Ongoing Due Diligence

Ongoing due diligence is the continuing obligation of banks and other regulated firms to monitor each business relationship throughout its life, not only when the account is opened. It has two parts: scrutinising transactions to make sure they fit what the firm knows about the customer, its business and its risk profile, and keeping identification, ownership and other customer due diligence information current. The aim is to spot when a customer's activity or circumstances change in a way that raises money laundering, terrorist financing or sanctions concerns.

It is sometimes called ongoing monitoring. It connects onboarding checks under Know Your Customer rules with transaction monitoring, periodic reviews and screening, and its intensity depends on the customer's rating in the firm's customer risk rating model.

A landlord checks references before letting a flat, but the job does not end when the tenant moves in. Over the years the landlord notices if the rent stops arriving, if many strangers start coming and going, or if the tenant seems to be running a business from the flat. The original references are only a starting point.

Banks work the same way. Checking identity at the start is not enough, because people's jobs, businesses and habits change. Ongoing due diligence means the bank keeps watching how the account is used, updates its records from time to time, and asks questions when something no longer matches the picture it has of the customer.

• International standards. FATF Recommendation 10 lists ongoing due diligence on the business relationship as a core element of customer due diligence.
• European Union. The anti-money laundering directives require ongoing monitoring, including scrutiny of transactions and keeping documents, data and information up to date, a requirement carried into the EU's single anti-money laundering regulation.
• United Kingdom. The Money Laundering Regulations 2017 require firms to conduct ongoing monitoring of business relationships, including reviewing existing records.
• United States. FinCEN's 2016 customer due diligence rule made ongoing monitoring an explicit element of anti-money laundering programs for covered institutions: monitoring to identify and report suspicious transactions and, on a risk basis, maintaining and updating customer information, including beneficial ownership.

• Transaction scrutiny. Automated systems and staff review activity for patterns that do not fit the customer profile, supported by unusual activity detection.
• Screening. Customers and related parties are screened regularly against sanctions lists, through politically exposed person screening and for adverse media.
• Periodic reviews. Files are refreshed on a cycle linked to risk, commonly every year for high-risk customers and less often for lower-risk ones.
• Event-driven reviews. Changes such as new owners, a new line of business, a large unexpected payment or a law enforcement request prompt an immediate review, sometimes as an enhanced due diligence trigger.

Some firms are moving from fixed review cycles to more continuous updating, sometimes called perpetual KYC, in which data feeds and alerts update the customer file as soon as something changes.

For companies, ongoing due diligence goes beyond the account's transactions. Firms track changes in directors, shareholders and controllers, because a new owner may bring sanctions or reputational risk, and they check that the business still does what it said at onboarding. Payment firms and acquirers review merchants' websites, products and refund patterns, while banks serving other financial institutions reassess their respondents' own controls. Where customers act for others, such as payment agents or professional intermediaries, the firm must also consider the risks of the underlying clients it cannot see directly.

A review may confirm the existing profile, update records, change the customer's risk rating or impose extra controls, such as limits on certain products. If the firm cannot obtain the information it needs, it may have to restrict or end the relationship, a process covered under offboarding. Where activity cannot be explained, staff escalate it internally, and the firm may file a suspicious activity report.

Ongoing due diligence is resource-intensive, especially for firms with millions of customers. Customers often ignore requests for updated documents, data held in different systems may conflict, and review backlogs are a common supervisory finding. Firms also have to avoid treating customers unfairly, for example by closing accounts on thin evidence, which can contribute to de-risking. Better use of data, automation and a clear risk-based approach help firms focus effort on the relationships that matter most.