Periodic review
Also called KYC refresh, KYC review, customer due diligence refresh
A periodic review is a scheduled refresh of a customer's due diligence file. The firm checks that identity, ownership, risk rating and expected activity are still accurate. Higher-risk customers are reviewed more often, typically every year, while lower-risk customers may be reviewed every three to five years.
How it works
Each customer gets a review date set by its risk rating. When the date arrives, the file goes to a queue where analysts re-screen names against sanctions, PEP and adverse media lists. They confirm ownership and control, compare actual activity with the stated purpose of the account and request updated documents where needed. The customer is then re-rated and the next review date is set.
Periodic review sits alongside event-driven review, which is triggered by changes such as a new director or unusual transactions. Backlogs of overdue reviews are a common finding in regulatory inspections. Many firms are moving towards perpetual KYC, where data feeds update files continuously and reduce the need for large fixed-cycle review programmes.
The rules
Requires customer due diligence on existing customers at other appropriate times on a risk-based approach, including when circumstances change.
Firms in the UK regulated sectorRequires customer information updates based on risk, at least every year for higher-risk customers and every five years for others.
Obliged entities across the EURequires ongoing monitoring and, on a risk basis, maintaining and updating customer information, including beneficial ownership.
Banks, broker-dealers, mutual funds and futures firmsCommon questions
How often should a periodic review happen?
Frequency follows risk. A common pattern is annual reviews for high-risk customers and three or five years for medium and low risk. From July 2027 the EU AML regulation sets one year and five years as the outer limits.
What is the difference between periodic and event-driven review?
A periodic review happens on a set date. An event-driven review is triggered by a change, such as new ownership, adverse media or activity that does not fit the customer profile.
What happens if a customer does not respond?
Firm policies usually set escalation steps, such as reminders and account restrictions. Under UK rules, a firm unable to apply due diligence must not carry out transactions, must end an existing relationship and must consider making a suspicious activity report.
Is perpetual KYC replacing periodic review?
Partly. Perpetual KYC refreshes data when triggers fire, which can extend or replace fixed cycles. Most firms still keep scheduled reviews for high-risk customers as a backstop.
