What is the best way to manage ongoing customer due diligence?

What ongoing customer due diligence is designed to catch

Ongoing customer due diligence is not a one-time verification exercise. It is a monitoring and refresh process that looks for material change after onboarding, so the institution can keep the customer risk view aligned with reality. FATF Recommendations, the AML and KYC framework and the EBA’s AML/CFT guidance both support that risk-based, lifecycle approach.

That means the process should be able to absorb new information from periodic reviews, transaction monitoring, sanctions screening, ownership changes, adverse media and relationship escalation. The practical objective is to decide whether the original risk rating still holds, whether controls need to tighten, or whether the relationship has changed enough to justify enhanced review or exit.

Good ongoing due diligence is therefore a governance process as much as a screening process. It needs clear ownership for review timing, alert handling and case escalation, because stale customer records are one of the fastest ways for risk to drift away from the controls that were originally approved.

How to run refresh cycles without creating blind spots

The strongest operating model combines time-based reviews with event-driven triggers. A scheduled cycle keeps the population moving, while alerts from transaction monitoring, sanctions changes, beneficial ownership updates or unusual activity force an earlier review when the risk profile changes. Perpetual KYC is the closest practical pattern for this because it treats monitoring as continuous rather than purely annual.

A review cycle should be defined by customer risk, not just by convenience. Lower-risk relationships can often move on a longer cadence if transaction behaviour remains stable, while higher-risk customers, complex ownership structures, politically exposed persons and cross-border relationships need more frequent refresh and tighter escalation thresholds.

The refresh itself should update the record, not just refile it. That means confirming beneficial ownership, checking whether the intended activity still matches observed activity, validating sanctions exposure and re-evaluating adverse media or source of funds issues where they are relevant. If the new information does not change the risk rating, the record should still show that the review was completed and why the current view was retained.

What makes CDD fail in practice

CDD usually fails when firms confuse periodic administration with risk management. A review that only confirms the file exists, without testing for ownership change, unusual behaviour or screening hits, gives a false sense of control. The other common failure is weak escalation, where alerts are generated but do not produce a timely decision, so the customer record remains out of date even though the risk has already changed.

Another weakness is treating screening results as static. Sanctions exposure, adverse media and transaction patterns can change quickly, and the process must be able to react when a customer moves into a materially different risk bucket. For that reason, alert quality matters as much as alert volume: too many low-value alerts slow the process, but too few or poorly tuned alerts leave blind spots.

There is also a practical dependency on data quality. If ownership data, transaction history or customer profile fields are incomplete, the monitoring process may still run, but it will not be able to distinguish ordinary drift from a real change in risk. That is why ongoing due diligence works best when onboarding, monitoring and case management share the same customer view.

Risk and Threat Considerations

Weak ongoing due diligence creates exposure to missed control changes, stale risk ratings and delayed detection of customers whose ownership, behaviour or sanctions profile has changed. The result is not just a compliance gap, it is a real opportunity for illicit activity to continue under an unchanged customer file.

Failure mechanism: The process becomes calendar-driven or checkbox-driven, so meaningful changes are not escalated quickly enough, and the organisation continues to rely on an outdated risk assessment.

Impact: That can leave the firm exposed to sanctions breaches, AML control failures, missed suspicious activity and a larger remediation burden once the change is eventually detected.

Practitioner Guidance

What to prioritise: Start with the triggers that should force an out-of-cycle review, especially ownership changes, sanctions hits, adverse media and transaction anomalies. If those triggers are vague, the process will default to slow manual review and the risk rating will lag reality.

What to verify: Confirm that every refresh cycle can answer three questions, whether the customer profile is still accurate, whether the observed activity still matches expected behaviour, and whether the current risk rating still makes sense. If any of those are unclear, the case should be escalated rather than simply renewed.

Practitioner takeaway: The best ongoing CDD programmes are designed around change detection, not calendar compliance, because the value is in catching risk movement early enough to act on it.

Related resources from NHI Mgmt Group

• What breaks when customer due diligence is treated as a one-time onboarding step instead of an ongoing control?
• What is the difference between customer due diligence and ongoing monitoring in AML?
• How should organisations implement customer due diligence in a way that balances fraud prevention with regulatory compliance?
• What do teams get wrong about ongoing customer due diligence after onboarding?