Know-Your-Customer (KYC) Periodic Review Process

A know-your-customer (KYC) periodic review is the check a bank runs on a customer it already knows. Are the identity documents still valid? Has the ownership of the company changed? Does the account still behave the way the risk rating given at onboarding assumed? Most of the work is gathering and comparing evidence. The decision at the end, to keep the rating, raise it or leave the relationship, belongs to a compliance analyst.

See AI agents for finance and insurance operations: onboarding files, claims, submissions and reconciliations checked against your systems, with a person on every decision.

This guide sets out what the rules actually require in the United States and the European Union, what triggers a review before its date, and the steps of a review as a checklist.

What a KYC periodic review is, and what it is not

The Financial Action Task Force (FATF), the intergovernmental body that sets the global anti-money laundering standards, asks institutions to apply customer due diligence to existing customers "on the basis of materiality and risk" and to conduct "ongoing due diligence on the business relationship" (FATF Recommendation 10). Its interpretive note is more concrete: documents, data and information collected at onboarding should be kept "up-to-date and relevant by undertaking reviews of existing records, particularly for higher-risk categories of customers."

That places the periodic review between two neighbours. Onboarding builds the file once. Transaction monitoring watches payments as they happen. The periodic review reopens the file and asks whether what the bank knows about the customer is still true.

Perpetual KYC, often written pKYC, is the same review started by events instead of the calendar: a new director in the company registry, an expired passport, a fresh adverse media article. A bank can run both, with events opening a review between scheduled ones.

How often a KYC periodic review must happen

In the United States there is no fixed schedule. The customer due diligence rule of the Financial Crimes Enforcement Network (FinCEN), the US Treasury bureau that enforces the Bank Secrecy Act, requires "appropriate risk-based procedures for conducting ongoing customer due diligence", including, "on a risk basis", to "maintain and update customer information" (31 CFR 1020.210). FinCEN's own answer is direct: "There is no categorical requirement that financial institutions update customer information on a continuous or periodic schedule" (CDD Rule FAQ F.6). Banks may still choose a regular schedule on the basis of risk.

In the European Union the answer changes on 10 July 2027, when the Anti-Money Laundering Regulation (AMLR, Regulation (EU) 2024/1624) starts to apply. Its Article 26(2) caps the time between updates of customer information: it "shall not in any case exceed" 1 year for higher-risk customers under enhanced due diligence, and 5 years for all other customers (AMLR, Articles 26 and 90). The new EU authority, AMLA, is due to issue guidelines on ongoing monitoring by 10 July 2026.

The low, medium and high risk intervals that circulate online come from individual banks' policies, not from a regulation. A bank sets its own tiers and documents why. Once it has, it has to keep to them: an overdue review is a finding even where the law names no date.

What triggers a KYC review before its date

The AMLR lists the events that reopen a file whatever the schedule says. A bank must review and, where relevant, update the customer information when:

• there is a change in the relevant circumstances of the customer;
• it has a legal obligation during the calendar year to contact the customer to review information about its beneficial owners;
• it becomes aware of a relevant fact about the customer.

In practice those are a change of owner or director, a new country or line of business, an expired identity document, a sanctions or adverse media hit, or unusual activity flagged by monitoring.

Beneficial ownership is where US practice moved most recently. FinCEN defines a beneficial owner as each individual who owns 25 percent or more of the equity of a legal entity customer, plus a single individual with significant responsibility to control or manage it (31 CFR 1010.230). Its FAQ states that "periodic reviews are not by themselves a trigger to obtain or update beneficial ownership information." Since 13 February 2026, an exceptive relief order also means banks no longer have to identify and verify beneficial owners "each time the customer opens a new account" (FinCEN). It is still required when a legal entity first opens an account, when the bank has facts that "reasonably call into question the reliability" of what it holds, and wherever its own risk-based procedures require it.

In the EU the 25 percent marker survives: recital 107 of the AMLR says that ownership of "25 % or more of the shares or voting rights or other ownership interest in general establishes the beneficial ownership of a corporate entity."

The steps of a KYC periodic review, as a checklist

1. Pull the file: the onboarding documents, the last review, the current risk rating and every alert since.
2. Check document validity: identity documents and registry extracts that have expired or changed.
3. Screen again: sanctions lists, politically exposed persons and adverse media.
4. Check ownership and control: who owns 25 percent or more and who controls the entity, against the registry.
5. Compare expected and actual activity: products, volumes and countries against the profile.
6. Rate the risk again.
7. Decide: keep the relationship as it is, move it to enhanced due diligence or exit, with the reasons recorded.

Steps 1 to 5 are gathering and comparing. Steps 6 and 7 are judgement. The first five are where the time goes and where a review stalls: a registry extract the client has to send, an adverse media hit that turns out to be a namesake, an ownership chart that no longer matches the registry.

Where review programs break: backlogs and exceptions

In June 2020 the UK Financial Conduct Authority (FCA) fined Commerzbank London £37,805,400 over anti-money laundering failures. Among them, the branch failed to "conduct timely periodic due diligence on its clients": "By 1 March 2017, 1,772 clients were overdue updated due diligence checks." The FCA also described an exceptions process that "was not adequately controlled or overseen and which became 'out of control' by the end of 2016" (FCA).

The lesson is that the rule broken was not a frequency written into a regulation. It was the bank's own schedule, plus a way around it that nobody controlled. A review program fails in the queue, not in the policy document.

What an AI agent can prepare, and what stays with compliance

An AI agent can take steps 1 to 5. It fetches the file and the registry extract, checks expiry dates, runs the screening, compares the ownership chart with the registry and the activity with the profile, and lists every difference with its source. The analyst opens a prepared file instead of a blank one, and makes the rating and the decision. Every step the agent took is logged, so the review can be shown to an examiner as it happened.

That gathering-and-checking half of the work is what Mirage's agents for bank and insurance operations take off onboarding and compliance teams, with every rating and every exit decision left to an analyst. The same split between explaining and deciding applies to reconciliation breaks.

Getting ready for the EU's July 2027 deadline

For a bank in the EU, the useful exercise now is to size the back book. How many higher-risk customers were last reviewed more than a year ago? How many others more than five years ago? How many reviews does the team close in a month? The gap between those numbers is the backlog that 10 July 2027 turns into a breach.