AML ongoing monitoring means keeping each client’s due diligence up to date and checking that the work you do for them still fits what you know about them. The Money Laundering Regulations set no fixed refresh period, so practices set their own: a review cycle for each risk band, plus an early review whenever a trigger event happens.
In practice, AML ongoing monitoring is a diary. Higher-risk clients are reviewed more often, lower-risk clients less often, and certain events, such as a new director, a new service or a transaction that does not fit, bring a review forward. Below is a schedule your admin team can diarise and a tracker layout that keeps the evidence in one place.
Key points
- Regulation 28(11) requires ongoing monitoring of every business relationship, including scrutiny of transactions and keeping CDD documents and information up to date (MLR 2017, regulation 28).
- Regulation 27(8) requires CDD on existing clients at appropriate times on a risk-based approach, and when relevant circumstances change (MLR 2017, regulation 27).
- No statutory refresh period exists. Your firm’s policy sets the cycle and must be justifiable to your supervisor.
- High-risk clients and PEPs need enhanced ongoing monitoring.
- Admin staff can run the diary and chase documents. Risk decisions stay with the MLRO or responsible partner.
What AML ongoing monitoring means for a practice
Regulation 28(11) gives AML ongoing monitoring two parts. The first is scrutiny of transactions throughout the relationship, including source of funds where necessary, to make sure they are consistent with your knowledge of the client, their business and risk profile. The second is reviewing existing records and keeping CDD documents and information up to date.
For an accountancy practice, “transactions” usually means the work you see: the accounts, the bank statements you reconcile, the tax returns you prepare and the advice you give. Staff who do that work are often first to notice something odd, such as an unexplained large receipt or a new overseas supplier. AML ongoing monitoring therefore needs a route for staff to raise concerns, alongside the scheduled reviews.
Your firm must also be able to show its supervisor that the extent of the measures is appropriate to the risks (regulation 28(16)). A written schedule and a completed tracker are the simplest evidence. For the wider CDD rules, see our AML requirements checklist for accountants.
AML ongoing monitoring cycles by risk band
Because the regulations leave timing to a risk-based approach, refresh cycles are a firm-wide policy choice. The table below is an example schedule many practices adapt. Adjust it to your own firm-wide risk assessment and your supervisor’s guidance, and record the reasons for the intervals you choose.
| Risk band | Example review cycle | What the review covers | Who signs off |
|---|---|---|---|
| Low | Every 3 years | Confirm identity details, ownership and services unchanged; re-screen sanctions and PEP status | Client manager |
| Medium | Every 2 years | As low, plus refresh the client risk assessment and check activity against the expected profile | Client manager |
| High | Every year | Full CDD refresh, enhanced checks, source of funds where relevant, written conclusion | MLRO or partner |
| PEP or family member or close associate | Every year, or more often | Enhanced ongoing monitoring and senior management approval to continue | Senior management |
The high-risk and PEP rows reflect legal duties. Regulation 33 requires enhanced ongoing monitoring where a case is high risk, and regulation 35(5) requires senior management approval to continue a relationship with a PEP and enhanced ongoing monitoring of it (regulation 33; regulation 35). The specific intervals are policy.
Screening between reviews
Sanctions and PEP status can change at any time, which is why AML ongoing monitoring cannot rely on the review cycle alone. If your AML software offers automatic re-screening, record that it is switched on for every client and who receives the alerts. If it does not, add a periodic batch re-screen to the diary.
Trigger events that force an early review
Regulation 27(9) lists what firms must take into account when deciding when to apply CDD to existing clients: any sign that the identity of the client or beneficial owner has changed, transactions that do not fit what you know, a change in the purpose or nature of the relationship, and anything else that might affect the risk assessment. Turned into everyday events, that gives the list below.
| Trigger event | Where staff usually spot it | Action |
|---|---|---|
| New director, PSC or shareholder | Companies House alert, confirmation statement | Identify and verify the new person; update ownership chart |
| New service requested (for example payroll, trust work, property sale) | Engagement letter update | Re-assess risk for the new service |
| Unusual or unexplained transaction | Bookkeeping, bank reconciliation | Raise with the MLRO; ask for an explanation and evidence |
| Change of business activity or country of operation | Accounts preparation, client meeting | Re-assess risk band |
| Client becomes, or is linked to, a PEP | Screening alert | Enhanced measures; senior management approval |
| Doubts about earlier ID evidence | Any | Fresh CDD under regulation 27(1)(d) |
| Change of name or address | Client correspondence | Update records; verify if risk warrants |
Do not rely on the Companies House register alone when ownership changes. Regulation 28(9) says firms do not meet the beneficial ownership duty by relying solely on information delivered to the registrar. Our Companies House identity verification checklist covers the separate verification regime for directors and PSCs.
Keeping ID documents in date
For AML ongoing monitoring, the regulations require CDD documents and information to be kept up to date. They do not say that every expired passport must be replaced at once. A sensible policy is to record the expiry date of each ID document and treat expiry as a prompt to consider the file at the next review, rather than as an automatic refresh trigger for low-risk clients whose details are unchanged.
For high-risk clients, or where there is any doubt about identity, request current evidence. Electronic verification tools can help here. Under regulation 28(19), information obtained through a secure electronic identification process can count as coming from a reliable and independent source.
Running the diary: tracker fields that work
AML ongoing monitoring fails when the next review date lives in someone’s memory. A tracker, either in your AML software or practice management system, should hold these fields for every client.
- Client name and reference
- Risk band and date of the last risk assessment
- Date CDD last completed and next scheduled review date
- Individuals verified (directors, PSCs, beneficial owners) with ID expiry dates
- Sanctions and PEP screening: last date and whether ongoing screening is active
- Open trigger events and date raised
- Documents requested, date chased, date received
- Reviewer, review date and outcome
Run an AML ongoing monitoring report on the first working day of each month showing reviews due in the next 60 days. That gives time to request documents before the review date passes. Keep the evidence of each review: under regulation 40, CDD records must be kept for five years from the end of the business relationship.
Who reviews and who chases
The split below keeps decisions with the people accountable for them. Regulation 39(7) allows a firm to apply CDD measures through an outsourcing service provider, but the firm remains liable for any failure (regulation 39).
| Task | Admin team (in-house or outsourced) | Client manager, MLRO or partner |
|---|---|---|
| Maintain the review diary and monthly report | Yes | Checks report |
| Request and chase documents | Yes | Escalation if client does not respond |
| Run ID checks and screening in the firm’s tool | Yes | Reviews results |
| Log trigger events raised by staff | Yes | Decides response |
| Set or change the risk band | No | Yes |
| Approve continuing a high-risk or PEP relationship | No | Yes |
| Decide on a suspicious activity report | No | MLRO |
Where AML ongoing monitoring usually breaks down
Supervisors’ findings tend to repeat the same gaps: review dates that were never set, trigger events noticed by staff but never logged, risk bands copied forward without a fresh look, and files with no record of who reviewed them or what they concluded. Each of these is an admin failure, so a disciplined diary does most of the work. Ask whoever runs AML ongoing monitoring to send the MLRO a one-page summary each month: reviews completed, reviews overdue, open triggers and documents outstanding.
Our comparison of AML checks in-house and outsourced sets out the costs of each approach.
FAQs
What are the AML ongoing monitoring requirements in the UK?
Regulation 28(11) of the Money Laundering Regulations 2017 requires firms to scrutinise transactions throughout a business relationship and keep CDD documents and information up to date. Regulation 27(8) adds that CDD must be applied to existing clients at appropriate times on a risk-based approach and whenever relevant circumstances change.
How often should AML checks be refreshed?
The regulations do not set a fixed period. Firms decide intervals by risk and must be able to justify them to their supervisor. A common pattern is yearly for high-risk clients, every two years for medium risk and every three years for low risk, with early reviews whenever a trigger event happens.
What is the difference between ongoing monitoring and continuous monitoring?
Ongoing monitoring is the legal duty to keep CDD current and check that activity fits the client’s profile. Continuous monitoring usually describes software that re-screens clients against sanctions and PEP lists automatically and alerts you to changes. Continuous screening helps meet the ongoing monitoring duty but does not replace scheduled reviews.
Do expired ID documents need replacing?
Not automatically. The regulations require CDD information to be kept up to date, and a document that was valid when you verified identity remains evidence that you did so. Record expiry dates and consider the file at the next review. Request current ID for high-risk clients or where there is any doubt about identity.
Can AML ongoing monitoring be outsourced?
The administration can be. An outsourced team can run the diary, chase documents and carry out checks in your AML tool. Under regulation 39(7) your firm stays liable for any failure, and risk decisions, approvals and suspicious activity reporting should remain with your MLRO and partners.
Keep every review on time
Our team runs the AML ongoing monitoring diary for practices: monthly due lists, document chasing and checks in your chosen tool, with every decision left to your MLRO. See our AML checks service or book a consultation.
