Continuous monitoring
Also called ongoing monitoring, perpetual monitoring
Continuous monitoring is the ongoing tracking of customers or third parties for changes in risk, instead of relying only on periodic reviews. Data feeds and alerts flag events such as sanctions listings, adverse media, ownership changes, cyber incidents or financial distress. Each flagged event prompts a review of the relationship.
How it works
For customers, anti-money laundering rules require ongoing monitoring of the business relationship. Firms scrutinise transactions and keep customer information up to date. Many now screen their client base daily against sanctions, PEP and adverse media data, and trigger a review when something changes. This approach is often called perpetual KYC. It replaces fixed review cycles for many lower-risk customers.
For third parties, continuous monitoring tracks suppliers between formal reviews. Firms watch cyber risk ratings, credit scores, news, service performance and regulatory actions. DORA, PRA SS2/21 and the US interagency guidance all expect ongoing oversight of third parties after onboarding. Continuous monitoring allows firms to spot a weakening supplier before it causes an outage or data breach.
The rules
Requires firms to identify and verify customers and beneficial owners, and to conduct ongoing monitoring including scrutiny of transactions throughout the relationship.
UK banks, payment firms, accountants, lawyers and other relevant personsRequires identifying beneficial owners of legal entity customers, understanding the relationship and ongoing monitoring to report suspicious transactions and update customer information.
US banks, broker-dealers, mutual funds, futures commission merchantsRequires ICT third-party risk management, contract terms, a register of information on all ICT providers and exit plans for critical services.
EU banks, insurers, investment firms, payment firms and other financial entitiesDescribes risk management across the third-party life cycle: planning, due diligence, contract negotiation, ongoing monitoring and termination, scaled to risk.
Banking organisations supervised by the Federal Reserve, FDIC and OCCCommon questions
Is continuous monitoring the same as ongoing monitoring?
They are closely linked. Ongoing monitoring is the legal term in AML rules. Continuous monitoring describes the technology-driven way many firms now meet it, using automated feeds and alerts rather than only fixed review dates.
Does continuous monitoring replace periodic reviews?
Not entirely. Many firms use event-driven reviews to extend review cycles for low-risk customers or suppliers. High-risk relationships usually still receive scheduled reviews as well, in line with the firm's risk-based approach.
What data does third-party continuous monitoring use?
Common sources include cyber risk ratings, credit and financial data, sanctions and adverse media screening, service-level performance, incident reports and changes in ownership or subcontractors.
What do EU AML rules require from 2027?
The EU Anti-Money Laundering Regulation, (EU) 2024/1624, applies from 10 July 2027. It sets ongoing monitoring duties directly, including updating customer information at set intervals based on risk.
