Perpetual KYC: How Ongoing Monitoring Works and What Examiners Expect

What is perpetual KYC?

Perpetual KYC is an approach to customer due diligence that keeps each customer's information and risk rating up to date continuously. It monitors for events that change a customer's risk, such as a sanctions designation, a new PEP status or unusual transactions. It then triggers a review when one happens, rather than only on a fixed date.

It is sometimes called pKYC, continuous KYC or event-driven KYC. Traditional periodic KYC reviews every customer on a calendar cycle, often by re-collecting documents. Perpetual KYC focuses effort on the customers whose risk has actually changed.

For banks, fintechs, payment companies and gaming operators in Nigeria, this matters because risk does not wait for review dates. This guide explains how perpetual KYC works, what the CBN expects, and the two questions buyers most often ask vendors about it.

Perpetual KYC vs periodic KYC

Periodic reviews still have a place. They catch slow changes that no single event reveals. Our guide to periodic KYC refresh explains how those cycles work. Perpetual KYC adds a second layer on top.

What triggers a perpetual KYC review?

A trigger is any event that suggests a customer's risk may have changed. The most common are a new sanctions designation or a change to a PEP list, and new adverse media about the customer or its owners. Changes in transaction behaviour also count, such as sudden volume spikes, new countries or new counterparties. Changes to the customer's own details matter too, such as a new address, new directors or a change in ownership.

Each trigger should lead to a defined response. Minor changes may simply update the record. Significant ones should re-score the customer's risk and, where needed, start enhanced due diligence (EDD) or a suspicious transaction report.

For list-based triggers, update speed matters. Our guide to watchlist screening covers how quickly sanctions changes should reach your screening.

What do FATF and the CBN require for ongoing monitoring?

Ongoing monitoring is not optional. The Financial Action Task Force (FATF) Recommendation 10 requires ongoing due diligence on the business relationship and scrutiny of transactions throughout its course. The aim is to ensure transactions are consistent with what the institution knows about the customer, its business, its risk profile and, where necessary, its source of funds. It also says due diligence should apply to existing customers on the basis of materiality and risk.

In Nigeria, the CBN Customer Due Diligence Regulations 2023 set review cycles in Regulation 23(b). High-risk customers must be reviewed every 12 months, medium-risk every 18 months and low-risk every three years, and also whenever the need arises. Regulation 13 adds triggers for existing customers, including significant or unusual transactions and material changes to a customer's profile or how an account is operated.

The CBN has previously required mass revalidation. A December 2023 circular required the BVN or NIN on all accounts and wallets to be electronically revalidated by 31 January 2024. Institutions with a perpetual KYC setup could run that against their existing records. Others had to start from scratch.
 

Can you re-screen existing customers automatically, or only at onboarding?

This is the question that tells you whether a platform supports perpetual KYC or only onboarding. Many tools screen a customer once, at sign-up. After that, the customer is checked again only if someone runs a manual batch.

There are three levels of capability. Onboarding-only screening checks each customer once. Scheduled batch screening re-checks the whole customer base on a fixed cycle, such as nightly or monthly. Event-driven screening re-checks affected customers as soon as a trigger fires, such as a list update.

Perpetual KYC needs the third level, with the second as a backstop. Ask the vendor whether a sanctions or PEP list update automatically re-screens your existing customers, or only new ones. Then ask whether a change in transaction behaviour can re-score a customer's risk without a person starting it.

For business customers, ask whether directors and beneficial owners are monitored too, not just the company. A clean company with a newly sanctioned owner is still a sanctions risk.

Finally, ask how the platform avoids flooding your team. Re-screening a large customer base can generate thousands of alerts. Good systems suppress repeat alerts that were already cleared and use secondary identifiers to cut false positives.
 

Does the platform keep an audit trail a CBN or NFIU examiner would accept?

This question has become harder to dodge. On 10 March 2026, the CBN issued its Baseline Standards for Automated AML Solutions (circular BSD/DIR/PUB/LAB/019/002). They require a comprehensive, tamper-proof and immutable audit trail of all system and user activities, and a documented governance framework for the AML solution.

Institutions that use a third-party AML solution must also keep a vendor and third-party management policy. It must cover procurement, implementation, support, change management, incident handling and exit. Your vendor's audit trail therefore becomes part of your own compliance evidence.

An examiner reviewing a perpetual KYC decision will want to reconstruct it. What triggered the review, and when? What data did the system hold at that moment? How did the risk score change, and why? Who reviewed the case, what did they decide, and was a suspicious transaction report filed with the Nigerian Financial Intelligence Unit (NFIU)?

Ask the vendor to show you a real case history, not a slide. The record should be time-stamped, unchangeable after the fact, and linked to the customer it concerns. It must also be kept for at least five years after the relationship ends, in line with the CBN Customer Due Diligence Regulations 2023.
 

Perpetual KYC checklist: questions to ask every vendor

How Youverify supports perpetual KYC

Youverify due diligence does not stop at approval. The entity record created on day one is the record that gets re-screened, re-scored and re-reviewed for as long as the relationship lasts.

Sanctions, PEP and adverse media screening continue after approval, and business owners stay under continuous monitoring, so a status change reaches you the day it happens. Enhanced due diligence can be scheduled by risk group, so review cycles can follow your own risk tiers.

Every check, its source, its timestamp and the officer who set the final status stay attached to the entity record. Re-screening and status changes append to that same record rather than creating a new one. A match opens a case with the evidence attached. Youverify's transaction monitoring runs on the same record, so behaviour changes and screening results sit together.

To see a customer record re-screened and re-scored over time, request a free demo today..

Conclusion

Risk changes after onboarding, and regulators now expect your controls to keep up. Perpetual KYC does that by reacting to real events, while scheduled reviews catch what events miss.

When you assess a platform, ask two things. Does it re-check existing customers automatically? And can it show an examiner exactly what happened, when and why?
 

About the Author

Victoria Okere is a compliance content writer at Youverify, specializing in AML compliance, financial crime risk, regulatory technology, and emerging trends in financial services.