Ongoing Due Diligence

What ongoing due diligence is really checking

Ongoing due diligence is not a one-time onboarding checkbox. It tests whether an identity, customer or counterparty still matches the trust assumptions used to approve it, using new evidence, refreshed attestations and periodic review.

That distinction matters because trust can drift after the initial decision. Ownership can change, systems can be reconfigured, access patterns can expand, and the control environment that looked acceptable at onboarding may no longer support the same level of risk.

For that reason, ongoing due diligence sits closer to continuous assurance than to static screening. It is a review process with a lifecycle trigger, not a one-off approval artefact.

What gets reviewed over time

The review scope usually follows the original trust decision, but it is broader than a single document refresh. Organisations look again at identity attributes, beneficial ownership where relevant, operating model changes, sanction or watchlist changes, control evidence, incident history and any material change in the relationship.

In practice, the exact evidence set depends on the risk of the relationship. A low-risk customer may need periodic refresh and monitoring, while a high-risk counterparty may require stronger verification, tighter review cycles and more escalation points.

Useful review inputs include internal monitoring, external intelligence, contract compliance, audit findings and exception tracking. The point is to detect whether the subject still behaves and operates within the expected trust envelope.

This is why the term is commonly used alongside EBA AML/CFT Guidance and similar customer due diligence regimes, because both rely on refreshed evidence rather than a permanent trust decision.

Why ongoing due diligence matters operationally

Its value is in catching drift before it becomes loss, fraud, compliance failure or a security event. A relationship that still looks acceptable on paper may have accumulated new risk through ownership change, weak controls, hidden intermediaries or abnormal behaviour.

That is especially important where access, data handling, payment flows or delegated authority are involved. The wrong assumption is to treat onboarding approval as durable trust; ongoing due diligence exists precisely because trust can decay.

It also gives organisations a consistent way to escalate. When evidence no longer supports the original risk decision, the result should not be silent acceptance. It should drive remediation, tighter terms, restricted activity or exit.

For broader third-party programmes, the same logic appears in Third-Party Risk Management Guide and Vendor Tiering and Inherent Risk Questionnaire Template, where periodic review is tied to tiering, monitoring and re-assessment frequency.

How ongoing due diligence connects to remediation and offboarding

When a review uncovers a material change, the organisation needs a clear response path. That may mean requesting new evidence, changing the risk rating, tightening contract terms, limiting access, increasing monitoring or beginning offboarding if the relationship no longer meets the required threshold.

The offboarding step is important because ongoing due diligence is not only about retention. It is also the mechanism that tells you when a relationship should end, whether because the counterparty no longer qualifies or because the residual risk is no longer acceptable.

Where the subject is a supplier or service provider, this lifecycle view is well captured in Supplier Security Policy Template and Third-Party Risk Management Guide, which both frame due diligence as part of monitoring, incident handling and exit planning.

What strong ongoing due diligence looks like in practice

Strong programmes make the review cadence risk-based, keep evidence current, and define what counts as a material change. They also separate routine refresh from escalation events, so teams know when a standard review is enough and when deeper investigation is required.

It is most effective when ownership is explicit. Someone must be accountable for triggering the review, interpreting the evidence and acting on the result; otherwise due diligence becomes a reporting exercise with no real control effect.

For vendor-heavy environments, practical support often comes from a structured questionnaire and review workflow. Vendor Security Assessment Template and Managed Service Provider Risk Assessment Guide show how repeated evidence requests, monitoring and offboarding decisions can be operationalised without turning the process into a one-time approval only.

Related resources from NHI Mgmt Group

• Why does enhanced due diligence need ongoing monitoring after onboarding?
• What breaks when customer due diligence is treated as a one-time onboarding step instead of an ongoing control?
• Why do UK KYB programmes need both verification steps and ongoing due diligence controls?
• What is the difference between customer due diligence and ongoing monitoring in AML?