Ongoing monitoring in AML: how to run it after onboarding

On 6 November 2025 the Central Bank of Ireland fined Coinbase Europe over transaction monitoring that had partly failed. Faults in the system's configuration left more than 30 million transactions, about 31 percent of those made in that period, without proper monitoring for 12 months. Catching up took almost three years. The late review produced 2,708 suspicious transaction reports. The High Court confirmed the sanctions on 12 January 2026.

Ongoing monitoring is what a firm keeps checking after approval: each transaction against what the file says, and the file itself, until the relationship closes. Reading payments against the file is the daily work of AML transaction monitoring. The other roles in AML compliance, from list rescreening to the periodic review, keep that file worth reading against.

The ongoing monitoring process picks up where customer onboarding ends, and the file that onboarding built becomes the baseline it measures against.

Which key components does an ongoing monitoring program need?

Table 1. The six standing components of ongoing monitoring (rules read 3 November 2026)

Each row feeds the next on the same customer record: a list change raises a match, the match moves the risk tier, and the new tier changes which payments count as normal. AMLA's draft guidelines on ongoing monitoring of 3 June 2026 say ongoing monitoring should not be limited to transaction monitoring and should also capture the activities, behavior and events of the whole relationship (paragraph 4).

These key components hold whatever the tooling. Where data collection, analysis, reporting and response sit with different teams or monitoring solutions, one owner still has to show how a screening result reached the transaction rules and the review. Coinbase Europe's fault sat in row 3; its late reports came out of rows 4 and 5.

Why does the finance sector need ongoing monitoring for AML compliance?

For any financial services firm, from a big bank to a small payment company, a file approved at onboarding describes the customer on the day of approval. Ongoing monitoring keeps it true. Suspicious activity is detected early, and regulatory reporting requirements get the facts they depend on. Customer risk profiles stay current, while up to date sanctions and PEP screening reduces false negatives and hidden risks. Over months, the program enhances detection of high risk patterns, strengthens the overall AML framework and turns the risk based approach that FATF Recommendation 1 sets into daily practice.

Some risk shows only when transactions are read together. AMLA's draft asks firms to detect risk that emerges over time, including value accumulated, split or moved across transactions that each look low risk (paragraph 44). Picture a customer whose single transfers all pass every rule while the month's total runs at four times the expected volume (illustrative).

OFAC is a sanctions authority rather than an AML regulator, and its Framework for OFAC Compliance Commitments asks for a risk based sanctions compliance program that is routinely updated.

How does ongoing monitoring benefit organizations?

Lower regulatory risk is the first return, and the Coinbase Europe case puts a price on its importance: a penalty of €30,663,906, cut to €21,464,734 by the 30 percent settlement discount. Greater operational efficiency comes next. AMLA's draft lets a firm reduce the depth of a periodic review for a low risk customer whose activity and products have not changed (paragraph 20). Reputation and public trust depend on catching risky behavior early, and the Central Bank treated Coinbase Europe's late report of its own fault as aggravating.

How do you set review cycles by risk tier?

Table 2. Review cycles by risk tier (automated segmentation by tier can set each customer's review frequency; what each tier rechecks, and how often inside the EU limit, is the firm's design)

The EU column is a ceiling. Under Regulation (EU) 2024/1624, from 10 July 2027 the period between updates may not exceed 1 year for higher risk customers and 5 years for the rest, and the knowledge base entry adds the US and UK rules. Inside that ceiling each tier's interval is the firm's call, and a trigger event starts a review whatever the date.

Plan for customers who do not answer. Under AMLA's draft a firm that cannot get updated information may suspend or restrict transactions for a time after repeated reasonable requests, and must end the relationship if it still cannot comply (paragraphs 30 and 32). Dormant accounts are no exception, because no activity does not, on its own, remove the risk (paragraph 31).

What is enhanced ongoing monitoring?

Enhanced ongoing monitoring is the heavier version run on higher risk customers, usually after enhanced due diligence at onboarding. FINTRAC suggests five methods: a transaction review schedule approved and signed off by management, more frequent reports on high risk transactions, flags on activity that departs from expectations, "business limits or parameters" that "trigger early warning signals" and force a review, and more frequent checks against suspicious transaction indicators (FINTRAC, ongoing monitoring requirements). AMLA's draft adds tighter scenarios and reviews that look further back (paragraph 41).

Where does perpetual KYC fit in the review calendar?

Perpetual KYC reviews a file when an event lands, such as a change of director or a new PEP status, so most reviews stop waiting for a date. The calendar stays as the fallback: the EU's 1 and 5 year limits still apply when no event fires.

How do you keep sanctions and PEP screening current after onboarding?

Picture a payment firm with 50,000 business customers (figures illustrative). Then a list update lands overnight. It adds 40 names and removes 12.

• A full rescreen runs all 50,000 customers against the whole list again. It catches the 40 new names but also raises every near match analysts already cleared, unless those decisions are stored and applied.
• A list change run screens all 50,000 against the 40 new names, screens customers whose own data changed against the whole list, and closes open matches on the 12 names that came off.

Both catch the new designation, but only the second spares analysts the whole book's history. New politically exposed persons (PEPs) arrive the same way, through PEP data updates.

AMLR Article 26(4) adds a rule for EU credit and financial institutions from 10 July 2027: run the targeted financial sanctions check on customers "upon any new designation". OFAC's Framework lists firms that "failed to update their sanctions screening software to incorporate updates to the SDN List or SSI List" among the root causes of past violations (p. 11). In the UK, a feed still built on OFSI's Consolidated List, closed since 28 January 2026, misses new UK names, which appear only on the UK Sanctions List.

complead, formerly Sanction Scanner, runs each monitored name past 3,500+ sanctions, PEP and watchlists from 220+ jurisdictions, refreshed every 15 minutes. Monitoring of a name can be started and stopped through API triggers, and Candex, a master vendor that screens its buyers' suppliers, uses them to stop screening vendors that are no longer relevant (Candex's account of its vendor screening).

How do banks manage ongoing sanctions monitoring without too many alerts?

A cleared decision is stored against the customer and the list entry, so a rerun raises it again only when one side changes. Thresholds can be set per list type and per individual list in the client screening and ongoing monitoring product; Candex runs its fuzzy threshold at 80 percent for sanctions lists and at 95 percent for watchlists, so more near matches surface where a true match carries the most risk. Each alert also carries the reason it fired, which lets an analyst close a known false positive quickly.

How does ongoing monitoring connect to transaction monitoring and SAR filing?

Transaction monitoring is the part of ongoing monitoring that reads payments. It runs on the customer file. AMLA's draft asks for customer profiles built from verified due diligence information, including the expected transactions, with monitoring calibrated to that baseline so deviations show without undue delay (paragraph 53), and for continuous monitoring as a general rule (paragraph 58). That is the know your transaction step, and the logic behind expected activity rules.

A deviation reopens the file. The firm reassesses the customer's information and risk profile and decides whether a suspicious activity report is due under AMLR Article 69 (paragraph 57). In the EU the report goes to the FIU promptly once the firm knows, suspects or has reasonable grounds to suspect. In the US, a bank's SAR clock is 30 calendar days from first detecting the facts, stretched to 60 at most while a suspect is still unknown (31 CFR 1020.320).

Monitoring never files the report by itself. In complead's transaction monitoring software, every alert shows which rule fired and which signals matched, and a reviewer makes the call, with the record naming who did. AMLA's draft asks for outputs a person can review and challenge, with responsibility for monitoring decisions clearly assigned (paragraph 88), and a decision to report then follows the SAR and STR filing steps.

How do you prove that ongoing monitoring actually ran?

The Central Bank of Ireland's settlement notice reads like a test plan in reverse, and AMLA's draft supplies the matching expectation for most of its findings.

1. Every scenario fired last month. Five of Coinbase Europe's 21 high risk scenarios did not operate fully for a year (notice, para 12); the framework must produce "valid and meaningful output" (AMLA para 49).
2. Each rule tested against known hits. The faulty rules compared blockchain addresses with lists of high risk addresses, and configuration faults stopped some transactions from matching (notice, p. 15).
3. Defaults assessed. "Default settings should not be used without a documented assessment" (AMLA para 50).
4. Outsourced monitoring evidenced. A sister company ran the system; Coinbase Europe "remained responsible" (notice, para 11; AMLA para 37).
5. Pending alerts aged. Review of the 184,790 transactions flagged by August 2022 began only in May 2023 (notice, para 13; AMLA para 76).
6. Automatic closures sampled. A person samples alerts that close without one (AMLA paras 78 and 79).
7. Faults reported. The Central Bank was told on 21 November 2023 and called the delay aggravating (notice, para 20).
8. Changes validated. A new rule set is tested for what it should catch, not only against the old output (AMLA para 85), and performance is reviewed on a cycle (para 81).

For checks 1 and 8, complead's rules engine replays a rule over a 30, 60 or 90 day window of real history and reports its alert volume, clearance rate and true positives, and every change is versioned with who made it, when and why.

What records must you keep, and for how long?

From 10 July 2027, AMLR Article 77(1)(b) asks EU firms to record each assessment of a possibly suspicious transaction, "whether or not" a report follows, for 5 years from the end of the relationship (77(3)). A cleared alert is a record too. UK firms keep due diligence records, and records of transactions in the relationship, for five years after it ends, and need not keep transaction records beyond 10 years (Money Laundering Regulations 2017, regulation 40). A US bank keeps Bank Secrecy Act records for five years (31 CFR 1010.430(d)) and each SAR with its supporting documents for five years from filing. FINTRAC wants the monitoring measures and their findings kept at least five years from creation.

Which 2026 changes reached ongoing monitoring, and what comes next?

• 12 January. The High Court confirmed the Coinbase Europe sanctions.
• 28 January. OFSI's Consolidated List closed, which leaves the UK Sanctions List as the one place UK designations appear.
• 13 February. FinCEN's exceptive relief tied beneficial owner verification to a legal entity customer's first account, to doubts about earlier data and to risk based procedures; the ongoing monitoring duty stayed in place.
• 7 April. FinCEN proposed an AML/CFT program rule that fully supersedes the July 2024 proposal; comments closed on 9 June, and by 3 November no final rule had appeared in the Federal Register.
• 3 June. AMLA published its draft guidelines on ongoing monitoring. The consultation closed on 3 September, and on 3 November the page still said results will follow, although Article 26(5) had set 10 July 2026 for the guidelines. The draft adds that using AI or other advanced tools is not, by itself, proof that monitoring works (paragraph 87).
• Next, 10 July 2027. AMLR Article 26 applies.

Start with three checks on your own program:

1. Pull last month's alert count for every scenario and explain each zero.
2. Confirm that every sanctions feed points at a live source, the UK Sanctions List included.
3. Date the last completed review of each higher risk customer and flag any older than a year.

Where these facts come from. Melis Alparslan wrote this guide from the Central Bank of Ireland's release of 6 November 2025 and its settlement notice, AMLA's consultation paper of 3 June 2026 (for every paragraph number), Regulation (EU) 2024/1624, 31 CFR 1010.430 and 1020.320, regulation 40 of the UK Money Laundering Regulations 2017, FINTRAC's ongoing monitoring guidance, OFAC's Framework and FinCEN's releases of 13 February and 7 April 2026, all reread on 3 November 2026. Laura Otterpohl, Compliance Manager at Candex, checked the facts on 6 November 2026.