Ongoing monitoring is often read as a yearly rescreen of the customer base. FATF Recommendation 10(d) asks for two duties instead: "ongoing due diligence on the business relationship", and scrutiny of the transactions made over its whole course (FATF Recommendations, updated June 2026, p. 14). Both run until the customer leaves. The scrutiny half is the daily work of a transaction monitoring program.
What do the rules require for ongoing monitoring?
Table 1. Ongoing monitoring requirements by jurisdiction (rule texts read 22 October 2026; FATF edition of June 2026).
| Jurisdiction | Rule | What it requires | Applies to |
|---|---|---|---|
| FATF standard | Recommendation 10(d); Interpretive Note to Recommendation 10, paragraph 23 | Ongoing due diligence and scrutiny of transactions; CDD records kept current by reviewing existing records, particularly for higher risk customers | Countries, for their national laws |
| United States | 31 CFR 1020.210(a)(2)(v) | Understanding customer relationships "for the purpose of developing a customer risk profile"; monitoring to report suspicious transactions and, "on a risk basis", to update customer information | Banks |
| United States | FinCEN CDD FAQ, 3 April 2018, question 14 | No duty to update beneficial ownership "as a matter of course during regular or periodic reviews"; an update is "triggered when, in the course of normal monitoring," the bank learns something relevant | Covered financial institutions |
| United Kingdom | Money Laundering Regulations 2017, regulation 28(11) | Scrutiny of transactions "throughout the course of the relationship" and "reviews of existing records" to keep CDD documents current | Relevant persons |
| United Kingdom | Regulation 27(8) and (9) | CDD on existing customers "at other appropriate times" on a risk based approach, and when their circumstances change | Relevant persons |
| European Union | Regulation (EU) 2024/1624 (AMLR), Article 26 | Customer information updated at least every 1 year for higher risk customers and every 5 years for others; a review when circumstances change; a sanctions check "upon any new designation" | Obliged entities, from 10 July 2027; the designation check binds credit and financial institutions |
The rows agree on the two duties and part on timing. The US works from risk and events, the UK from "appropriate times", and the EU adds outer limits. In the US the duty sits in the bank's AML program rule.
The FCA has fined a bank for missing it. On 16 July 2025 it fined Barclays Bank PLC £39.3 million over Stunt & Co, because Barclays "did not gather enough information at the start of the relationship or carry out proper ongoing monitoring" (FCA). In just over a year Stunt & Co received £46.8 million from Fowler Oldfield, a money laundering operation; the firm's owner was acquitted of money laundering charges.
Ufuk Gürdaş, reviewing this entry, on running one calendar for two books: "A US bank does not have to refresh beneficial ownership at a routine periodic review unless something in its monitoring raises a risk (FinCEN's CDD FAQ, question 14), while from 10 July 2027 an EU firm must update every customer file at least every five years, and every year for higher risk customers (AMLR Article 26(2)), so a group that runs one review calendar for both books has to set it to the EU's."
Which regulated industries must carry it out?
Article 3 of the EU Regulation gives examples of regulated industries: credit and financial institutions, auditors, accountants and tax advisors, lawyers and notaries in certain transactions, trust or company service providers, estate agents, traders in precious metals and stones or high value goods, and gambling providers. Under Article 26 each of them runs both duties.
How does ongoing monitoring work, and what are its two components?
The first component is transaction scrutiny. Each payment on the account is compared with what the firm knows about the customer: expected activity, source of funds, the business. In the transaction monitoring software of complead, formerly Sanction Scanner, rules and scenarios raise the alerts, and an analyst decides what each one means.
The second is file upkeep. Identity, ownership, purpose and the customer risk profile are kept current, and the customer is rescreened against sanctions, PEP and watchlist data. Hepsiburada, a leading ecommerce company in Türkiye, selected complead Fusion for merchant compliance, including ongoing monitoring with daily rescreening of its merchants (Hepsiburada selects complead Fusion, 16 October 2026).
The two share one record. An odd payment can move the risk tier, and a new owner changes what counts as normal. Both sit in the program the AML compliance officer runs and signs off.
What are the key triggers for an ongoing monitoring review?
Six events start a review. UK regulation 27(9) names the first three, and the EU Regulation the rest:
- A change in identity or ownership. "Any indication that the identity of the customer, or of the customer's beneficial owner, has changed" (27(9)(a)).
- Activity outside the profile. Transactions "not reasonably consistent" with what the firm knows (27(9)(b)).
- A new purpose. A change in "the purpose or intended nature" of the relationship (27(9)(c)).
- A new designation or PEP status. AMLR Article 26(4) asks for a sanctions check "upon any new designation"; PEP checks are part of CDD (Article 20(1)(g)).
- Negative news. It can be "a relevant fact which pertains to the customer" (Article 26(3)(c)).
- The review date. The outer limit when nothing else fires (Article 26(2)).
Reviewing on these events, with the date as the backstop, is what perpetual KYC means.
Is ongoing monitoring the same as sanctions screening?
Picture a payment firm that screens a customer in January and finds no match (illustrative). In July the EU designates the customer under its sanctions. The January result was right on the day it ran, and only ongoing monitoring catches July.
From 10 July 2027, AMLR Article 26(4) requires credit and financial institutions to check their customers against targeted financial sanctions "upon any new designation", on top of the regular checks every obliged entity runs. AML screening is that check at one moment. Ongoing monitoring repeats it as lists change, reads each result and acts on it, alongside the review of the whole relationship.
How is ongoing monitoring different from transaction monitoring?
Transaction monitoring is one of the two components, and its primary purpose is to score payments against rules and the customer's profile. Ongoing monitoring is the wider duty that also keeps that profile current, and UK regulation 28(11)(a) and AMLR Article 26(1) put transaction scrutiny inside it. Run on every payment, that component becomes continuous transaction monitoring.
What is the ongoing monitoring process, and when is a review necessary?
To build an effective ongoing monitoring process, work through five steps:
- Rate each customer's risk tier at onboarding.
- Write down the activity that counts as normal for each tier.
- Turn the triggers above into alerts.
- Have an analyst review each alert, update the file and decide the tier again, with the evidence attached.
- Record who decided what, when and why.
A review is necessary when a trigger fires and, in the EU, when the outer limit comes due. Count the load (illustrative): 10,000 customers with 800 at higher risk need 800 reviews a year plus 9,200 within five years, at least 2,640 a year before any trigger.
The tools and technologies that support the cycle are transaction monitoring, rescreening and case management. Its challenges are alert volume and stale data, and the benefit of strong ongoing monitoring is a customer file that still matches the customer.
How often must a customer file be reviewed?
None of the four regimes sets one interval for every customer. The EU sets outer limits of 1 and 5 years. The UK asks for CDD "at other appropriate times to existing customers on a risk based approach" (regulation 27(8)(a)). The US asks for updates "on a risk basis" and, for beneficial ownership, when monitoring gives a reason. FATF asks for record reviews, particularly for higher risk customers. These limits govern updates to customer information, while transaction scrutiny runs throughout the relationship.
Which customer changes start a review, and how fast the file then has to be updated, is for each firm to set, and an examiner (US) or auditor (UK and EU) will ask to see that list.
Related terms
- Transaction monitoring. Scoring payments against rules and the customer's profile.
- AML compliance officer. The person accountable for the AML program.
- Perpetual KYC. Reviewing a file when events occur, not only on a date.
- Know your transaction (KYT). Checking each transaction against the customer's profile.
- False positives and false negatives. Wrong alerts, and missed risks.
