Perpetual KYC and Event-Driven Reviews

Why This Topic Matters

Know Your Customer (KYC) is the foundation of any anti-money laundering (AML) program, but traditional KYC has a weakness: it is static. A customer is onboarded, risk-rated, and then re-reviewed at fixed intervals (for example, every year for high-risk customers, every three years for medium-risk, and every five years for low-risk). Between those dates, the institution may be relying on information that is out of date, incomplete, or simply wrong. Criminals exploit this gap. A customer who appeared low-risk at onboarding may change ownership, move into a high-risk jurisdiction, or begin transacting in ways that are inconsistent with their stated profile, and under a purely periodic model the institution might not notice for years.

Perpetual KYC (often abbreviated pKYC) and event-driven reviews address this gap. They move the institution from a calendar-based approach to a risk-based, continuous approach, which is exactly what regulators such as FATF, the Wolfsberg Group, and national supervisors increasingly expect. For the CAMS exam, this topic sits within the domain covering monitoring, investigation, and technology, and it tests whether you understand how modern compliance programs maintain accurate customer information in real time while allocating resources based on risk.

What Is Perpetual KYC?

Perpetual KYC is an approach to customer due diligence (CDD) in which customer information and risk ratings are continuously updated as new data becomes available, rather than only at scheduled periodic review dates. Instead of asking "Is it time to review this customer?", the institution asks "Has anything changed about this customer that requires action?"

Key characteristics of pKYC include:

• Continuous data ingestion: Information flows into the customer profile from internal systems (transaction monitoring, account changes, relationship managers) and external sources (corporate registries, adverse media feeds, sanctions and PEP lists, beneficial ownership registers).
• Automated change detection: Technology compares incoming data against the existing profile and flags material differences.
• Dynamic risk rating: The customer's risk score is recalculated when relevant attributes change, rather than staying fixed until the next scheduled review.
• Targeted human intervention: Analysts focus on exceptions and material changes rather than conducting full file refreshes on customers whose circumstances have not changed.

Perpetual KYC does not necessarily eliminate periodic reviews entirely. Many institutions use a hybrid model in which pKYC handles ongoing updates and a lighter-touch periodic check serves as a backstop to confirm nothing has been missed.

What Are Event-Driven Reviews?

An event-driven review (also called a trigger-based review or trigger event review) is a customer due diligence review initiated by a specific occurrence, rather than by the passage of time. The event signals that the institution's understanding of the customer may no longer be accurate and that the risk assessment should be revisited.

Common trigger events include:

• Changes in customer information: New address, new country of residence or incorporation, change of legal name, change in nature of business.
• Changes in ownership or control: New beneficial owners, new directors or signatories, mergers, acquisitions, or transfer of shares above a threshold.
• Adverse media: Negative news linking the customer or its associates to crime, corruption, fraud, or regulatory action.
• Sanctions or PEP status changes: The customer or a connected party appears on a sanctions list or becomes a politically exposed person.
• Transactional anomalies: Unusual activity flagged by transaction monitoring, a significant increase in volume or value, activity inconsistent with the expected profile, or new high-risk counterparties or jurisdictions.
• Product or service changes: The customer requests a new, higher-risk product (for example, correspondent banking, private banking, trade finance, or cash-intensive services).
• External requests: A subpoena, law enforcement inquiry, regulatory request, or a request for information from a correspondent bank.
• Internal events: Filing of a suspicious activity report (SAR/STR), an internal investigation, or a relationship manager raising a concern.
• Document expiry: Identification documents or licenses that lapse.

When a trigger fires, the institution decides whether a full review, a targeted review, or simply a data update is appropriate, based on the materiality of the change.

How Perpetual KYC Works in Practice

A typical pKYC framework operates in several interconnected stages:

1. Data Aggregation. The institution builds a single, consolidated view of the customer by connecting internal systems (core banking, onboarding, transaction monitoring, case management) and external data providers. Data quality and entity resolution (confirming that records refer to the same person or company) are critical here; poor data quality is one of the most common reasons pKYC programs fail.

2. Trigger Definition. Compliance defines which events are material and sets thresholds. For example, a change of address within the same low-risk country may only update the record, while a change of address to a high-risk jurisdiction may trigger enhanced due diligence (EDD). Trigger rules should be documented, risk-based, and approved through governance.

3. Monitoring and Detection. Automated tools continuously screen the customer base against the defined triggers. Technologies used include rules engines, name-screening tools, adverse media monitoring with natural language processing, robotic process automation for data retrieval, and machine learning models that detect behavioral changes or prioritize alerts.

4. Assessment and Risk Re-Rating. When a trigger fires, the system or an analyst evaluates its impact. The customer risk rating may increase, decrease, or remain unchanged. A decrease is possible too: pKYC can identify customers whose risk has fallen, allowing the institution to redirect resources.

5. Action and Documentation. Depending on the outcome, the institution may update the profile, request additional documents from the customer, apply EDD, escalate to senior management, file a suspicious activity report, restrict the account, or exit the relationship. Every decision and its rationale must be documented so that the audit trail is clear for regulators and auditors.

6. Feedback and Tuning. Trigger effectiveness is reviewed over time. Triggers that generate excessive false positives are refined; gaps revealed by investigations or regulatory findings lead to new triggers. Model governance and validation apply to any machine learning components.

Periodic Review vs. Perpetual KYC: A Comparison

• Timing: Periodic review happens at fixed intervals based on risk tier; pKYC happens continuously as events occur.
• Resource allocation: Periodic review spends effort on every customer regardless of whether anything changed; pKYC focuses effort on customers with material changes.
• Risk detection: Periodic review may miss changes for months or years; pKYC detects them close to real time.
• Customer experience: Periodic review requires repeated outreach for documents even when nothing has changed; pKYC reduces unnecessary customer contact.
• Technology dependence: Periodic review can be performed manually; pKYC requires integrated data, automation, and strong data governance.
• Regulatory view: Both are acceptable, but regulators increasingly favor approaches that keep CDD information current and are risk-based. Periodic review is still often retained as a backstop.

Benefits of Perpetual KYC and Event-Driven Reviews

• More accurate and current customer risk profiles.
• Faster identification of emerging risk, including sanctions exposure and adverse media.
• Better allocation of analyst time toward genuine risk rather than routine file refreshes.
• Reduced backlog of overdue periodic reviews, a frequent regulatory finding.
• Improved customer experience through fewer redundant document requests.
• Stronger alignment with the risk-based approach promoted by FATF.

Challenges and Risks

• Data quality and integration: Fragmented legacy systems and inconsistent data make it difficult to build a reliable single customer view.
• Trigger calibration: Triggers set too broadly produce alert fatigue; triggers set too narrowly miss real risk.
• Over-reliance on automation: Human judgment is still required for materiality assessments, EDD, and SAR decisions. Automation supports, but does not replace, the compliance function.
• Model risk and explainability: Machine learning components must be validated, documented, and explainable to regulators.
• Regulatory acceptance: Some jurisdictions still expect documented periodic reviews; institutions must confirm the pKYC approach satisfies local requirements and retain evidence of ongoing review.
• Governance: Clear ownership, policies, procedures, and audit trails are necessary; otherwise the program cannot demonstrate effectiveness.
• Privacy and data protection: Continuous collection of external data on customers raises data protection considerations that must be managed.

Relationship to Other AML Program Elements

Perpetual KYC is tightly linked to transaction monitoring: unusual transactions are one of the most important triggers for a review, and updated KYC information in turn improves the accuracy of transaction monitoring expectations. It is also linked to sanctions and PEP screening (list changes are triggers), to enhanced due diligence (high-risk triggers often result in EDD), and to suspicious activity reporting (a review may reveal grounds for a SAR, and a SAR filing may itself trigger a review). Understanding these connections helps you answer scenario-based exam questions that combine multiple program elements.

Exam Tips: Answering Questions on Perpetual KYC and Event-Driven Reviews

Tip 1: Recognize the vocabulary. The exam may use terms such as perpetual KYC, pKYC, continuous KYC, dynamic KYC, ongoing due diligence, trigger-based review, event-driven review, or trigger event. Treat them as pointing to the same core concept: updating customer information and risk ratings in response to changes rather than only on a schedule.

Tip 2: Default to the risk-based approach. When a question asks what an institution should do after a trigger event, the best answer is almost always the one that assesses the materiality of the change and applies a proportionate response, rather than the one that automatically closes the account, automatically files a SAR, or automatically ignores the event. CAMS consistently rewards proportionate, risk-based reasoning.

Tip 3: Identify the trigger in scenario questions. Scenario questions often describe a customer whose circumstances have changed (new beneficial owner, adverse media, relocation to a high-risk country, sudden change in transaction pattern). The question may ask what the most appropriate next step is. Look for the answer that involves reviewing and updating the customer's due diligence and risk rating, and, where the risk is elevated, applying enhanced due diligence.

Tip 4: Do not assume periodic review is obsolete. If a question asks whether pKYC replaces periodic review, remember that many institutions use a hybrid model and that regulators still expect evidence of ongoing review. An answer stating that periodic reviews are "no longer necessary under any circumstances" is usually too absolute.

Tip 5: Remember that automation supports, not replaces, human judgment. Questions on technology frequently test whether you understand the limits of automation. The correct answer typically acknowledges that automated tools detect changes and prioritize work, while trained analysts assess materiality, conduct EDD, and make escalation or reporting decisions.

Tip 6: Watch for data quality as the root cause. If a scenario describes a pKYC program that is producing poor results, excessive false positives, or missed events, the underlying issue is frequently data quality, system integration, or poorly calibrated triggers. Answers that address governance, data remediation, and trigger tuning tend to be correct.

Tip 7: Link to transaction monitoring and SARs. Be prepared for questions that connect event-driven reviews to transaction monitoring alerts or suspicious activity reporting. A transaction monitoring alert can trigger a KYC review; a KYC review can uncover activity that must be reported. Choose answers that reflect this two-way relationship.

Tip 8: Eliminate absolute and extreme answers. Options containing words such as "always," "never," "immediately terminate," or "all customers regardless of risk" are usually distractors. The exam favors nuanced answers that reflect proportionality and documentation.

Tip 9: Remember documentation and audit trail. If an answer option includes documenting the rationale for the decision made after a trigger event, that is a strong indicator it is correct. Regulators assess whether the institution can evidence its reasoning.

Tip 10: Know the benefits and challenges in balance. A question may ask for the primary benefit of pKYC (more current risk profiles and better resource allocation) or the primary challenge (data quality and integration). Be able to articulate both sides.

Sample Exam-Style Question

A bank's monitoring system flags that a long-standing corporate customer, previously rated low-risk, has registered a new beneficial owner who is a resident of a jurisdiction identified by FATF as having strategic AML deficiencies. What is the MOST appropriate action for the compliance team?

A. Immediately close the account to eliminate the risk.
B. Wait until the next scheduled periodic review to update the customer file.
C. Conduct an event-driven review, reassess the customer's risk rating, and apply enhanced due diligence if the risk is elevated.
D. File a suspicious activity report based solely on the change in beneficial ownership.

Correct answer: C. The change in beneficial ownership to a high-risk jurisdiction is a material trigger event. The proportionate, risk-based response is to review the customer, update the risk rating, and apply EDD as warranted. Option A is disproportionate and not risk-based; option B ignores a material change; option D jumps to reporting without establishing suspicion.

Key Takeaways

• Perpetual KYC continuously updates customer information and risk ratings using internal and external data, supported by automation.
• Event-driven reviews are initiated by specific trigger events such as ownership changes, adverse media, sanctions hits, unusual transactions, or new high-risk products.
• The approach is an application of the risk-based approach, concentrating resources where risk has actually changed.
• Periodic reviews are often retained as a backstop in a hybrid model.
• Success depends on data quality, well-calibrated triggers, governance, documentation, and skilled human judgment.
• On the exam, favor proportionate, documented, risk-based responses and avoid absolute or extreme answer choices.