Perpetual KYC

KYC processes establish and maintain information about customers and the purpose of their relationships. Traditional programs often use periodic reviews based on risk tier, while perpetual KYC describes a more continuous approach that updates profiles when meaningful events occur. This may include a verified ownership change, a new product, a significant change in activity, a sanctions-screening update, or a customer-provided correction. The event-driven approach can reduce dependence on fixed review dates, but it does not mean collecting every available data point continuously. Institutions should define which events are relevant, how sources are verified, and when information needs an update. A monitoring alert is a prompt for review, not proof that a customer is risky or has done something wrong. Machine learning can prioritize changes, identify relationships among customer records, or compare observed activity with an expected profile. It may also create false links, amplify data errors, or flag legitimate customers whose activity changes for ordinary reasons. Model scores should be explainable enough for analysts to understand what triggered the review, and customers should have a path to correct inaccurate records. A risk-based process considers the specific customer and relationship rather than assigning one level of risk to an entire customer type. Updates should be proportionate to the information needed for due diligence. Excessive refresh requests can burden customers, while missing a material change may create compliance risk. Keep audit records of data sources, verification, decisions, and overrides. Perpetual KYC is an operating model, not a universal legal category. Regulations and supervisory guidance vary by jurisdiction and institution type. Compliance teams should map event-driven workflows to current obligations, protect personal data, and avoid using automated risk signals as final decisions without appropriate review.