Ongoing monitoring and periodic review are two different controls that teams often merge. Ongoing monitoring is the continuous, event-driven scrutiny of a customer's transactions and profile. A periodic review is the scheduled refresh of due diligence set by the customer's risk rating. One runs all the time; the other runs on a calendar.
FATF Recommendation 10 treats ongoing due diligence as a core part of customer due diligence, not an optional add-on. The two controls answer to the same rule but do different jobs, and an examiner expects to see both working and both evidenced.
This guide is written for heads of AML and reporting officers who want a defensible split between the two, the triggers that should force an off-cycle review, and the record each one has to leave.
What is the difference between ongoing monitoring and a periodic review?
Ongoing monitoring watches behaviour as it happens; a periodic review re-checks the customer's information on a schedule set by risk.
Ongoing monitoring is continuous. It compares each customer's activity against their expected profile and raises an alert when something departs from it. A periodic review is a point-in-time exercise: the team re-verifies identification data, reassesses risk, and confirms the customer's profile is still current. The first is a detection control that produces alerts and cases. The second is a maintenance control that produces an updated record. A programme that performs only one of them has a gap.
FATF Recommendation 10 requires covered persons to conduct ongoing due diligence on the business relationship, including scrutiny of transactions throughout the relationship and keeping CDD information up to date. The two controls are how an institution meets that single requirement in practice.
When should a periodic KYC review happen?
On a frequency set by the customer's risk rating, and sooner whenever a trigger event changes the risk.
Most programmes set a review cycle by risk band: higher-risk customers are reviewed more often than lower-risk ones. The exact intervals are a policy decision that should be justified in the risk assessment, not copied from another institution. What matters for an examiner is that the frequency follows the risk and that the institution can show the schedule was kept. A rating that never changes after onboarding is the classic finding, a point covered in our guide to customer risk rating reviews.
The schedule is only half of it. A risk-based programme also reviews a customer off-cycle when something material changes. Useful triggers include a change in ownership or control, a sanctions or adverse-media hit, a significant change in transaction behaviour, a new product or channel, or a law-enforcement request. When one of these fires, the next scheduled date is no longer the right date, and the review should be brought forward.
What should ongoing monitoring actually monitor?
The customer's activity against the profile captured at onboarding, aggregated over time rather than judged one transaction at a time.
Ongoing monitoring works when the expected profile is specific. If onboarding records the declared purpose, expected activity and source of funds, monitoring has something to compare against. If it records none of these, every rule is tuned against an average and the alerts are noise. The practical measures are familiar: aggregate behaviour over windows, segment thresholds by customer type, and review each rule against closed-case outcomes. These are the core ideas in our transaction monitoring guide, and alert quality itself is an ongoing calibration exercise.
The link back to the review matters. When monitoring shows that a customer's behaviour no longer matches the profile, that is a trigger to review the profile, not only to investigate the transaction. Monitoring that never updates the customer record leaves the next analyst working from stale assumptions. Our note on ongoing CDD sets out why the two have to feed each other.
Is continuous review replacing the periodic cycle?
In part. Event-driven review reduces the reliance on fixed dates, but the scheduled cycle still has a job for customers who generate no triggers.
The direction of travel is toward reviewing customers when something changes, not when a date arrives, an approach our piece on perpetual KYC and the end of periodic reviews describes. The logic is sound: a review prompted by a real change is worth more than one prompted by the calendar.
The caveat is the quiet customer. An account that generates no triggers still ages, and its documentation still goes stale. A mature programme runs both: event-driven review as the primary mechanism, with a backstop cycle so that no customer goes unreviewed indefinitely. The backstop interval can be longer for low-risk customers, but it should exist, and the institution should be able to show why it chose the interval it did.
How do you evidence both controls for an examiner?
Keep a record for each that a reviewer can trace: alerts and dispositions for monitoring, and dated, approved reviews for the cycle.
The two controls leave different evidence, and an examiner tests both. For ongoing monitoring, a reviewer should be able to pick any alert and follow it to its disposition, the reasoning, and the analyst who closed it. For the review cycle, they should be able to pick any customer and see when the last review happened, who approved it, what changed, and when the next one is due. A sensible evidence set contains the following.
- The monitoring rule inventory, with calibration records and change approvals.
- Closed alerts and cases with reasoning, approver and determination date.
- The review schedule by risk band, and the policy basis for each interval.
- Completed reviews with the date, the approver and what was updated.
- A log of off-cycle reviews and the triggers that caused them.
This is also what examiners mean by an effective programme, not just a documented one, a distinction we cover in our guide to independent testing.
How can a lean team keep both running without drowning?
Automate the triggers and the scheduling, and reserve analyst time for the judgement each control still needs.
A team of five to fifteen cannot review every customer by hand on a fixed cycle and also clear the alert queue. Three habits make it manageable. First, let the risk rating drive the schedule automatically, so reviews fall due without someone tracking spreadsheets. Second, wire the triggers, so a sanctions hit or a profile breach raises an off-cycle review on its own. Third, hold the customer's monitoring, cases and reviews in one place, so an analyst opening a case sees the review history and an off-cycle review sees the open cases. Our buyer's guide lists the questions to ask a vendor about both controls.
How does Fyscal ARCX support ongoing monitoring and periodic review?
Fyscal ARCX runs both controls from one record, so monitoring and review inform each other instead of sitting in separate systems. In Transaction Monitoring, a compliance team defines its own variables and rules and tests them against historical data before activation. The Admin Control Center governs the configuration, review hierarchies and the audit trail. Because cases and customer records sit together, an alert that shows a profile has drifted is visible to the next review, and a review that raises the risk rating tightens the monitoring that follows.
If you want to see event-driven review and scheduled review working from the same case record, book a walkthrough of Fyscal ARCX and bring a customer scenario you want to trace from alert to updated profile.