Periodic KYC reviews occur on a schedule, while event-driven CDD is triggered by a material change in customer risk, activity or adverse information. The first manages time-based recertification, but the second catches risk changes that happen between calendar reviews, which is increasingly important in digital, fast-moving AML environments.
How periodic KYC reviews differ from event-driven CDD
Periodic KYC reviews are calendar-based recertifications of a customer file. Event-driven CDD is a triggered reassessment when something material changes, such as ownership, transaction behaviour, sanctions exposure, adverse media, or the stated business model. The operational difference is timing: one is scheduled governance, the other is exception handling that reacts to new risk signals.
Because the two serve different control purposes, they should not be treated as substitutes. Periodic reviews give an institution a baseline rhythm for keeping records current, while event-driven CDD is the control that closes the gap between review cycles. In practice, the strongest programs use periodic KYC to maintain coverage and event-driven CDD to catch out-of-cycle changes that would otherwise linger until the next scheduled refresh.
The distinction also matters for case design. A periodic review usually checks whether the existing profile is still complete and whether the customer should remain on the same review cadence. Event-driven CDD is more investigative: it asks whether the triggering change alters the customer’s risk rating, due diligence depth, monitoring rules, source-of-funds expectations, or even the decision to keep the relationship open.
When each control should be used
Periodic KYC works best as a stable lifecycle control for every customer segment, with frequency set by risk tier, regulatory expectation, and internal policy. It is the main tool for planned recertification, data refresh, and evidence that the institution is not relying on stale onboarding information. FATF Recommendations remain the clearest external reference point for why customer due diligence must be ongoing rather than a one-time event.
Event-driven CDD should be used when a discrete signal changes the risk picture before the next scheduled review. Common triggers include a new beneficial owner, a material change in activity, a high-risk jurisdiction link, suspicious payment patterns, or adverse information that calls the original customer story into question. The practical test is simple: if the trigger would change how you would monitor, question, or restrict the customer today, it belongs in event-driven CDD.
That is why many firms pair both controls with transaction monitoring and alert triage. The monitoring layer detects the signal, while the CDD process decides whether the signal is material enough to update the KYC file, escalate due diligence, or invoke restrictions. EBA AML/CFT Guidance is useful here because it frames ongoing monitoring and periodic review as complementary obligations, not competing ones.
Why the distinction matters for AML governance
Teams often fail when they over-rely on the calendar. If periodic reviews are the only refresh mechanism, risk can drift for months without correction. That is especially problematic in digital onboarding and fast-moving customer environments, where ownership, payment behaviour, counterparties, and adverse signals can change faster than the next annual or biennial review.
The strongest programs treat event-driven CDD as a governance backstop for stale assumptions. A trigger should not merely open a case, it should force a decision on whether the customer’s profile, risk score, and controls remain valid. This is where clear escalation criteria matter, because not every change is material and not every alert warrants full re-underwriting.
Good governance also depends on traceability. If a firm cannot show why a trigger was ignored, downgraded, or escalated, it will struggle to defend its CDD decisions to auditors or regulators. FinCEN is a relevant reference for institutions that need to align ongoing monitoring, suspicious activity evaluation, and customer risk management with US AML expectations.
Risk and Threat Considerations
When organisations rely too heavily on periodic reviews, the main risk is stale customer intelligence. That creates a window where beneficial ownership changes, adverse media, sanctions exposure, or unusual activity can sit undetected until the next scheduled refresh. In AML terms, the control failure is not missing the review cycle, it is assuming the cycle itself is enough to keep the risk picture current.
Failure mechanism: Material changes occur between review dates, but the institution lacks a trigger, ownership, or workflow to force an out-of-cycle reassessment, so the customer remains on an outdated risk profile.
Impact: The firm can under-monitor higher-risk customers, miss suspicious activity indicators, delay escalation, and retain relationships that should have been repriced, restricted, or exited.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 provides the primary governance reference for this topic.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | ID.AM-01 — Physical devices and systems within the organization are inventoried | Supports maintaining current customer records and review cadence discipline. |
| DE.CM-01 — The network is monitored to detect potential cybersecurity events | Event-driven CDD depends on monitoring signals that surface material change. | |
| GV.RM-01 — Risk management strategy is established and agreed to by organizational stakeholders | The question is fundamentally about when to recertify versus when to escalate risk. | |
| Recommendation — Inventory customer records and review states so refresh decisions are based on current data. Monitor for change signals and route material alerts into CDD escalation. Define when calendar review is enough and when triggers require immediate reassessment. | ||
Practitioner Guidance
What to verify: Check whether your periodic review policy and event trigger list are actually linked to the same customer risk model. If a trigger would change the customer’s risk rating, due diligence depth, or monitoring scenario, it should produce a documented CDD decision, not just an alert disposition.
Decision rule: Use periodic KYC to confirm completeness and cadence, and use event-driven CDD to challenge the current risk story. If the trigger is material, re-rate first and investigate second, because the correct control response is often to change the profile before the next review date.
Practitioner takeaway: The best AML programs do not choose between periodic and event-driven controls, they use periodic reviews to maintain baseline governance and event-driven CDD to prevent risk drift from outrunning the calendar.
Related resources from NHI Mgmt Group
- What is the difference between periodic access reviews and event-triggered access reviews?
- What is the difference between attack surface management and NHI governance?
- What is the difference between reviewing human access and reviewing NHIs?
- What is the difference between role-based access and API key governance for NHI security?