What a KYC refresh cycle is, and what triggers one early

Regulation 28(11) of the Money Laundering Regulations 2017 requires ongoing monitoring of a business relationship, including reviewing existing records and keeping customer due diligence documents and information up to date.

Regulation 27(8) requires due diligence to be applied to existing customers at other appropriate times on a risk based approach, and when the firm becomes aware that circumstances relevant to its risk assessment of the customer have changed. The FCA describes the Regulations as setting a risk based approach to anti money laundering.

Because the Regulations do not fix a period, firms set their own in their policies, usually tied to the risk rating given at the last review. For example, a firm might review high risk customers every year, medium risk every two or three years and low risk less often. These are common choices, not legal requirements.

What matters is that the interval is written down, applied consistently and recorded on each customer, so that a missed review can be seen.

Regulation 27(9) lists matters a firm must take into account in deciding when to review an existing customer, among others: any sign that the identity of the customer or its beneficial owner has changed, transactions not reasonably consistent with what the firm knows of the customer, and any change in the purpose or intended nature of the relationship.

In practice, common triggers include a change of ownership or directors, a new jurisdiction in the structure, an unexpected payment pattern and a new screening match. Each should start a review whatever the calendar says.

In Alethia, each KYC decision can set the next review date, either from a review interval your workspace has adopted for the risk rating or by choosing a date. The entity shows when its next review is due or overdue, and a refresh can be opened as a new case for a relationship you already have.