Periodic KYC Refresh and Risk-Based Prioritisation

1. Why This Topic Matters

Know Your Customer (KYC) is not a one-time event performed at onboarding. Customers change: ownership structures shift, business activities expand into new jurisdictions, individuals become politically exposed persons (PEPs), and transaction behaviour evolves. If a financial institution only verified a customer once and never looked again, its understanding of that customer would quickly become stale and its risk rating would be inaccurate. Stale KYC data leads directly to weak transaction monitoring (because expected activity is wrong), missed sanctions and PEP hits, inaccurate risk scoring, and ultimately regulatory penalties.

The CAMS exam tests this topic because it sits at the intersection of several core AML pillars: Customer Due Diligence (CDD), the Risk-Based Approach (RBA), ongoing monitoring, and governance. Regulators worldwide (FATF, FinCEN, the European Banking Authority, the UK FCA, MAS, HKMA, AUSTRAC and others) consistently cite 'failure to keep customer information current' as a root cause in enforcement actions. For the exam, you must understand why refresh is required, how the frequency is determined, what triggers an out-of-cycle review, and how an institution should prioritise limited resources when backlogs arise.

2. What Is Periodic KYC Refresh?

Periodic KYC refresh (also called periodic review, KYC renewal, or ongoing due diligence) is the scheduled, systematic process of re-examining and updating a customer's due diligence file at defined intervals to confirm that:

- Identification and verification information is still accurate and current.
- Beneficial ownership and control information is complete and up to date.
- The nature and purpose of the relationship still match what was documented.
- The customer's actual transaction activity is consistent with the expected activity profile.
- Screening results (sanctions, PEP, adverse media) have been refreshed.
- The customer risk rating remains appropriate, or is adjusted up or down.

It is distinct from, but complementary to, event-driven (trigger-based) review, which occurs outside the normal cycle when a specific event signals that the customer's risk profile may have changed.

Key regulatory anchors:
- FATF Recommendation 10 requires ongoing due diligence, including scrutiny of transactions and ensuring documents, data and information are kept up to date and relevant, particularly for higher-risk categories.
- FinCEN CDD Rule (2016, the Fifth Pillar) requires covered US institutions to conduct ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information, including beneficial ownership. Note: the US rule is primarily event-driven; it does not mandate a fixed calendar cycle, though many institutions adopt one as best practice.
- EU Anti-Money Laundering Directives (4AMLD/5AMLD/6AMLD and the new AML Regulation) require obliged entities to keep documents, data and information up to date, and to apply CDD to existing customers on a risk-sensitive basis at appropriate times.
- Wolfsberg Group guidance and the Basel Committee's 'Sound management of risks related to money laundering and financing of terrorism' both emphasise that customer information must remain current and that the intensity of ongoing review should be proportionate to risk.

3. What Is Risk-Based Prioritisation?

The risk-based approach (RBA) is the foundation of modern AML. Instead of applying identical controls to every customer, institutions identify, assess and understand their ML/TF risks and allocate resources where risk is highest. Applied to KYC refresh, this means:

- Frequency is tiered by risk rating. High-risk customers are reviewed most often; low-risk customers least often.
- Depth is tiered by risk rating. High-risk reviews involve Enhanced Due Diligence (EDD): source of wealth, source of funds, senior management approval, deeper beneficial ownership analysis and more extensive adverse media research. Low-risk reviews may rely on Simplified Due Diligence (SDD) and automated data confirmation.
- Backlogs are worked in risk order. When an institution cannot complete all reviews on time, it must prioritise the highest-risk and overdue-longest files first, rather than clearing easy low-risk files to improve statistics.

4. How It Works in Practice

Step 1: Assign the risk rating at onboarding.
The Customer Risk Rating (CRR) is derived from a risk model weighing factors such as customer type (individual, corporate, trust, correspondent bank, MSB), geography (country of residence, incorporation, operation), products and services used (cash-intensive, private banking, trade finance, correspondent banking), delivery channel (face-to-face vs non-face-to-face), PEP status, industry, ownership complexity and transaction expectations. The output is typically a tier: Low, Medium (Standard), High, and sometimes Very High or Restricted.

Step 2: Set the review cycle according to the tier.
Typical industry cycles (these are common practice, not universal law, and the exam will usually describe them as illustrative):
- High risk: annually (every 12 months), sometimes more frequently (6 months) for the very highest risk such as foreign PEPs or correspondent banking relationships in high-risk jurisdictions.
- Medium risk: every 2 to 3 years.
- Low risk: every 3 to 5 years, with some institutions moving to indefinite cycles supported by trigger monitoring and data feeds.

Step 3: Monitor for trigger events between cycles.
Common trigger events that should prompt an immediate, out-of-cycle review include:
- Change in beneficial ownership, directors or controllers.
- Customer or beneficial owner becomes a PEP, or appears on a sanctions list or in negative news.
- Significant unexplained change in transaction volume, value, pattern or counterparties.
- Filing of a Suspicious Activity Report / Suspicious Transaction Report on the customer.
- Request for a new high-risk product (e.g. private banking, trade finance, cash services).
- Change of registered address or operating jurisdiction, particularly to a high-risk or FATF grey/black-listed country.
- Receipt of a law enforcement request, subpoena, or Section 314(a)-style enquiry.
- Change in corporate structure, merger, acquisition, or change of legal form.
- Returned mail, dormant account reactivation, or failed verification data.
- Internal audit, regulatory examination or quality assurance findings relating to the file.

Step 4: Perform the review.
A thorough refresh includes:
- Re-collecting and verifying identity documents where expired or where the regulatory regime requires re-verification.
- Confirming or updating beneficial ownership (commonly the 25% threshold, or 10% in some regimes or for higher risk, plus the control prong).
- Comparing actual activity over the review period against the documented expected activity and investigating material variances.
- Re-running sanctions, PEP and adverse media screening on the customer, beneficial owners, directors and authorised signatories.
- Reassessing the risk rating and documenting the rationale for any change.
- Obtaining appropriate approvals: higher-risk customers typically require senior management or compliance sign-off to continue the relationship.
- Recording the outcome: retain, retain with enhanced monitoring, restrict products, or exit (de-risk) the relationship.

Step 5: Escalate and act on findings.
If the review uncovers suspicious activity, the matter should be escalated to the Financial Intelligence Unit (FIU) reporting process. If the customer refuses to provide information or verification cannot be completed, FATF Recommendation 10 directs that the institution should not open the account or should terminate the relationship, and should consider filing a suspicious transaction report. Many institutions apply account restrictions (blocks on new products or outgoing payments) when a periodic review becomes significantly overdue because the customer has not responded.

Step 6: Govern the programme.
Effective governance includes management information (MI) on reviews due, completed, overdue and ageing; key risk indicators (KRIs) with thresholds; quality assurance sampling; independent testing by internal audit; and board or committee reporting. Overdue high-risk reviews are a red flag regulators look for immediately.

5. Managing Backlogs and Prioritisation

Backlogs arise from mergers, system migrations, regulatory change (e.g. a new beneficial ownership rule applied to legacy customers), under-resourcing or poor data. When a backlog exists, the exam expects you to know the correct prioritisation logic:

1. Highest risk first. Overdue high-risk customers (PEPs, correspondent banks, high-risk jurisdictions, cash-intensive businesses) are addressed before medium and low.
2. Longest overdue within a tier next. Age of the overdue review is a secondary sort key.
3. Customers with open alerts, SARs or adverse media move to the front regardless of nominal tier.
4. Interim mitigants are applied while the backlog is cleared: enhanced transaction monitoring, lowered alert thresholds, product restrictions, or temporary account blocks for non-responsive customers.
5. Transparency with regulators. A documented remediation plan with milestones, resourcing and senior management ownership is expected; concealing a backlog is far worse than disclosing it.

What not to do (common wrong answers): clearing low-risk files first to improve completion percentages; rubber-stamping reviews without substantive analysis; extending review cycles across the board purely to eliminate the backlog on paper; or treating the refresh as a documentation exercise divorced from transaction analysis.

6. The Shift to Perpetual KYC (pKYC) and Technology

Because this concept sits in the 'Monitoring, Investigation and AI Technology' domain, be ready for questions linking refresh to technology:

- Perpetual or continuous KYC replaces or supplements fixed cycles with real-time monitoring of data sources (corporate registries, screening lists, news feeds, internal transaction data). A material change automatically creates a review task. The benefit is that risk changes are caught when they occur rather than months later; the challenge is data quality, false positives and demonstrating to regulators that the control is at least as robust as the periodic cycle.
- Dynamic risk rating uses transaction behaviour and external data to recalculate the CRR continuously, which in turn adjusts review frequency.
- Machine learning and AI can prioritise review queues by predicted risk, extract data from documents (OCR and natural language processing), suppress low-value adverse media hits, and flag anomalies against peer groups. Examiners expect model governance: explainability, validation, bias testing and human oversight. AI assists analysts; it does not remove accountability.
- Data quality is the foundation. Poor customer reference data (missing dates of birth, inconsistent names, unlinked related parties) undermines both screening and risk rating. Many remediation programmes are fundamentally data remediation programmes.
- Digital identity and e-KYC tools can streamline re-verification for low-risk customers, reserving analyst time for high-risk, judgement-based work.

7. Typical Exam Scenarios

Scenario A: A low-risk retail customer suddenly begins receiving large international wires from a high-risk jurisdiction. Correct response: this is a trigger event; initiate an out-of-cycle review and reassess risk rating, rather than waiting for the scheduled low-risk cycle.

Scenario B: A bank has 5,000 overdue reviews. Management proposes completing the 3,000 low-risk ones first because they are quick. Correct response: prioritise by risk, address high-risk overdue files first, apply interim controls, and document a remediation plan.

Scenario C: During a periodic review, a corporate customer's beneficial owner is found to be a foreign PEP. Correct response: escalate for EDD, establish source of wealth and funds, obtain senior management approval to continue, upgrade the risk rating and increase monitoring. Being a PEP is not itself grounds to exit, but it mandates EDD.

Scenario D: A customer refuses to provide updated beneficial ownership information after repeated requests. Correct response: consider restricting the account, consider exiting the relationship, and evaluate whether a suspicious activity report is warranted. Do not simply mark the review complete.

Scenario E: An institution wants to move to perpetual KYC and eliminate fixed cycles. Correct response: acceptable under a risk-based approach if the trigger framework, data feeds and governance are demonstrably robust, validated and documented; high-risk customers typically still receive a minimum periodic human review.

8. Exam Tips: Answering Questions on Periodic KYC Refresh and Risk-Based Prioritisation

Tip 1: Always think 'risk-based' first. If an answer option applies the same treatment to all customers regardless of risk, it is almost always wrong. CAMS consistently rewards proportionality.

Tip 2: Distinguish periodic from event-driven. Read the question stem carefully. If a specific change or red flag is described, the expected answer involves an immediate, trigger-based review, not waiting for the next scheduled cycle.

Tip 3: Higher risk means more frequent and deeper. When asked how refresh should differ for high-risk customers, the answer combines shorter intervals, EDD measures (source of wealth and funds, senior management approval) and more intensive monitoring.

Tip 4: Remember that refresh is more than documents. The best answer usually involves comparing actual transaction activity against the expected profile and re-running screening, not merely obtaining a new copy of a passport.

Tip 5: Know the regulatory nuances. FATF Recommendation 10 requires ongoing due diligence and keeping information current, especially for higher-risk categories. The US CDD Rule is event-driven on beneficial ownership updates rather than mandating a fixed cycle. EU directives require risk-sensitive updating at appropriate times. If a question says 'the regulation requires an annual review of all customers,' be suspicious; most regimes do not prescribe one universal interval.

Tip 6: Backlog questions test priorities and integrity. Choose answers that prioritise high-risk and overdue-longest files, impose interim mitigants, resource appropriately, and report transparently to senior management and regulators. Reject answers that game metrics or simply lengthen cycles.

Tip 7: Non-cooperation has consequences. When a customer will not provide required information, the right answer involves restriction, exit consideration and SAR consideration. Never choose 'close the review and proceed as normal.'

Tip 8: PEP discovery equals EDD, not automatic exit. A frequent distractor is 'immediately close the account.' The correct response is to apply EDD, obtain senior approval and increase monitoring; exit is a decision following that analysis, not a reflex.

Tip 9: Link to the other pillars. The exam loves integration. Refresh results feed the enterprise-wide risk assessment, calibrate transaction monitoring scenarios, inform training, and are tested by independent audit. Answers that connect KYC refresh to monitoring and reporting tend to be stronger than isolated ones.

Tip 10: Technology answers still require governance. If a question involves AI-driven or perpetual KYC, the best answer acknowledges benefits (timeliness, efficiency, prioritisation) while insisting on model validation, explainability, data quality controls and human oversight. Technology never eliminates the institution's accountability.

Tip 11: Use the 'best available option' mindset. CAMS questions often present several reasonable-sounding actions. Pick the one that is most proportionate, most compliant with FATF principles, and most defensible to a regulator. Ask yourself: what would a prudent compliance officer document and defend in an examination?

Tip 12: Watch for absolute language. Words such as 'always', 'never', 'all customers' and 'regardless of risk' in an answer option are frequently signals of a distractor in a risk-based framework.

9. Quick Revision Summary

- KYC is ongoing; information must be kept current and relevant (FATF R.10).
- Periodic refresh is scheduled; trigger review is event-driven. Both are needed.
- Frequency and depth are proportionate to customer risk: high risk roughly annually with EDD; medium every 2 to 3 years; low every 3 to 5 years or trigger-based.
- Common triggers: ownership change, PEP or sanctions hit, adverse media, SAR filing, unusual activity, new high-risk product, jurisdiction change, law enforcement enquiry.
- A full refresh covers identity, beneficial ownership, purpose of relationship, expected versus actual activity, screening and risk re-rating, with appropriate approvals.
- Backlogs must be prioritised by risk and age, with interim mitigants and a transparent remediation plan.
- Non-cooperative customers may face restriction, exit and SAR consideration.
- Perpetual KYC and AI improve timeliness but require data quality, validation and human oversight.
- On the exam: choose proportionate, risk-based, well-governed, integrated answers and avoid absolutes.