Periodic KYC Reviews: Setting Refresh Cycles by Customer Risk Level

Onboarding checks capture a customer at a single point in time. Within a few years, the information can be badly out of date: the company has new owners, the individual has changed jobs, the business has moved into a new market. Periodic KYC reviews exist to close that gap — and overdue reviews are one of the most frequent findings in AML inspections.

This guide covers what the rules require, how to set review frequencies by customer risk, what a review should actually involve, and how to keep the backlog under control.

What the rules require

FATF Recommendation 10 requires ongoing due diligence on business relationships. That includes ensuring that documents, data and information collected under CDD are kept up to date and relevant, by reviewing existing records — particularly for higher-risk customers.

Most national regimes adopt the same principle without setting fixed intervals. Instead, they expect firms to:

set review frequencies in their own policies, based on risk;
review customers when relevant circumstances change, not just on a schedule; and
actually complete reviews on time and document them.

That last point is where most firms struggle. Supervisors rarely criticise a firm for choosing a three-year cycle for low-risk customers. They frequently criticise firms whose policy says three years when a large share of files haven't been touched in six.

Setting review frequencies by risk

A common industry pattern looks like this:

Customer risk rating	Common review interval
High	Every 12 months, or more often for the highest-risk relationships
Medium	Every 2–3 years
Low	Every 3–5 years

These are typical practice, not legal requirements in most jurisdictions. That is changing in the EU: the new Anti-Money Laundering Regulation, which applies from 10 July 2027, requires customer information to be updated at least annually for higher-risk customers and at least every five years for all others. Whatever intervals you choose, you should:

Justify them in your policy by reference to your business-wide risk assessment.
Apply them consistently. The review date should be calculated automatically from the risk rating and the last review date, not set by hand.
Reset the clock correctly. If a customer's rating changes, the next review date should change with it.
Be realistic. A policy that requires annual reviews of every medium-risk customer, with no resources to deliver it, will create a backlog on day one.

Trigger-based reviews

Scheduled reviews alone aren't enough. A customer whose circumstances change materially shouldn't wait three years for their next review. Define trigger events in your policy, such as:

a change in ownership, control or directors;
unusual transaction activity or a pattern inconsistent with the customer's profile;
a new product, or activity in a new country;
relevant adverse media;
a potential sanctions or PEP match;
an internal suspicious activity report; or
documents expiring or information found to be inaccurate.

A trigger review can bring forward the scheduled date, and its outcome should feed back into the customer's risk rating.

What a periodic review should involve

A periodic review is not just re-collecting an expired passport. It is a check that what you know about the customer is still accurate and that the relationship still makes sense.

Refresh identification and verification where documents have expired or information has changed.
Re-confirm beneficial ownership and control. Ownership structures change more often than any other element of a corporate customer's profile.
Re-screen against sanctions, PEP and adverse media sources.
Compare expected and actual activity. Is the customer using the account the way they said they would at onboarding? If not, is there a credible explanation?
Reassess the risk rating based on what you have found.
Apply enhanced measures if the customer is now higher risk — see CDD vs EDD for what that involves.
Document the conclusion — including the decision to continue, restrict or exit the relationship — and set the next review date.

Managing the backlog

Almost every firm has an overdue review backlog at some point. What matters is that you know its size, manage it actively and can show a supervisor a credible plan.

Measure it. Report overdue reviews by risk rating to senior management every month. An overdue review on a high-risk customer is a much bigger problem than one on a low-risk customer.
Prioritise by risk. Clear high-risk overdue reviews first.
Have an escalation path. Define what happens when a customer doesn't respond — reminders, restrictions, and ultimately exit.
Don't let remediation become permanent. A one-off remediation project that clears the backlog without fixing the process will be followed by the same backlog two years later.

Perpetual KYC

Some firms are moving from fixed cycles to "perpetual KYC" (pKYC): continuously monitoring data sources such as company registries, screening results and transaction behaviour, and triggering a review only when something changes. Done well, it can reduce workload on stable low-risk customers and catch changes faster on everyone else.

It isn't a shortcut, though. Most supervisors still expect a firm to be able to show when each customer was last reviewed and why. If you adopt pKYC, document the methodology, the data sources and the controls that ensure customers without triggers are still reviewed periodically.

Don't forget firm-level deadlines

Customer reviews are tracked customer by customer, in your onboarding or case management system. But the obligations that sit around them — the monthly backlog report to senior management, the annual review of the KYC policy itself, the yearly AML compliance calendar — are firm-level deadlines that are just as easy to miss. A deadline tool like Regmindr can track those recurring tasks, assign owners and send reminders before they fall due.

Key takeaways

Ongoing due diligence requires keeping customer information up to date, particularly for higher-risk customers.
Set review intervals by risk in your policy — commonly annual for high risk, 2–3 years for medium and 3–5 years for low.
Combine scheduled reviews with defined trigger events.
A review should re-check identity, ownership, screening and activity, and reassess the risk rating.
Measure the overdue backlog monthly, prioritise by risk and fix the process, not just the backlog.

Periodic reviews are one part of a risk-based AML program. Regpin helps compliance teams manage customer risk ratings and the program behind them — book a demo to see how.

This article is general information, not legal advice. AML obligations vary by jurisdiction, sector and firm, so confirm the specific requirements that apply to you with your supervisor's guidance or a qualified adviser.