How Often Should Banks Update Customer KYC Information?

Is there a fixed KYC update frequency?

No single timetable fits all banks and customers. In Singapore, MAS Notice 626, paragraphs 6.19 and 6.24, requires banks to monitor customer relationships on an ongoing basis and keep customer due diligence (CDD) data, documents and information relevant and up to date through reviews of existing records, particularly for higher-risk customers. Those provisions do not prescribe one blanket number of years for every customer.

In the United States, the FFIEC examination manual describes updates as risk-based and event-driven. FinCEN’s CDD FAQs state that there is no categorical requirement to update every customer on a continuous or periodic schedule, although institutions may choose periodic reviews based on risk. These are US rules and guidance, not a substitute for Singapore requirements.

A bank might choose an annual review for a higher-risk population and longer intervals for other customers. Those are examples of internal policy choices, not a universal regulatory timetable. A new risk event can require an earlier review in any tier.

What customer KYC information needs to stay current?

A useful KYC record describes who the customer is, who controls a corporate customer, why the relationship exists and what activity the bank expects. The review should focus on information relevant to the relationship and its financial crime risk.

• Identity and contact details: name, identifying information, address and authorised representatives where relevant.
• Business details: activities, operating locations, products used and expected account behaviour.
• Ownership and control: directors, shareholders, beneficial owners and the structure through which control is exercised.
• Risk context: jurisdiction exposure, PEP or sanctions results, relevant adverse information and the rationale for the current rating.
• Source of funds or wealth: where required by the customer’s risk and the applicable CDD or enhanced due diligence measures.
• Decision history: exceptions, approvals, restrictions, monitoring measures and outstanding information requests.

Current does not mean collecting a new copy of every document each time. It means the bank can explain which facts remain reliable, which have changed and what evidence supports the present decision. A document’s expiry may require action under the bank’s policy or local rules, but a new document alone cannot resolve an unexplained change in activity or ownership.

Which events should trigger an earlier KYC review?

Trigger events should be defined in the bank’s policy and routed to a named owner. Examples include:

• a new beneficial owner, director or person authorised to act for a corporate customer;
• a material change in business activity, occupation, operating geography or product use;
• transactions that depart from the customer’s stated purpose or expected activity;
• a relevant sanctions, PEP or adverse-media result that requires assessment;
• credible concerns about the accuracy, completeness or authenticity of existing information;
• an investigation, law-enforcement request or other development that changes the risk assessment; and
• new information that calls for enhanced due diligence or a different monitoring measure.

The trigger should lead to an assessment, not an automatic assumption that the customer is suspicious. The reviewer should establish what changed, whether the information is reliable, what further evidence is proportionate and whether the existing risk rating still makes sense. The FFIEC manual gives similar examples, including ownership changes, unexplained activity and negative media.

How should banks set a review schedule?

Start with the applicable law and supervisory guidance in every jurisdiction where the bank operates. Then use the bank’s customer risk methodology to set a maximum interval for each relevant population. Document why the chosen interval is sufficient and who may change it.

1. Segment the book. Consider customer type, products, delivery channel, geography, ownership complexity, activity and existing risk signals.
2. Set risk-sensitive intervals. Higher-risk relationships generally need closer review; lower-risk relationships may justify a longer scheduled interval if monitoring still detects material change.
3. Define event overrides. Specify which signals create a review task immediately or within a stated internal service level, even when the next scheduled date is far away.
4. Set evidence and approval rules. State what must be checked, who may approve a rating change and when enhanced measures are required.
5. Test the policy. Review overdue work, missed changes, repeated information requests and cases where the risk rating was changed too late.

The EBA’s ML/TF risk factors guidelines likewise describe monitoring frequency and intensity as risk-sensitive, with customer information kept up to date. Banks should verify the version and local implementation relevant to their business before adopting a cross-border policy.

What should happen during a KYC refresh?

A refresh should produce a decision that a later reviewer can reconstruct. The amount of work should fit the trigger and the risk.

1. Open and assign the review. Record whether it began with a scheduled date, customer notice, monitoring alert or external information.
2. Compare old and new facts. Identify the fields, people, entities and behaviours affected. Keep the previous position visible.
3. Verify what matters. Request or obtain reliable evidence for the changed information and resolve conflicting sources.
4. Reassess risk and controls. Consider screening, expected activity, ownership, enhanced due diligence and monitoring settings.
5. Approve the outcome. Record the reviewer, any escalation or maker-checker approval, the rationale and any unresolved conditions.
6. Update connected workflows. Make sure the current profile is available to screening, transaction monitoring, investigations and the next scheduled review.

If the trigger is a changed address, the bank may be able to verify and update that fact without repeating every onboarding step. If a company’s control passes to a new person in a higher-risk jurisdiction, the review may need substantially more work. The decision should follow the facts, not a fixed document checklist.

A practical example: ownership and activity change together

A corporate customer was onboarded to receive domestic payments from its established clients. Six months later, transaction monitoring detects sustained payments from a new overseas corridor. Around the same time, a corporate registry update shows a change in shareholding.

The bank should not wait for the next calendar review. A reviewer can compare the activity with the approved profile, confirm the current ownership and control structure, ask for an explanation and supporting information, screen relevant new parties and reassess the customer’s risk. The result might be an unchanged rating with a documented explanation, enhanced monitoring, an escalation or another action under the bank’s policy.

The important connection is between the event, the evidence and the decision. A completed form that never reaches monitoring leaves the bank working from an outdated profile.

What if a customer does not provide updated information?

Record what was requested, why it was needed, when the customer was contacted and whether the available information remains sufficient to understand and manage the relationship. Escalate according to the bank’s policy and applicable rules. The response should reflect the significance of the missing information and any other risk signals.

A minor administrative gap differs from an inability to establish who controls a customer or explain significant activity. The bank may need enhanced review, restrictions or a decision about continuing the relationship, depending on the facts and its obligations. Suspicion and reporting questions should be handled through the bank’s established investigation and escalation process. The KYC team should not silently close a review simply because a request timed out.

How can banks measure review quality?

Completion rates show workload, but they do not show whether the bank is using current information. Useful measures include the share of reviews completed by risk tier, overdue higher-risk reviews, time from a material event to triage, unresolved ownership changes, repeated customer requests and risk-rating changes after review.

Quality assurance can sample whether the triggering event was understood, evidence was sufficient, the decision matched policy and changed information reached downstream controls. Segment the results by customer type and team. A low overdue count may conceal a weak trigger process; a high number of completed reviews may conceal superficial decisions.

How WIDTH supports ongoing KYC

WIDTH supports connected KYC onboarding, screening, risk review and transaction monitoring workflows. Customer information gathered at onboarding can remain linked to later signals and investigations, helping an authorised reviewer see what changed and why a case was opened.

For banks, the useful design question is whether a new signal can create a review with the existing customer context attached, route it to the right owner and preserve the evidence behind the final decision. The WIDTH banking platform is designed to bring those activities together. The bank remains responsible for its review intervals, risk rules and approval decisions.

Frequently asked questions

Sources and further reading

• MAS Notice 626, paragraphs 6.19–6.24: ongoing monitoring and current CDD records
• FFIEC BSA/AML Examination Manual: Customer Due Diligence
• FinCEN: Customer Due Diligence Rule FAQs
• EBA Guidelines on CDD and ML/TF risk factors, monitoring section

Regulatory requirements differ by jurisdiction and can change. This article explains an operating approach; banks should apply the current rules relevant to their activities.