Ongoing AML Monitoring

What Ongoing AML Monitoring Does

Ongoing AML monitoring is not a one-time onboarding control, it is a continuous surveillance process that keeps customer risk current as behaviour, counterparties, payment patterns and ownership data change. Its purpose is to surface new suspicious activity, sanctions exposure, or inconsistency with the original customer profile after the relationship has already begun.

That makes it a living control rather than a static checklist. A customer can be clean at onboarding and become higher risk later because of a new geography, a new beneficial owner, a changed transaction pattern, or new adverse information.

Why It Exists in AML Programmes

The core value of ongoing monitoring is that financial crime risk evolves faster than a point-in-time review can capture. Screening at onboarding answers whether the customer looked acceptable then; monitoring answers whether the customer still looks acceptable now. It is one of the mechanisms that connects customer due diligence with alerting, investigation, and reporting obligations.

In mature programmes, monitoring also supports risk-based calibration. Higher-risk customers may need tighter thresholds, more frequent review, or more analyst attention, while lower-risk relationships can be monitored with lighter but still meaningful scrutiny. The control only works when the rules are tuned to the institution’s actual product, geography and customer mix.

What Good Monitoring Looks For

Effective monitoring looks for changes that matter, not just volume. That includes unusual transaction velocity, circular flows, rapid movement through accounts, new counterparties, sanctions-list hits, unexpected jurisdictions, and activity that no longer fits the customer’s stated purpose or expected behaviour.

It also depends on data quality. If customer records, beneficial ownership, geographies, or expected activity profiles are stale, the monitoring engine will generate weak signals or miss meaningful ones. The quality of the underlying customer record is therefore part of the control, not a separate administrative task.

For programme design and case handling, the monitoring function should connect clearly to alert triage, investigation, escalation and suspicious reporting. NHIMG’s AML programme and transaction monitoring guide covers how scenario tuning, alert triage and case management fit together in practice.

Why It Is Hard to Do Well

Monitoring fails when organisations treat it as a static rules engine instead of a risk intelligence process. Too many false positives can bury genuinely suspicious cases, while thresholds that are too loose can delay detection until exposure has already spread across accounts, products or jurisdictions.

It also becomes harder when customer populations are broad and change quickly, such as correspondent banking, cross-border activity, virtual assets, or complex ownership structures. In those settings, the challenge is not simply seeing activity, but maintaining a current understanding of what “normal” should mean for each relationship. FATF’s AML and KYC Framework remains the broad international reference point for customer due diligence, beneficial ownership and suspicious activity controls, while the EBA AML/CFT Guidance reflects the EU supervisory perspective on implementing those obligations.

Risk and Threat Considerations

Ongoing AML monitoring matters because criminals do not need to defeat the whole control environment, they only need to make risky activity look ordinary for long enough to move value, layer funds, or avoid filing thresholds. Weak monitoring creates exposure to sanctions breaches, missed suspicious activity, and reputational damage when a relationship changes faster than the programme detects it.

Failure mechanism: The control breaks when customer risk indicators are stale, scenarios are poorly tuned, alerts are deprioritised, or ownership and counterparty changes are not reflected quickly enough in the monitoring model.

Impact: Suspicious activity may pass through undetected, sanctions exposure can increase, and the institution may miss the evidence needed to investigate, escalate, or file on time.

Practitioner Guidance

Why practitioners should care: Ongoing monitoring should be owned as an operational control, not just a compliance report. Its effectiveness depends on the link between customer data quality, scenario design, and case handling, so control ownership needs to sit across financial crime operations, compliance, and data governance.

What to watch for: Pay close attention to drift between the expected customer profile and observed behaviour, especially where ownership, geography, payment corridors, or product usage change after onboarding. That drift is often the earliest sign that a customer’s risk has changed before a formal alert appears.

Practitioner takeaway: The most effective programmes treat monitoring as a continuous recalibration loop, not a fixed set of rules run in the background.

Related resources from NHI Mgmt Group

• Why do VASPs need ongoing transaction monitoring for Travel Rule and AML compliance?
• What is the difference between customer due diligence and ongoing monitoring in AML?
• What is the difference between sanctions screening and ongoing AML monitoring?
• Why do US AML requirements place so much emphasis on customer due diligence and ongoing monitoring?