Perpetual KYC names an old duty. The FATF Recommendations say financial institutions should be required to keep due diligence records up to date "by undertaking reviews of existing records" (Interpretive Note to Recommendation 10, para 23), and US banks monitor "on a risk basis, to maintain and update customer information" (31 CFR 1020.210).
EU law reapplies due diligence to existing customers "when the relevant circumstances of a customer change" (Directive (EU) 2015/849, Article 14(5)), and so does the UK's Money Laundering Regulations 2017 (MLR) reg 27(8).
What is perpetual KYC, and what is it not?
Perpetual KYC, short for perpetual know your customer, means meeting that duty on events: an event opens the review, and the scheduled date waits behind it. Business files age as owners and directors change unannounced, so KYB and UBO verification is best refreshed continuously, with periodic reviews as a backstop.
Identity checks need not restart each review. A firm may rely on the verification it has already done unless it doubts that information (Interpretive Note 10, para 10). eKYC verifies identity electronically, usually at onboarding; pKYC decides when the file is looked at again.
Ongoing monitoring is the wider duty, covering transaction scrutiny and file upkeep for as long as the relationship lasts. Perpetual KYC is one way to run the upkeep part of customer due diligence.
How does perpetual KYC differ from a periodic review, and what are its benefits?
Picture an EU retail bank and a low risk customer due for review in five years (illustrative). In March the customer joins the supervisory board of a state owned energy company abroad, a PEP role (Directive Article 3(9)(g)). On a periodic model the file stays low risk until the date. Under perpetual KYC the next PEP screening run returns the match, and the review refreshes PEP status, source of funds and source of wealth and expected activity.
The rating goes to high and enhanced due diligence (EDD) follows, with senior management approval to continue (Directive Article 20(b)(i); UK MLR 2017 reg 35(5)(a); for foreign PEPs, FATF Recommendation 12(b)).
Table 1. Periodic review and event driven review compared (as of October 2026).
| Periodic review | Event driven review (perpetual KYC) | |
|---|---|---|
| What starts it | A date set by the risk tier | An event: a screening match, a registry filing, an alert, a staff report |
| What it covers | The customer information, at a depth set by the customer's risk profile (AMLA consultation draft, para 19) | What the event affects (AMLA draft, para 3); for US beneficial ownership, only what changed (FinCEN CDD FAQ B.20) |
| When a change is caught | At the next date | When the event is detected |
| Where the work sits | In batches around review dates | Across the year, as events arrive |
| What the rules still ask | A latest date: Regulation (EU) 2024/1624 (AMLR) Article 26(2) from 10 July 2027; RBI KYC Directions, 2025 for commercial banks, para 42(1) | Event reviews "in addition" to the date (AMLR Article 26(3)) |
For anti money laundering (AML) compliance the benefit is timing: the PEP role reaches the file in March, and the record shows which event opened the review.
Count the events that ended in a changed risk rating, not the alerts. If a year of triggers moved no customer's tier and every rating change still came from the scheduled review, the trigger set is too narrow or its thresholds too high, and the calendar is still doing the work.
How does perpetual KYC work, from event to updated file?
Table 2. One event through a perpetual KYC review, step by step (rules as of October 2026).
| Step | Starts from | Ends with | Who acts | Rule or guidance |
|---|---|---|---|---|
| 1. Detect | Rescreening, adverse media, a registry filing, a transaction alert, a staff report | An event with its source and date | System or staff | AMLR Article 26(3); MLR reg 27(8)(b) and (9); AMLA draft para 29 |
| 2. Triage | The event and the current profile | Closed with a note, or a review opened | Analyst | AMLA draft para 27 |
| 3. Scope | The event type | The fields to refresh: an owner filing reopens owners and control, not the passport | Analyst, under a written procedure | FinCEN FAQ B.20; FATF INR 10 para 10; AMLA draft para 3 |
| 4. Refresh and rate again | New data with its source and date | Updated file, rating and due diligence level | Analyst, using the rating method | AMLR Article 26(2); MLR 2017 reg 28(11)(b) |
| 5. Decide | The new rating | Continue, apply enhanced measures with approval, end the relationship, or consider a suspicious activity report | Analyst; senior management for PEPs | FATF Recommendations 10 and 12; Directive Article 20; MLR reg 35(5) |
| 6. Record and set the date | The decision | The trail and the next review date | The policy | AMLR Article 26(2); AMLA draft paras 2 and 8; RBI para 42(1) |
Steps 2 and 3 decide the workload. Triage asks whether the event is a relevant and material change to the customer's risk profile (AMLA draft, para 27). Scope limits the refresh: for beneficial ownership after a triggering event, FinCEN says "only the information that has changed must be updated" (FAQ B.20, updated 6 May 2026).
In AMLA's draft an expired passport alone does not mean collecting new KYC documents. The firm weighs the customer's risk, the issuing country, how long the document has been expired and whether an older one lacks current security features and is easier to counterfeit; the update then comes without delay, or at the next scheduled review or customer contact (paras 16 to 18).
Does perpetual KYC remove the need for a periodic review?
No. In the EU from 10 July 2027, AMLR Article 26(2) sets the longest gap between updates at 1 year for higher risk customers under enhanced measures and 5 years for all others, and Article 26(3) adds event reviews "in addition". AMLA's draft says periodic reviews "must always be conducted" (para 19) and an earlier review "can reset the timeline" (para 2).
An Indian commercial bank updates KYC at least once every two, eight or 10 years for high, medium and low KYC risk rating tiers, counted from account opening or the last update (RBI para 42(1)). The UK and US rules set no interval, and FinCEN says periodic reviews "are not by themselves a trigger" to update beneficial ownership (FAQ B.18).
What technology and data does a firm need before it runs perpetual KYC?
Whatever KYC solutions a firm buys, seven things come first:
- A dated baseline. Each field keeps its source and last verified date, so a review sees how current it is (AMLA draft para 3).
- Connected sources. Rescreening, registry filings, monitoring alerts and staff escalations reach one queue (para 29).
- A triage rule. It says which events count as a relevant and material change (para 27).
- A scope rule. It says which fields each event reopens (FinCEN B.20).
- A rating step. New facts go back through the customer risk assessment method, or the tier never moves.
- A backstop date per tier. The policy also says which reviews reset it (para 2).
- A decision trail. What was assessed, what was decided and why, so a supervisor can follow it (para 8).
The role of technology scales: for a business limited in scale, risk and complexity, AMLA's draft says manual or partly automated processes may be a proportionate option (para 28).
In complead, formerly Sanction Scanner, perpetual KYB and KYC keeps a last verified date on every field, and a review starts from the last decision and looks only at what changed.
What is perpetual KYB?
Perpetual KYB applies the same model to business customers, with onboarding KYB verification as the baseline. Registry changes are the events. A new director, new owners, a change of control or status all count (AMLA draft paras 27(a) and 29(c)).
In the US, FinCEN's exceptive relief order of 13 February 2026 lets covered institutions limit identifying and verifying a legal entity customer's beneficial owners to its first account, to facts that "would reasonably call into question the reliability" of what they hold, and to what their risk based procedures need.
What did 2026 add to event driven review?
- 13 February. FinCEN granted relief from identifying and verifying beneficial owners at every new account.
- 10 April. A FinCEN proposal for its AML and CFT program rule (91 FR 18704) would keep ongoing customer due diligence "without alteration", inside internal controls; no final rule as of 28 October.
- 3 June to 3 September. AMLA consulted on its AMLR Article 26(5) monitoring guidelines, due by 10 July 2026; its regulatory instruments page of 7 October 2026 lists them as a consultation draft (closed 3 September 2026, not final).
When nothing fires, how long can a file wait before its next review?
Related terms
- Ongoing monitoring. The duty to scrutinize a customer's transactions and keep the file current, whose upkeep part perpetual KYC runs on events.
- KYC risk rating. The low, medium or high tier that sets how often a file must be updated.
- Customer risk assessment. The method that turns a refreshed file into a new rating.
- Enhanced due diligence. The deeper checks a rating rise can bring, with senior management approval for PEPs.
- Know your customer (KYC). The checks a firm runs to identify a customer and understand the relationship.
- eKYC. Identity verification done electronically, usually at onboarding.
How this entry was checked. Barbaros Sercan (Customer Success Specialist, complead) is the author; Ufuk Gürdaş (Compliance Specialist) is the fact checker. Fact checked by: Ufuk Gürdaş, Compliance Specialist, 29 October 2026. Last reviewed: 29 October 2026. No rule text uses the term perpetual KYC, so the entry rests on the texts that set the duty it serves, each reread on 28 October 2026: Interpretive Note 10 (paras 10 and 23) and Recommendations 10 and 12 in FATF's June 2026 edition, Directive (EU) 2015/849 (Articles 3(9), 14(5) and 20), Regulation (EU) 2024/1624 (Article 26), AMLA's consultation draft guidelines of 3 June 2026, the UK Money Laundering Regulations 2017 (regulations 27, 28 and 35), 31 CFR 1020.210, FinCEN's CDD FAQs B.18 and B.20, its order of 13 February 2026, 91 FR 18704 and the RBI KYC Directions, 2025 (para 42(1)). The customer case in the second section is illustrative.
