter and then reevaluate when such a change takes place.
In reality this involves several measures operating in unison. It means continuously checking your customers and the individuals associated with them against sanctions lists, PEP lists, adverse media and watchlists in such a way that any new matches are detected as they occur. It involves keeping an eye on any changes in beneficial ownership so that you become aware if the people who are in control change. It means applying a risk-based level of scrutiny, so that low-risk customers are regularly checked in the background while any significant change with respect to a high-risk customer is immediately escalated. Moreover, each decision to clear a customer, to update information or to escalate a case must be based on evidence that is linked to the source and can be audited ready for examination by an examiner. The result is that the customer risk ratings cease to be mere guesses at a particular point in time and instead become much more like a dynamic record.
It is important to clarify what “perpetual” does not imply, since the term suggests the wrong mental picture. It doesn’t involve carrying out every check on every customer every day, or flooding your team with a constant amount of alerts. Instead, it means that the system is activated by actual events not by the calendar; and when this is done properly, it results in less work rather than more, since you no longer spend time on reviews in cases where nothing has changed. The calendar should then serve as a backup measure for the infrequent quiet customer, not be the main method for all customers.
What a good trigger set looks like
Whether the continuous KYC approach succeeds or fails depends entirely on the triggers, that is, the events which cause the system to decide that a customer deserves further examination. If the triggers are properly set, the entire system functions smoothly in the background; if they are set incorrectly, then you will either fail to detect anything or be overwhelmed. A few categories are most important.
Screening triggers are the obvious ones: a new sanctions or PEP match, or fresh adverse media naming the customer or someone behind them. Ownership triggers fire when the beneficial owners or controllers of a corporate customer change, because the people you cleared may no longer be the people in charge. Behavioural triggers come from the customer’s own activity, transactions that don’t fit the profile they were onboarded with, a sudden change in volume, counterparties turning up in unexpected places. Geographic and status triggers catch a customer or their business moving into a higher-risk jurisdiction or sector. And relationship triggers fire on the structural events: a change of directors, a merger, a new authorised signatory.
What matters is the action taken by each trigger. It isn’t necessary for every event to trigger a complete re-review. An effective system sends minor changes through a quiet background update, directs substantial ones to a specific check, and takes serious cases—such as a live sanctions hit—directly to a human reviewer with the relevant evidence already attached. It is important to match the response to the level of severity because only by doing so can continuous KYC avoid turning into a constant stream of noise. It should be the severity of the case—not just the fact that something has occurred—that determines the response.
It isn’t only the account holder who changes
One thing periodic reviews and one-time checks both tend to under-cover is everyone around the customer. A corporate account isn’t just the legal entity. It’s the beneficial owners behind it, the directors, the authorised signatories, and sometimes a web of connected companies. Any of them can become a risk after onboarding, and when they do, the risk flows to the account whether or not the entity itself did anything at all.
When a beneficial owner becomes a politically exposed person, the risk for each company they control changes. If a director is named in a fraud case, this brings the exposure into the boardroom. A signatory who is added silently during the onboarding process might have been overlooked during the initial screening. Continuous assurance must extend to cover these individuals, not merely the name on the account, since it is they who are precisely the place where changes tend to occur and exactly the sort of thing that a once-a-year review of the entity is most unlikely to pick up.
The payoff isn’t only compliance
It would be easy to frame all of this as a box you have to tick more often. In fact, moving from periodic to continuous KYC tends to be one of the rare changes that improves several things at once.
You identify risk in real time: if a customer begins to structure their affairs in the third month, they are flagged in that same month rather than being assessed at the following review, and the SARs you submit are based on up-to-date information rather than on outdated file records. You no longer subject satisfied customers to the wholesale re-documentation process, which results in a real and noticeable improvement in their experience and in customer retention. It also costs less, not more. Firms that switch to a continuous, event-driven KYC approach usually find that they are able to reduce their periodic-review workload by most of the previous amount, since the manual work moves from scheduled periods when teams have to re-examine thousands of customers who haven’t changed to the actual exceptions that do require attention. The fact that it is safer, cheaper, and causes less friction at the same time is not something that anyone has previously been offered in the field of compliance; it’s worth taking the time to understand why, since it goes against common intuition—because the savings come from no longer having to use your most costly resource, namely skilled analysts, to verify that nothing has changed for the large number of customers where, in fact, nothing has. Most compliance leaders have spent their entire careers being told that greater safety always entails higher costs. This is one of the rare instances where that is not true.
Won’t this result in an overwhelming number of alerts?
That is the first objection people put forward, and it is a reasonable one. Compliance teams are already overburdened, and ‘continuous monitoring’ does sound like a promise of constant noise. The objection would in fact be valid if continuous KYC meant constantly re-running each check on every customer and sending all of it to a human.
That is not what good continuous KYC achieves, and that is precisely the key point. Since it is event-driven, most customers produce no entries on most days, as most customers do not make changes. Owing to its risk-based approach, the routine refreshes for low-risk customers are handled silently in the background while only significant changes are brought to the surface. And since it correctly resolves identity, it does not flag every customer who happens to have the same name as someone on a list. As a result, continuous KYC generally results in fewer items for a human to examine than a periodic model would with its extensive reviews, rather than more, and the items it does bring to light are genuine.
The real issue isn’t the volume of alerts. It’s having a system that’s badly constructed and which ends up giving you a large number of false positives. That does represent a genuine kind of failure, and it’s something that must be avoided by means of entity resolution, risk tiering, and source-linked clearance—this is a matter worth dealing with properly. However, it’s an argument in favour of building a continuous KYC system, not a reason to stick to a periodic model which leaves you unable to see what’s going on between reviews. In simple terms, the concern about the number of alerts is actually a question of build quality using a different set of words.
Getting there
Moving from a periodic model to a continuous one is mostly a matter of a few deliberate choices.
- Define your trigger events: the changes that should prompt a reassessment, such as a sanctions or PEP hit, adverse media, an ownership change, or a shift in transaction behaviour.
- Screen continuously against the right sources, rather than only at onboarding and on a calendar.
- Tier by risk, so the intensity of monitoring matches each customer’s risk instead of treating the whole book the same.
- Clear automatically the low-risk cases with no changes and send only those involving actual changes to a human, so that your team can spend their time on important matters.
- Make sure that records of each reassessment are kept with the relevant source information, so that the programme can be audited and all decisions can be explained.
- Make sure that your written procedures reflect the way things actually are. If your policy still talks about a periodic review schedule but you are carrying out continuous monitoring, then you are documenting a process that differs from the one you actually carry out.
You don’t need to overhaul your onboarding process at all. The onboarding verification continues to carry out its function. It’s the continuous KYC procedure that ensures that verification remains valid throughout the time the customer is your customer. While the onboarding team established who it was who came in, continuous KYC ensures that you would still approve them today.
How to know it’s working
If you make the shift, measure it, because the improvement should show up in numbers, not just in principle. A few are worth watching.
The time it takes to detect a change is the most important one: on average, how long lies between a change in a customer’s status and your company becoming aware of it. With a periodic model that interval is measured in months. The whole idea behind continuous KYC is to reduce it to days. There is also your review backlog, which ought to decrease as the scheduled bulk reviews are replaced by checks that are triggered by events. Then there’s the proportion of periodic reviews that found no changes, and if this figure is high it is a direct indication of the effort you have been wasting. Finally, there’s the freshness of your suspicious activity reports, which should improve since you will be detecting behaviour as it occurs rather than waiting until the next review. Taken together, these four figures show whether or not you have actually moved from a schedule to a system.
Even if the figures aren’t changing, the change hasn’t actually taken place, no matter what the vendor’s dashboard indicates.
Frequently Asked Questions
Keep the verification true
A clean KYC check carried out at the onboarding stage means that the customer could safely be served on the first day; it gives no information regarding the fifth hundred day. It is usually the case that the firms which end up in difficulties did not have serious problems at the time of onboarding, they simply stopped monitoring and the customer had changed during that period. The entire purpose of ongoing assurance is to close that gap, and it is cheaper to detect a change in week one than it is to deal with it in year two.
Beady is designed to offer that layer. It continuously monitors your customers and the individuals associated with them using sanctions lists, PEP designations, adverse media, and legal and regulatory information, ensuring that you are made aware of any change in your customer’s risk as soon as it occurs rather than having to wait until the next scheduled review. Each finding is traceable back to its original source so that you can verify it and be able to show an examiner precisely what you knew and when. The onboarding process informs you who a customer is, while Beady continues to inform you who they have become.
If you’d like to see what kind of continuous assurance would emerge among your present customer base, you should book a demo and we’ll carry out the exercise with you.
