The frequency of conducting a Know Your Customer (KYC) data review depends on several factors, including regulatory requirements, the nature of the business relationship, and the customer’s risk profile. KYC is a core part of anti-money laundering (AML) and counter-terrorist financing controls, ensuring businesses can identify and verify who they are dealing with.
Regulators typically set expectations around review frequency, but most frameworks are risk-based. That means higher-risk customers require more frequent and more detailed reviews, while lower-risk customers are reviewed less often.
In practice, KYC is carried out at onboarding and then refreshed periodically. A common baseline is annual review cycles, but higher-risk relationships may be reviewed more frequently, while lower-risk customers may fall into longer review intervals.
KYC should not rely solely on scheduled reviews. If there is a material change in a customer’s behaviour, ownership structure, transaction patterns, or risk indicators, an immediate review is required to ensure records remain accurate and risk exposure is understood.
What does a KYC check involve?
The exact process varies by jurisdiction and sector, but a standard KYC workflow includes the following components:
- Customer identification: Collecting core identity data such as full name, date of birth, address, and official identification (e.g. passport, driving licence, or national ID).
- Identity verification: Validating that information using reliable and independent sources, including public records, government databases, or electronic identity verification services.
- Risk assessment: Assigning a risk profile based on factors such as geography, industry, transaction behaviour, and ownership structure. This determines the level of scrutiny required.
- Customer due diligence (CDD): Building a deeper understanding of the customer’s background, source of funds, and purpose of the relationship. This step becomes more extensive for higher-risk customers.
- Ongoing monitoring: Continuously reviewing customer activity to identify unusual behaviour or emerging risk, and updating customer data as needed.
- Sanctions screening: Checking customers against sanctions lists to ensure they are not restricted or prohibited entities.
- PEP screening: Identifying whether the customer is a politically exposed person, or connected to one, which requires enhanced due diligence.
- Record keeping: Maintaining clear, complete records of all checks, decisions, and supporting data for audit and regulatory purposes.
KYC is not a one-off control. It is an ongoing process that requires periodic review, continuous monitoring, and escalation when risk indicators change.
The correct approach is systematic and risk-based. Firms that treat KYC as a static onboarding task are the ones that get caught out. Regulators expect evidence that customer risk is understood, reviewed, and actively managed over time.
