Ongoing KYB monitoring under the AMLR: rescreening, triggers and reviews
Vasco Alexandre
August 21, 2025
What is ongoing KYB monitoring?
Ongoing KYB monitoring, also called continuous monitoring, is the duty to keep watching a business customer after onboarding: you rescreen them, catch the changes that alter their risk and keep their information up to date for as long as the relationship lasts. Under the EU Anti-Money Laundering Regulation it gets hard deadlines: customer information must be updated at least every year for higher-risk customers and every 5 years for everyone else (Article 26(2), Regulation (EU) 2024/1624), plus a review whenever something relevant changes.
A clean file at onboarding is a snapshot, not a status. In Dotfile's data from the past year, 1 in 19 monitored screenings picked up a new hit after day one, and 58% of monitored companies produced at least one registry alert within six to twelve months. This guide sets out what the rules ask, today and from 10 July 2027.
What does the law require today, and what does the AMLR change?
Today's rule is a principle without a calendar. The Fourth AML Directive requires "ongoing monitoring of the business relationship", including keeping documents, data and information up to date (Article 13(1)(d), Directive (EU) 2015/849), and applying due diligence to existing customers "at appropriate times" on a risk-sensitive basis or when their circumstances change (Article 14(5), Directive (EU) 2015/849). How often is left to national law and to you.
The AMLR, which applies from 10 July 2027 (Article 90, Regulation (EU) 2024/1624), changes four things. All articles refer to Regulation (EU) 2024/1624.
| Requirement | Today (AMLD4, as transposed) | From 10 July 2027 (AMLR) |
|---|---|---|
| Maximum time between updates | None set in the directive | 1 year for higher-risk customers under enhanced due diligence, 5 years for all others (Article 26(2)) |
| Review on change | When relevant circumstances change, or when you have a legal duty to contact the customer about beneficial owners (Article 14(5)) | On a change in relevant circumstances, a legal duty to contact the customer about beneficial owners or a relevant fact you become aware of (Article 26(3)) |
| Sanctions rescreening | Flows from the EU sanctions regulations, such as the asset freeze in Article 2, Council Regulation (EU) No 269/2014, and national law | Part of due diligence (Article 20(1)(d)); verify regularly, and for credit and financial institutions on every new designation (Article 26(4)) |
| Guidance | National supervisors, EBA guidelines | AMLA guidelines on ongoing monitoring (Article 26(5)) |
The ceiling is not the target. Article 26(2) says the period between updates "shall be dependent on the risk posed by the business relationship", so a 5-year cycle on every standard customer will be hard to defend.
What are the three layers of ongoing KYB monitoring?
Ongoing KYB monitoring covers the company, its beneficial owners and its representatives. It runs on three layers, and each one catches what the others miss.
1. Continuous screening and rescreening
Rescreening means running the company and every person attached to it against sanctions, PEP and adverse media lists again, either on a schedule or each time the lists change. Article 26(4), Regulation (EU) 2024/1624 requires you to verify regularly whether the customer or its beneficial owners are subject to targeted financial sanctions, and banks and financial institutions must do it "upon any new designation". A monthly batch job does not meet that sentence. See our guides to AML screening and to false positives.
2. Event-driven registry monitoring
Event-driven monitoring watches the company's registry record and raises an alert when it changes: a new director, a new shareholder, an insolvency filing. This is how you meet Article 26(3)(a), Regulation (EU) 2024/1624, a "change in the relevant circumstances of a customer", without waiting for the calendar.
3. Risk-based periodic reviews
A periodic review is a scheduled refresh of the whole file: identity, ownership, purpose of the relationship, screening, risk level. Its frequency follows the risk level, inside the Article 26(2) ceilings. Our KYB process checklist shows where the review sits, as step 9.
Is perpetual KYC a replacement for periodic reviews?
No. Perpetual KYC (pKYC) is event-driven review layered on top of the calendar: you review a file when something about the customer changes, instead of only when a date comes up. It does not remove the calendar, because Article 26(2) sets a maximum interval whatever happens in between. What pKYC changes is the content of the scheduled review: if the registry, the lists and the ownership have been watched all along, the review confirms a file instead of rebuilding it. Our pKYC overview has the background.
What do AMLA's draft guidelines on ongoing monitoring say?
Article 26(5) asks AMLA for guidelines on ongoing monitoring. AMLA consulted on a draft from 3 June to 3 September 2026 and expects the final text in the fourth quarter of 2026. Its direction is clear:
- Periodic reviews always happen, with a depth that follows risk. For a low-risk customer whose activity has not changed, the draft gives as an example "checking business registries and other reliable and independent sources", PEP and adverse media screening and an internal check that the nature of the relationship is unchanged.
- Trigger events start a review "without delay". The draft lists changes in identity, legal status or ownership (including directors and signatories), behavioural anomalies, legal proceedings, "new adverse media, new PEP status" and changes in financial situation.
- Registries are a named detection source: "company registries and public databases to detect changes, such as changes in corporate ownership or status".
- A customer who does not answer can see transactions temporarily suspended or restricted before the relationship is terminated.
Worked example: one customer, 21 months
This example applies the AMLR rules, as they stand from 10 July 2027. You onboard Kestrel Wholesale NV, a fictional Belgian food wholesaler, at medium risk. Your policy reviews medium-risk files every 24 months, well inside the 5-year ceiling.
| Month | Event | What it triggers |
|---|---|---|
| 0 | Onboarding, medium risk | Next periodic review set for month 24 |
| 5 | Registry alert: a new managing director is appointed | Event-driven review (Article 26(3)(a)): update the representatives, screen the new director, check their authority (Article 20(1)(i)) |
| 9 | Monitoring raises a PEP hit on Sara, a beneficial owner at 30%, just elected to the national parliament | Confirmed true hit. Enhanced due diligence (Article 34(1)): senior management approval to continue, source of wealth and funds, enhanced ongoing monitoring (Article 42(1)). Risk moves to high |
| 9 | Risk level changes | Next review moves from month 24 to month 21: higher-risk files are updated at least every year (Article 26(2)(a)) |
| 14 | A new EU sanctions designation is published | Rescreening of the company and its people (Article 26(4)); no hit |
| 21 | Periodic review | Refresh ownership, screening and source of funds; confirm high risk or lower it with a written rationale |
Without monitoring, months 5 and 9 would have waited until month 24: a high-risk relationship three months past its 1-year ceiling, with a PEP nobody had approved.
How often does a monitored customer change? 1 in 19
Based on AML screenings and company monitoring checks built on Dotfile over the past year, each watched for six to twelve months; aggregates only.
- 1 in 19 monitored screenings (5.2%) picked up a new hit after day one, work a one-off screening never sees.
- 1 in 115 (0.87%) went from no hit at onboarding to a hit later.
- 58% of monitored companies produced at least one registry alert. Among those, 84% included a financial change, 48% an operational change such as an address or activity, 10.5% a change of status and 4.7% a change of shareholder. Shareholder changes are the rarest of the four and the one that can change who the beneficial owner is.
Frequently asked questions
How often should customers be rescreened against sanctions lists?
Regularly, at a frequency matching your sanctions exposure, and from 10 July 2027 on every new designation if you are a credit or financial institution (Article 26(4), Regulation (EU) 2024/1624). In practice that means continuous screening that reacts to list updates, not a periodic batch.
What is the difference between ongoing monitoring and periodic review?
A periodic review is one of the three layers of ongoing monitoring: the scheduled refresh of the whole file. Ongoing monitoring also includes rescreening and event-driven registry alerts, which run between reviews and often bring the next review forward.
Is ongoing monitoring the same as transaction monitoring?
No. Article 26(1) covers transactions, and Article 26(2) keeping customer information up to date. KYB monitoring watches the customer, its owners and its registry record; transaction monitoring watches what flows through the account. Both feed one risk profile.
What if the customer does not respond to a review request?
From 10 July 2027, if you cannot keep the information up to date, you must refrain from transactions, terminate the relationship and consider a suspicious transaction report (Article 21(1), Regulation (EU) 2024/1624); AMLA's draft reads Articles 20, 21 and 26 together to reach that result, and allows a temporary suspension or restriction first, where that keeps the risk under control.
Where Dotfile fits
Dotfile's AML screening keeps watching every screened company and person once monitoring is on: a new potential match sends the check back to Need Review, marked as coming from monitoring. Company monitoring watches the registry for the categories you choose (directors, shareholders, status, address, financial events) and reopens the check when one changes. Review periods are set per risk level in the approval flow, counted from the approval or the last review, and routines can run the collection work of a review overnight. The decision to keep, re-rate or exit a customer stays with your team.
Ready for Anywhere?
Verify any business, enter any market, defend every decision. Every signal orchestrated, every decision traceable, from one platform.