Most Know Your Customer (KYC) programs rely on a static snapshot. You gather customer data during onboarding, create a risk profile, assign a rating, and move on. This information remains unchanged until the next scheduled review, often 12, 24, or 36 months later. Meanwhile, your customer's business model may change, their beneficial ownership may shift, and their transaction patterns may evolve. Your compliance team is left managing risk with outdated information.
This checklist will help you audit your current KYC framework and identify where you're still relying on outdated data instead of maintaining continuous visibility.
Prerequisites
Before starting this audit, gather:
- Your written Customer Due Diligence (CDD) procedures, including periodic review schedules
- A sample of 10-15 customer files across different risk tiers
- Access to your core banking system, CRM, and any third-party data providers
- Your most recent regulatory examination report or internal audit findings related to CDD
- Documentation of your current data refresh triggers, if any
You'll also need input from frontline staff who conduct periodic reviews and relationship managers who interact with customers regularly.
Checklist Items
1. Data Capture Triggers Beyond Onboarding
Does your system automatically capture material changes to customer information outside of scheduled reviews?
Check for automated feeds or alerts that flag:
- Adverse media hits mentioning your customer or their beneficial owners
- Changes in corporate registry data (directors, shareholders, registered addresses)
- Sanctions list updates affecting existing customers
- Significant deviations from expected transaction patterns
- Public filings indicating mergers, acquisitions, or restructuring
Effective practice: Your compliance team receives alerts within 24-48 hours of a material change. You have documented data sources and refresh frequencies for each trigger category.
2. Risk Rating Recalibration Process
Can you adjust a customer's risk rating between periodic reviews when circumstances change?
Verify that you have:
- Written authority and procedures for interim risk rating changes
- Clear criteria defining what constitutes a material change requiring recalibration
- A workflow that doesn't require waiting for the annual review cycle
- Documentation requirements for interim rating adjustments
Effective practice: You've recalibrated at least some customer risk ratings mid-cycle in the past 12 months, with documented rationale. Your procedure explicitly permits this, and staff know how to initiate it.
3. Transaction Monitoring Integration
Does unusual activity detected by your transaction monitoring system feed back into customer risk profiles?
Examine whether:
- Alert dispositions (including false positives showing pattern changes) update the customer file
- Escalated cases trigger a CDD refresh, not just an investigation
- Geographic or product risk signals from monitoring inform risk rating
- Volume and velocity trends are visible to the team conducting periodic reviews
Effective practice: When you review a customer file, you can see a summary of monitoring alerts from the past 12 months, even if none resulted in a Suspicious Activity Report (SAR). Your transaction monitoring and CDD systems share data bidirectionally.
4. Beneficial Ownership Monitoring
How do you detect changes in beneficial ownership after initial identification?
Check for:
- Subscriptions to corporate registry monitoring services
- Contractual obligations requiring customers to notify you of ownership changes
- Periodic re-verification of beneficial owners, not just legal entity details
- Processes to identify beneficial owners of newly added authorized signers or controllers
Effective practice: You've identified at least one beneficial ownership change through monitoring (not customer self-reporting) in the past year. You have evidence that you verified the new beneficial owner's identity within a reasonable timeframe.
5. Regulatory Expectation Documentation
Have you mapped your CDD procedures to specific ongoing due diligence requirements?
Review whether your procedures reference:
- FATF Recommendation 10 requiring ongoing due diligence on the business relationship
- FinCEN's Customer Due Diligence Rule (31 CFR 1010.230) requiring institutions to "conduct ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information"
- Your primary regulator's examination manual guidance on CDD frequency and triggers
- Any jurisdiction-specific continuous monitoring requirements
Effective practice: Your CDD policy explicitly cites regulatory expectations for ongoing due diligence and defines what "ongoing" means in operational terms, not just "periodic reviews."
6. Enhanced Due Diligence Refresh Frequency
Are your highest-risk customers reviewed more frequently than standard risk customers?
Verify that:
- High-risk customer reviews occur at least annually; many regulators expect more frequent reviews
- You have a documented rationale for Enhanced Due Diligence (EDD) review frequency
- Complex or high-risk relationships have interim touchpoints between formal reviews
- Politically Exposed Person (PEP) status triggers more frequent monitoring of beneficial ownership and source of wealth
Effective practice: Your EDD customers are reviewed at intervals shorter than your standard periodic review cycle, with documented justification for the frequency. You can demonstrate that review timing reflects actual risk, not just administrative convenience.
7. Data Quality and Completeness Metrics
Can you measure how current your customer data is across your portfolio?
Assess whether you track:
- Percentage of customer files with data older than 12, 24, or 36 months
- Completeness rates for key data elements (beneficial ownership, source of funds, expected activity)
- Time lag between a triggering event and CDD update
- Staff capacity to complete triggered updates within target timeframes
Effective practice: You produce a monthly or quarterly dashboard showing data age and completeness. You've identified specific data elements or customer segments where staleness is a problem, and you have a remediation plan.
Common Mistakes
Treating periodic reviews as the only refresh mechanism. Waiting 12 or 24 months to update a customer file means you're managing yesterday's risk. If a customer's transaction patterns change materially in month three, your controls are blind for the next nine to 21 months.
Confusing transaction monitoring with ongoing due diligence. Transaction monitoring detects anomalies. Ongoing due diligence maintains an accurate understanding of who your customer is and what they should be doing. They're complementary, not interchangeable.
Implementing technology without changing processes. Buying a continuous monitoring tool doesn't create dynamic KYC if your procedures still require staff to wait for the annual review to act on the alerts. The workflow has to change, not just the data feed.
Failing to document interim updates. If you refresh CDD data mid-cycle but don't update the formal customer file, examiners will see only the outdated annual review. Document every material update, even if it's not a full periodic review.
Next Steps
If you checked fewer than five items as complete, your KYC program is still primarily point-in-time. Start by implementing one continuous data feed, like adverse media or corporate registry monitoring, and building a workflow to act on it within 30 days.
If you checked five or six items, you're in transition. Focus on integrating your data sources so that transaction monitoring, adverse media, and customer file updates inform each other automatically.
If you checked all seven, audit whether your "continuous" processes are actually being used. Pull a sample of customers who should have triggered an interim update in the past six months and verify that the update occurred and was documented. Good procedures on paper don't equal effective risk management in practice.
