Customer due diligence should not end when an account is opened. Names change, ownership structures evolve, risk ratings become stale and customer behaviour can diverge from the profile established at onboarding.
Japan's AML/CFT framework places continuing emphasis on risk-based customer management and the effectiveness of controls. For enterprise teams, the operational question is how to convert that expectation into a review model that updates the right customers at the right time without creating unnecessary manual work.
Use two review mechanisms, not one
An effective ongoing CDD model combines scheduled review with event-driven review.
Scheduled reviews provide a predictable control. Customers can be placed on different review cycles according to risk. Higher-risk relationships may warrant more frequent refreshes, while lower-risk customers can follow a longer cycle if that is consistent with the institution's methodology.
Event-driven reviews respond to information that makes the existing customer profile unreliable. This is where many programmes become more effective than a calendar-only approach.
Define the events that matter
A review trigger should be specific enough that operations teams know what action to take. Examples can include:
- a material change in ownership or control
- a new director or authorised representative
- a PEP or sanctions screening change
- significant adverse media
- an unusual change in transaction behaviour
- a new country or product exposure
- expired or inconsistent identification information
- a change in the customer's stated purpose or business activity.
Not every trigger needs to send the customer through full onboarding again. The response should be proportionate to what changed.
Connect monitoring to customer risk
Transaction monitoring and customer due diligence are often managed as separate processes. That can create a blind spot.
If transaction activity materially differs from the expected customer profile, the institution may need to reassess the customer's risk, update information or conduct enhanced due diligence. Conversely, a newly identified high-risk characteristic can affect how future activity should be interpreted.
The objective is a feedback loop: customer information informs monitoring, and monitoring outcomes can trigger customer review.
Decide what is refreshed
A review should focus on information that can change risk. Depending on the relationship, that can include identity data, address, occupation, business activity, purpose of the relationship, beneficial ownership, source information, expected activity and screening status.
The scope should be set by policy. Teams should avoid both extremes: repeating every onboarding task regardless of risk, or refreshing only a superficial contact field while leaving material risk data untouched.
Recalculate risk transparently
When information changes, the customer-risk score may need to change too. The organisation should be able to explain which factors changed, how they affected the rating and what additional controls follow from the new risk level.
Opaque scoring undermines reviewability. A second-line reviewer should be able to see the inputs, the decision rules and the rationale for any override.
Make exception handling explicit
Real-world customer records are incomplete. An ongoing CDD workflow should define what happens when documents cannot be obtained, ownership information conflicts, a potential screening match remains unresolved or the customer does not respond.
Exceptions should have owners, deadlines and escalation paths. Leaving them in an unstructured queue creates both operational and audit risk.
Measure whether ongoing CDD is working
Useful measures go beyond the number of reviews completed. Consider:
- reviews completed on time by risk tier
- overdue high-risk reviews
- event-triggered reviews by trigger type
- risk ratings changed after review
- beneficial-ownership changes identified
- screening escalations generated during refresh
- cases where transaction behaviour caused CDD reassessment
- unresolved exceptions and ageing.
These measures help management understand whether the programme is updating risk effectively, not simply processing cases.
Frequently asked questions
Is ongoing CDD the same as periodic KYC refresh?
Periodic refresh is one component. Ongoing CDD also includes event-driven reassessment when new information makes the existing customer profile or risk rating unreliable.
Should every customer be reviewed at the same frequency?
A risk-based model normally differentiates review intensity according to customer risk and the institution's methodology rather than applying one identical cycle to everyone.
Can screening changes trigger a CDD review?
Yes. A new PEP, sanctions or adverse-media result can be a material event requiring investigation and, where appropriate, reassessment of the customer relationship.
Design for change, not just onboarding
A customer file is a point-in-time view. Effective ongoing due diligence keeps that view aligned with current risk. MemberCheck can support structured screening, risk assessment and review workflows so changes can be identified, investigated and evidenced over the life of the relationship.
