Perpetual KYC
pKYCAlso called continuous KYC, event-driven review, dynamic KYC
Perpetual KYC is an approach to customer due diligence in which a firm updates customer records when something changes, rather than waiting for a scheduled periodic review. Data feeds and triggers flag events such as new owners, sanctions designations or unusual activity, prompting a targeted review of that customer.
How it works
A bank running perpetual KYC links customer files to external and internal data. Company registry changes, sanctions and PEP list updates, adverse media and transaction behaviour all act as triggers. When a trigger fires, the system refreshes the risk rating and routes the case to an analyst if needed. Low-risk customers with no events may see fewer manual reviews.
The approach matters because periodic reviews leave files out of date for years between cycles. AML rules require ongoing monitoring and keeping CDD information current, without prescribing a calendar. Event-driven updates let firms show supervisors that risk ratings reflect the customer today. The shift depends on data quality, clear trigger definitions and audit trails showing why each review happened.
The rules
Requires ongoing monitoring of business relationships, including keeping customer due diligence documents, data and information up to date.
Relevant persons under the MLRsRequires ongoing monitoring to identify suspicious transactions and, on a risk basis, to maintain and update customer information.
Banks and other covered financial institutionsRequires ongoing monitoring of business relationships and updating of customer information, with reviews at frequencies linked to the customer's risk.
Obliged entities in the EUCommon questions
Do regulators require perpetual KYC?
No rule names perpetual KYC. AML rules require ongoing monitoring and up-to-date customer information. Perpetual KYC is one way firms meet that requirement, using event triggers instead of relying only on fixed review cycles.
Does perpetual KYC remove periodic reviews?
Not entirely. Many firms keep periodic reviews for high-risk customers or as a backstop. Event-driven updates reduce the number of reviews that find nothing new and focus analyst time on customers whose circumstances have changed.
What events typically trigger a pKYC review?
Common triggers include changes in ownership or directors at a company registry, new sanctions or PEP matches, adverse media, and transaction activity that departs from the expected profile. Each firm sets its own triggers through its risk assessment.
