Ongoing Monitoring

Ongoing monitoring is the part of anti-money laundering compliance that continues after a customer has been accepted. A financial institution must keep watching the business relationship: scrutinising transactions to see whether they are consistent with what it knows of the customer, their business and their risk profile, and keeping the information it holds about the customer up to date.

It is one of the core elements of customer due diligence, alongside identifying the customer, identifying the beneficial owner and understanding the purpose of the relationship. Checks made at onboarding describe a customer at a single moment. Ongoing monitoring recognises that customers change, that criminals often behave normally at first, and that most suspicious activity can only be seen over time. The term is often used interchangeably with ongoing due diligence.

The requirement originates in the FATF Recommendations, whose customer due diligence standard calls for ongoing due diligence on the business relationship and scrutiny of transactions throughout its course. National laws implement it. In the European Union and the United Kingdom, anti-money laundering legislation lists ongoing monitoring among the due diligence measures every obliged entity must apply. In the United States, the Financial Crimes Enforcement Network's customer due diligence rule, which took full effect in 2018, requires covered institutions to conduct ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information.

The duty applies to banks, payment and e-money institutions, money transmitters, securities firms, crypto-asset service providers and other regulated businesses. All of these frameworks follow a risk-based approach: the intensity of monitoring should match the risk the customer presents.

• Transaction monitoring. Transaction monitoring compares activity with rules and with the customer's expected behaviour, flagging unusual amounts, patterns, counterparties or destinations.
• Sanctions and watchlist rescreening. Customers and related parties are checked again whenever sanctions lists change, since a person cleared at onboarding may be listed later. Sanctions screening of payments runs in real time alongside.
• Status changes. Screening continues for customers who become a politically exposed person, and adverse media screening looks for news linking a customer to crime.
• Keeping records current. Identity documents, addresses, ownership structures and the stated nature of business are refreshed, either on a schedule through periodic review or when something changes.
• Risk rating updates. The customer's score in the firm's customer risk rating model is revised as new information arrives, which in turn changes how closely the customer is watched.

Monitoring needs something to compare against. At onboarding the firm records what it expects: the customer's occupation or line of business, where their money comes from, the products they will use, and the likely volume and geography of their payments. A salaried employee whose account begins receiving large transfers from abroad, or a small retailer whose card takings triple in a month, departs from that profile.

A departure is not proof of wrongdoing. It is a prompt to ask why. The firm may find an innocent explanation in its own records, or may need to ask the customer for evidence such as a contract or proof of source of funds. For higher-risk customers, monitoring is closer and thresholds are lower, as part of enhanced due diligence.

Certain events call for a fresh look at a customer regardless of any schedule: a monitoring alert that cannot be explained, a sanctions or adverse media match, a change in ownership or control of a company, a request for a new and riskier product, activity in a high-risk country, a law enforcement inquiry, or doubt about the accuracy of information previously supplied. This event-driven approach is increasingly preferred to fixed review dates, and some firms describe a model of continuous or perpetual review fed by external data sources.

An alert is investigated by an analyst and either closed with a recorded reason or escalated. Where suspicion remains, the firm files a suspicious activity report with the financial intelligence unit and must not tell the customer it has done so. Other outcomes are a higher risk rating, restrictions on the account, or ending the relationship. Regulators caution against wholesale exits from entire categories of customer, the practice known as de-risking, in place of assessing each case.

The main practical difficulty is volume. Rule-based systems generate large numbers of alerts, the great majority of which turn out to be legitimate activity, and each must be reviewed and documented. Transaction monitoring tuning, customer segmentation and statistical models are used to reduce noise without missing real cases. Poor or outdated customer data undermines the whole exercise, since monitoring against a wrong profile produces both false alarms and blind spots.

Enforcement actions against banks and payment firms frequently cite failures in this area: alerts left unreviewed in backlogs, monitoring systems that did not cover certain products or data feeds, thresholds set to suit staffing levels instead of risk, and customer files not updated for years. Supervisors therefore expect firms to document how their monitoring is designed, test that it works, and show that staffing is adequate for the alerts it produces. Fast-growing fintech companies are a regular subject of such findings, because customer numbers can outpace compliance capacity.