Continuous Monitoring

What Is Continuous Monitoring?

Continuous monitoring is the practice of keeping a customer's risk picture current for the whole life of the relationship, rather than treating due diligence as a one-off exercise at onboarding. It combines the review of transactions as they happen with automatic re-checks of the customer whenever something relevant changes, such as a new sanctions designation, a change in company ownership or the appearance of adverse media.

The term is often used to contrast with purely periodic review. In a periodic model, a high-risk customer might be refreshed every year and a low-risk customer every few years, with little attention in between. In a continuous model, those scheduled reviews still exist, but they are supplemented by event-driven triggers that bring a customer back into review as soon as new information appears.

Why Continuous Monitoring Matters

Customers change. A company that was clean at onboarding may later be acquired by a sanctioned person, a private individual may become a politically exposed person, and an account opened for salary payments may begin receiving funds from dozens of unrelated senders. None of this is visible if the file is only opened again at the next scheduled review.

Continuous monitoring matters for three reasons:

• Sanctions exposure is immediate. A new designation applies from the moment it takes effect. Firms that only rescreen their customer base periodically can process payments for a designated person in the meantime.
• Risk ratings decay. A customer risk rating is only as good as the information behind it. Without updates, the rating gradually stops reflecting reality.
• Suspicion builds over time. Many laundering patterns, such as gradual layering through mule accounts, only become visible when activity is compared against the customer's expected behavior across weeks or months.

How Continuous Monitoring Works

A practical continuous monitoring program usually has four components that feed each other.

Transaction Monitoring

Payments are assessed against rules and behavioral models, in real time or near real time where the product requires it. Typical scenarios look for structuring, rapid movement of funds, unusual counterparties or jurisdictions, and activity inconsistent with the stated purpose of the account.

Rescreening Against Lists

The customer base is screened again when the customer data changes and when sanctions, PEP or watchlist data changes. Delta screening, which compares only new or changed records against the portfolio, keeps this manageable for large books.

Event-Driven Triggers

Defined events bring a customer back into review. Common triggers include:

1. A new or amended sanctions or PEP match
2. Relevant adverse media
3. A change of directors, shareholders or beneficial owners
4. A change of address, nationality or country of operation
5. A transaction monitoring alert that is escalated
6. A request for a new product with higher risk

Risk Rating and Review

Outputs from the other components update the customer risk rating. A higher rating can shorten the review cycle, lead to enhanced due diligence or, in some cases, result in exit. Every decision should record what information was considered and why.

Regulatory Expectations

FATF Recommendation 10 includes ongoing due diligence on the business relationship among the core customer due diligence measures, including scrutiny of transactions to ensure they are consistent with what the institution knows about the customer, and keeping CDD information up to date, particularly for higher-risk customers.

In the European Union, ongoing monitoring is a CDD requirement under the AML Directives, and it is carried forward in the AML Regulation (EU) 2024/1624. In the United Kingdom, the Money Laundering Regulations 2017 require relevant persons to conduct ongoing monitoring of business relationships. In the United States, FinCEN's Customer Due Diligence Rule expects covered financial institutions to conduct ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information.

Sanctions obligations add a further dimension: in most regimes, there is no grace period after a designation, so the obligation not to deal with designated persons applies to existing customers as well as new ones.

Common Challenges

• Alert volume. Rescreening a whole customer base against frequently changing lists can produce large numbers of repeat or low-value alerts. Good matching and suppression of previously cleared matches are essential.
• Stale or incomplete data. Monitoring is limited by the quality of the customer record. Missing dates of birth or ownership data increase false positives and hide true matches.
• Siloed systems. Transaction monitoring, screening and KYC records are often held in separate tools, so a signal in one does not update the others.
• Unclear ownership of triggers. Without defined owners and service levels, event-driven reviews can sit in queues for longer than the periodic reviews they were meant to improve.

How on8.ai Helps

SmartSanction supports ongoing monitoring by rescreening people, companies, vessels and crypto wallets against sanctions, PEP and risk sources through an API or in batch. Its ownership and relationship graph applies the OFAC 50 Percent Rule, so changes in a corporate customer's ownership can be reviewed in context, and each match comes with the reasoning behind it.

Related Terms

• Ongoing Monitoring
• Transaction Monitoring System (TMS)
• Customer Risk Rating (CRR)
• CDD (Customer Due Diligence)
• Lookback Review
• Watchlist