Perpetual KYC (pKYC): Ongoing Monitoring Beyond Periodic Reviews

Most firms still check who their customers are on a timetable: once at onboarding, then again every year, three years or five, depending on risk. Perpetual KYC throws out the timetable. Instead of waiting for the next scheduled review, it watches customer data continuously and refreshes the profile the moment something material changes.

Also called continuous KYC, ongoing KYC or event-driven KYC, it is the model regulators are steering toward and the one the EU AMLR effectively assumes.

This guide covers what perpetual KYC is, why fixed review cycles leave gaps, how the event-driven model works in practice, the trigger events that set it off, and how it maps onto the AMLR's ongoing-monitoring duties. It sits in our compliance cluster alongside the AMLR pillar and our guide to AML transaction monitoring.

What Is Perpetual KYC?

Perpetual KYC, or pKYC, is an automated form of customer due diligence that keeps a customer's risk profile current all the time, rather than at set intervals.

The system monitors internal and external data, and when a defined event suggests the customer's risk may have shifted, it updates the profile and, where needed, routes a review to a compliance analyst.

The ambition in one line: no more point-in-time snapshots, just a profile that stays accurate between onboarding and offboarding.

Why Periodic KYC Falls Short

Periodic KYC is not wrong, it is just slow. A customer is verified and risk-rated at onboarding, then left largely untouched until their review falls due. The trouble is that risk does not keep to a schedule.

Someone can be added to a sanctions list the week after their annual review, acquire a new beneficial owner, or start moving money in ways that no longer fit their profile, and under a periodic model none of that surfaces until the next cycle, which may be years away.

There is a quieter problem too. Because periodic reviews refresh whole segments of customers at once, most of that effort is spent re-checking people whose risk has not changed at all, while the one account that did change waits its turn in the queue. It is a lot of work aimed mostly at the wrong places.

Periodic KYC vs Perpetual KYC

The diagram shows the difference at a glance: the same sanctions hit lands in a blind spot under a periodic model and is caught immediately under a perpetual one.

Under periodic KYC, a change between reviews goes unseen; perpetual KYC triggers a review when the change happens.

Laid out side by side, the two models differ on almost everything that matters operationally:

How Perpetual KYC Works

Underneath, perpetual KYC is a loop: bring the data together, watch it, decide what matters, act only where it does. A few building blocks make that loop run.

• A single customer view. Internal records, external data and transaction history are resolved into one profile, so a change can be judged against everything else known about the customer.

• Continuous monitoring. Data and behaviour are tracked against a baseline in real or near-real time, not sampled once a year.

• Trigger detection and materiality. Defined events, and anomaly models, surface changes, and a materiality test decides which ones deserve attention. A new beneficial owner matters; a reformatted address does not.

• Dynamic risk re-rating. The risk rating updates automatically as new information lands, so it reflects the customer as they are now.

• Automated workflows with human exceptions. Low-risk, immaterial changes clear automatically and are logged; genuinely risky cases escalate to an analyst or to enhanced due diligence, with an audit trail throughout.

The trigger events to watch

The quality of a pKYC programme lives in its triggers. Too few and you miss things; too many and you drown in noise. These are the events firms commonly monitor:

Perpetual KYC and the EU AMLR

Here is where the EU framing matters, and where most explainers go quiet. The AMLR does not use the phrase perpetual KYC, but it points straight at it. Obliged entities have to monitor the business relationship throughout its life, scrutinising transactions and keeping customer information up to date, not just collecting it once. Perpetual KYC is simply the operating model that delivers that duty in practice.

The regulation also puts an outer limit on how stale a profile may become. Customer information must be refreshed at least every year for higher-risk customers and at least every five years for everyone else, with reviews also prompted when circumstances change.

Read those intervals the right way round: they are the backstop, the longest you can go, not the target. Event-driven monitoring is how you stay compliant in between, surfacing the sanctions listing or ownership change the day it happens rather than at the deadline.

And when monitoring does turn up a genuine concern, the report goes to the national Financial Intelligence Unit as a suspicious transaction report, with the new EU authority, AMLA, set to harmonise supervisory expectations across member states. The wider duties are covered in our AMLR pillar guide.

The Benefits

Done well, perpetual KYC pays off in several directions at once, which is why it has moved from buzzword to board agenda:

• Risk you can trust. Profiles reflect the customer today, so decisions rest on current information rather than a year-old snapshot.

• Faster detection. A listing, ownership change or behavioural shift is caught as it happens, closing the gap periodic reviews leave open.

• Effort where it counts. Analysts stop re-reviewing unchanged customers and spend their time on the accounts that actually moved.

• Less customer friction. Most updates happen passively in the background, so document chases are reserved for genuinely higher-risk moments.

• A lower running cost over time, once the upfront build is done, because the manual review burden shrinks.

The Challenges

None of this is a switch you flick on. The firms that struggle usually trip over the same obstacles, and it is worth naming them plainly:

• Data quality and silos. Without a reliable single source of truth, continuous monitoring just automates bad data.

• Legacy systems. Older stacks were built for batch reviews and resist the real-time integration pKYC needs.

• Noise. Weak materiality rules turn continuous monitoring into a flood of alerts, the false-positive problem all over again.

• Cost and change. The build is a real investment, and it crosses departments, so it needs sponsorship and new ways of working, not just software.

The Path to Perpetual KYC

Few firms go from annual reviews to full pKYC in one leap, and the ones that try tend to stall. It is more realistic, and more common, to move through stages, proving value at each before extending the next:

1. Periodic baseline. Scheduled reviews by risk tier, the starting point for most.

2. Event-triggered refresh. Monitor a few high-value triggers, such as sanctions and ownership changes, and refresh on those between cycles.

3. Continuous monitoring with dynamic re-rating. Expand the triggers, add materiality filtering, and let the risk rating update automatically.

4. Perpetual, straight-through. Immaterial changes clear automatically; only true exceptions reach an analyst. Scheduled reviews remain as a periodic audit of the automated system.

Perpetual KYC vs Transaction Monitoring

These two are easy to confuse, and they work together, but they are not the same thing. Transaction monitoring watches money movement and behaviour, and produces alerts. Perpetual KYC maintains the customer's identity and risk profile, and treats a monitoring alert as one trigger among many, alongside sanctions, ownership and identity changes. Put simply, monitoring asks what the customer is doing; pKYC keeps asking who they are and how risky that makes them. For the behaviour side, see our guides to transaction monitoring and how it differs from screening.

How Qoobiss Helps

Perpetual KYC needs three things working together: something to detect events, good identity data to re-verify against, and ongoing screening to feed it. That is how the Qoobiss platform is built.

• Ongoing risk oversight. Overwatch is the perpetual-KYC layer, consolidating signals from across the platform, detecting trigger events and keeping the audit trail that makes each decision defensible.

• Identity re-verification at the trigger. When an event calls for it, an expiring document or a step-up in risk, Ontrace and Origin re-verify identity with document and liveness checks, not just re-screen data.

• Ongoing screening. Omnicheck continuously re-screens customers against sanctions, PEP and adverse-media sources, feeding Overwatch the listings and status changes that should trigger a review.

Make KYC Continuous with Qoobiss

A profile that is accurate only on review day is a profile that is usually out of date. Perpetual KYC fixes that, and Qoobiss provides the pieces to run it: event detection and oversight in Overwatch, identity re-verification through Ontrace and Origin, and ongoing screening in Omnicheck. Read the AMLR pillar guide for the regulatory picture, see how transaction monitoring fits alongside it, or get in touch to talk through moving beyond periodic reviews.

Perpetual KYC - FAQs