Ongoing due diligence is the continuous review of an established customer relationship to keep risk ratings current and catch changes in behavior, ownership, or circumstances. It watches the customer, not just individual payments, because risk drifts between formal reviews.
What is ongoing due diligence, in plain English?
Ongoing due diligence keeps a customer's risk picture current after onboarding. It is the discipline of noticing when something about the customer changes: a shift in behavior, a new beneficial owner, a change of address or business line, a fresh adverse-media hit. When those changes appear, the risk rating and the level of scrutiny are updated to match, rather than left frozen at whatever they were the day the account opened.
It is distinct from transaction monitoring. Transaction monitoring watches individual payments for suspicious patterns; ongoing due diligence watches the customer and their overall profile. The two work together, but they answer different questions: one asks whether a payment looks wrong, the other asks whether the person or business behind the account still looks the way you thought they did.
The reason it exists is simple: risk drifts. A customer who was low risk at signup can become high risk through a change in ownership, a new pattern of activity, or a life event, and none of that waits for a scheduled review. Ongoing due diligence is the layer that catches drift as it happens.
Ongoing due diligence versus periodic review
What changes | Periodic review | Ongoing due diligence |
Trigger | The calendar; a scheduled date by risk tier. | An actual change in behavior, ownership, or circumstances. |
Timing | Point-in-time, months apart. | Continuous, as change occurs. |
Blind spot | Risk that shifts between scheduled dates. | Change that produces no obvious signal to catch. |
Role | A safety net that catches what nothing else did. | The primary line that keeps the profile live. |
What it looks like in practice
In practice
A business customer onboarded two years ago as a small local retailer starts receiving large international wires and adds several new signatories to the account. None of the individual payments is dramatic enough to trip a monitoring alert on its own, but together they describe a very different business from the one on file.
Because ongoing due diligence flags the change in behavior and ownership, an analyst pulls the file and finds the risk rating still reflects a small domestic shop. The profile is refreshed, the customer is re-rated higher, and monitoring is re-tuned to match the new activity. Without that catch, the file would have stayed frozen at onboarding while the real business moved somewhere else entirely.
Why it matters to operators
The classic failure mode in AML is a customer file frozen at onboarding while the customer's real activity moves somewhere very different. An outdated profile mis-tunes monitoring, understates risk, and delays escalation, and it is exactly the kind of gap examiners look for. Ongoing due diligence is the control that stops that drift from going unnoticed.
It also bridges the gap between periodic reviews. Calendar-based cycles are useful, but they are slow, and a lot can change in the months between them. Ongoing due diligence catches that change as it happens, so the firm is not waiting for an anniversary to notice a problem that started months earlier. A file that never changes on a customer who clearly has is a quiet, standing risk.
What to watch for
- Behavior that outgrows the profile. Activity volume, geography, or type that no longer matches the customer's rated risk.
- Ownership changes. New beneficial owners or signatories that alter who really controls the account.
- Fresh adverse media. New negative news or screening hits on an existing customer that were not present at onboarding.
- Stale files on active customers. A profile that has not changed in years while the customer's activity clearly has.
- Life or status events. A customer becoming a PEP, moving jurisdiction, or changing business line, all of which shift risk.
Quick questions
How is ongoing due diligence different from transaction monitoring?
Transaction monitoring watches individual payments for suspicious patterns. Ongoing due diligence watches the customer and their overall profile, catching changes in behavior, ownership, and circumstances rather than scoring single transactions.
How does it relate to periodic review?
It bridges the gaps between periodic reviews. Where periodic review is calendar-based and point-in-time, ongoing due diligence is continuous, catching change as it happens rather than waiting for the next scheduled date.
Is ongoing due diligence a regulatory expectation?
Yes. Keeping customer information and risk ratings current over the life of the relationship is a standard requirement under risk-based AML frameworks, not an optional extra.
What triggers a re-assessment?
Any material change: new ownership, a shift in transaction behavior, a fresh adverse-media hit, a change of jurisdiction, or an event that alters the customer's risk. The point is to act on the change, not wait for a date.
How does it connect to perpetual KYC?
Perpetual KYC is an event-driven way to operationalize ongoing due diligence, automatically refreshing the profile as underlying data changes rather than relying on manual attention or fixed cycles.
What is the most common failure?
A file left frozen at onboarding while the customer's activity changes. The outdated profile understates risk, mis-tunes monitoring, and slows escalation, which is exactly what ongoing due diligence exists to prevent.
Go deeper
- FFIEC BSA/AML Examination Manual ↗ — The manual US examiners use to assess BSA and AML programs.
- FATF ↗ — The global standard-setter for AML, counter-terrorist-financing, and counter-proliferation. Recommendations, guidance, and jurisdiction lists.