Ongoing Monitoring
Keeping due diligence current after onboarding: reviewing activity against what was expected and re-checking customers as lists and circumstances change.
Definition
Ongoing monitoring is the continuing due diligence a firm carries out on a customer for the life of the relationship. It has two parts that are often run by different teams but serve one purpose.
Scrutiny of activity: checking that transactions and behaviour are consistent with what the firm knows about the customer, its business and its risk profile.
Keeping information up to date: making sure identification data, ownership details, screening results and the risk rating still reflect reality.
Onboarding tells the firm who the customer was on the day it opened the account. Ongoing monitoring is how the firm finds out who the customer is now.
Why a regulated firm cares
Risk changes after onboarding, and most of the change is outside the customer's control or the firm's view. A person is added to a sanctions list. A director becomes a politically exposed person. A company is sold to a new owner. A customer's activity drifts from the profile it described at the start.
None of these is visible to a firm that checked once and stopped. A customer who was acceptable on the day it joined can become a problem later without any change the customer chooses to report. Ongoing monitoring is the control that is meant to catch that change.
How it works in practice
Re-screening. Customers and their related parties (directors, beneficial owners, signatories) are screened again when lists change, not only at onboarding. Sanctions lists can change on any working day, so many firms re-screen their customer base against list updates automatically, with alerts routed to review.
Transaction monitoring. Activity is compared against rules or models built from expected behaviour: unusual volumes, new counterparties or jurisdictions, rapid movement of funds through an account. Alerts are reviewed and either closed with reasons or escalated.
Periodic review. Each customer's file is refreshed on a cycle set by its risk rating. High-risk customers are reviewed more often than low-risk ones. The review checks that documents are current, that ownership has not changed, and that the rating is still right.
Event-driven review. Certain events trigger a review outside the cycle: a screening hit, adverse media, a change of control, a request for a new product, or a suspicious activity report.
Recording the outcome. Each alert, review and decision should be written down with the reason for it, so a reviewer can later see what the firm knew and why it acted as it did.
The two parts feed each other. A transaction pattern can prompt an information refresh, and a change in ownership can change what activity looks normal.
Regulatory basis
- FATF Recommendation 10 includes ongoing due diligence on the business relationship as part of customer due diligence, including scrutiny of transactions and keeping CDD information up to date.
- Directive (EU) 2015/849, amended by Directive (EU) 2018/843, requires ongoing monitoring of business relationships as a CDD measure, applied on a risk-sensitive basis.
- UK Money Laundering Regulations 2017 require firms to conduct ongoing monitoring of business relationships, including transaction scrutiny and keeping documents, data and information up to date.
- US FinCEN CDD Rule: the rule that introduced 31 CFR 1010.230 also made ongoing monitoring, to identify suspicious transactions and to maintain and update customer information on a risk basis, an explicit element of AML programme requirements for covered institutions.
Frequencies and methods are for each firm to set in line with its risk assessment and local requirements. Firms should confirm what applies in their jurisdiction; this is not legal advice.
Worked example
Hypothetically, Tidewell Marine Services Ltd was onboarded two years ago as a medium-risk ship chandler with a scheduled annual review. Its owner and both directors were screened at onboarding with no matches.
In month fourteen, a list update designates a vessel operator. Re-screening does not hit Tidewell itself, but the firm's related-party screening matches the designated operator as a counterparty in three recent payments. An alert is raised.
The analyst reviews the payments, confirms the counterparty match, and escalates. Transaction monitoring had already flagged that Tidewell's volume with new counterparties had doubled over the quarter. The firm brings forward Tidewell's review, asks the customer about the relationship, considers its reporting obligations, and raises the customer to high risk with a shorter review cycle. The file records each step and the reasons for it.
Without ongoing monitoring, none of this would have surfaced until the annual review, if at all.
Related terms
Related Articles
Account Takeover (ATO)
A form of identity theft where a fraudster gains access to a user's bank accounts, email, or other services.
Adverse Media
Adverse media is published information linking a person or company to crime or serious misconduct, screened as part of customer due diligence.
Alert Rules
Configured parameters within AML software that automatically trigger an alert when suspicious activities match defined criteria.
Algorithmic Fraud
Automated and programmatic approaches to attempting financial fraud at scale utilizing bots and specialized software.