Periodic Review

A periodic review is a scheduled reassessment of an existing customer carried out by a bank or other regulated firm to confirm that the information it holds is still correct and that the customer's risk rating is still appropriate. It is the calendar-driven part of the duty to keep customer due diligence up to date, and is often called a KYC refresh or KYC renewal.

The review exists because the checks made at onboarding go out of date. People move, change jobs and acquire new sources of income; companies change owners, directors and lines of business. A customer correctly rated low risk five years ago may not be low risk today. Periodic review sits beside continuous transaction and screening controls as one element of ongoing monitoring.

How often a customer is reviewed depends on the risk rating the firm has assigned, in line with the risk-based approach. A widespread industry convention is a review every year for high-risk customers, every two or three years for medium-risk customers and every three to five years for low-risk customers. Laws have generally required information to be kept current without fixing intervals, leaving firms to justify their choice to supervisors. The European Union's 2024 anti-money laundering regulation goes further, setting maximum intervals for updating customer information of one year for higher-risk customers and five years for others once it applies.

A politically exposed person, a customer subject to enhanced due diligence, a correspondent bank or a business in a high-risk sector will be on the shortest cycle. Very low-risk retail customers with simple products may be handled by automated checks alone.

• Identity and contact data. The firm confirms name, address, nationality and tax residence, and replaces expired identity documents where its policy requires.
• Ownership and control. For a business customer, the know your business file is refreshed: legal status, directors, and each ultimate beneficial owner, checked against company registers.
• Purpose and activity. The stated nature of the customer's business, expected volumes and countries are compared with what the account has actually done since the last review, drawing on transaction monitoring alerts and their outcomes.
• Screening. The customer and connected parties are run again through sanctions screening, political exposure lists and adverse media screening.
• Wealth and funds. For higher-risk customers the firm revisits the evidence for source of wealth and the origin of funds passing through the account.
• Risk rating. The inputs are fed back into the customer risk rating model and the rating is confirmed or changed, which sets the date and depth of the next review.

Most reviews end with the file updated and the relationship continuing unchanged. Others lead to a change of risk rating, with a corresponding change in monitoring intensity and approval level. Unexplained activity found during a review may be escalated and result in a suspicious activity report.

Where a customer does not respond to requests for information, firms follow a graduated process of reminders, restrictions on new transactions, and finally closure of the account, known as offboarding. Regulators expect a firm that cannot complete due diligence to end the relationship, but also expect customers to be given fair notice and vulnerable customers not to be cut off from basic services without good reason.

A calendar is a blunt instrument. A customer's circumstances may change the week after a review and go unnoticed for years, while thousands of unchanged customers are re-examined for no benefit. Firms therefore add trigger-based reviews, which are started by an event: a change of beneficial owner, a sanctions or media hit, a pattern of unusual transactions, a request for a new product, or a move to a higher-risk country.

Some institutions aim to replace most scheduled reviews with a model often called perpetual KYC, in which customer records are checked continuously against external sources such as company registers, sanctions lists and news feeds, and a human review is opened only when something material changes. Supervisors have accepted this approach in principle, provided the firm can show that its data sources and triggers are reliable and that no customer is left unreviewed indefinitely.

Periodic review is one of the most labour-intensive compliance processes. A large bank has millions of customers, and a corporate review can take many hours of analyst time gathering documents from the customer and public sources. Backlogs build up easily, and overdue reviews are a frequent finding in supervisory inspections and enforcement cases, where regulators have treated large numbers of out-of-date files as evidence that a firm does not understand its customer risk.

The process also strains customer relationships. Customers are asked for documents they believe they have already supplied, sometimes by several parts of the same institution, and business customers may face repeated requests from every bank they use. Firms try to reduce the burden by pre-filling what they already know, drawing data directly from registers and identity services, letting customers confirm details in the banking app, and reusing the results across products. Poor data quality is the underlying obstacle: reviews are slow largely because information from know your customer checks is scattered across systems, held in inconsistent formats, or missing.