Onboarding is today. Compliance is for a lifetime.

Most of the work in KYC and KYB happens at the start of a relationship. Documents come in, owners are traced, names are screened, a risk score is set and someone decides. Then the case closes, and the customer is done.

The law doesn't see it that way. In the UK and the EU, the duty to know your customer lasts as long as the relationship does, and the duty to keep the record runs for five years after it ends. And the customer you approve today won't stay the customer you approved. In three years it may have new directors, a new owner, a new country of operation, an expired passport on file and a name on a sanctions list.

Onboarding is today. Compliance is for a lifetime. This post sets out what ongoing due diligence asks of a firm, in the regulations' own words, and what a programme that lasts the whole relationship looks like. It's written for compliance teams at banks, payment institutions and e-money institutions in the UK and the EU.

What the law asks after day one

In the UK: the Money Laundering Regulations 2017

Three regulations carry the duty past onboarding.

Customer due diligence again, for customers you already have. Regulation 27(8) requires you to apply customer due diligence measures "at other appropriate times to existing customers on a risk based approach", and when you become aware that the circumstances of a customer relevant to your risk assessment have changed. Regulation 27(9) says what you must take into account in deciding when, among other things:

• any indication that the identity of the customer, or of its beneficial owner, has changed;
• transactions that aren't reasonably consistent with what you know about the customer;
• any change in the purpose or intended nature of the relationship.

(Source: MLR 2017, regulation 27)

Ongoing monitoring of every business relationship. Regulation 28(11) requires it, in two parts. The first is scrutiny of transactions throughout the relationship, to make sure they're consistent with what you know of the customer, its business and its risk profile. The second is "undertaking reviews of existing records and keeping the documents or information obtained for the purpose of applying customer due diligence measures up-to-date". How far you go must reflect your risk assessment, and the factors you weigh include "the regularity and duration of the business relationship" (regulation 28(12) and (13)). (Source: MLR 2017, regulation 28)

Records, for five years after the end. Under regulation 40(3), you keep customer due diligence records for five years from the date you know, or have reasonable grounds to believe, that the business relationship has come to an end. When that period expires, regulation 40(5) requires you to delete the personal data, with limited exceptions. (Source: MLR 2017, regulation 40)

The regulations don't set a review frequency. What you do, and how often, has to reflect your own risk assessment.

A UK change: since June, mandatory EDD follows one FATF list, not two

Since 30 June 2026, regulation 33(1)(b) has required enhanced due diligence and enhanced ongoing monitoring in any business relationship with a person established in a "FATF call for action country". That is a country on FATF's list of High-Risk Jurisdictions subject to a Call for Action, "as such list has effect from time to time". Until 29 June, the same rule covered countries on either of FATF's lists, including the Jurisdictions under Increased Monitoring, often called the grey list. (Source: MLR 2017, regulation 33, as amended by SI 2026/621)

Two things follow for the life of a relationship. The list is FATF's, so when FATF changes it, the customers who need enhanced due diligence by law change with it, including customers you onboarded years ago. And regulation 33(1)(b) no longer requires enhanced due diligence for a grey-listed connection. It can still be a high-risk factor, and enhanced due diligence may still be the right answer, but now your risk assessment has to say so, and your policy should record why. FATF's own statement on the grey list says it doesn't call for enhanced due diligence on those jurisdictions.

In the EU: the Anti-Money Laundering Regulation

From 10 July 2027, Regulation (EU) 2024/1624 applies directly to banks and other financial institutions in every member state (Article 90). Its Article 26 covers the life of the relationship, and it is more specific than the UK rules:

• Ongoing monitoring of the business relationship, including its transactions, to make sure they are consistent with what you know of the customer, its business activity and its risk profile (Article 26(1)).
• Customer information kept up to date, on a period that depends on risk and "shall not in any case exceed" one year for higher-risk customers under enhanced due diligence, or five years for everyone else (Article 26(2)).
• A review when something changes: when the customer's relevant circumstances change, when you have a legal duty in the year to contact the customer about its beneficial owners, or when you learn a relevant fact about it (Article 26(3)).
• Sanctions checks between reviews. You must regularly verify whether the customer or its beneficial owners are subject to targeted financial sanctions, as often as your exposure warrants. Credit and financial institutions, which include payment and e-money institutions, must also do it "upon any new designation" (Article 26(4)).

Article 77(3) sets the same five-year retention period, counted from the end of the relationship, and requires personal data to be deleted when it expires. (Source: Regulation (EU) 2024/1624)

Why approval doesn't stay true

A risk decision is a snapshot. These are the things that most often make it stale.

Sanctions and PEP status. Designations are added and lifted, and people take up and leave public functions. A customer that screened clean at onboarding can stop being clean without doing anything.

Ownership and control. Directors are appointed and resign, and shares change hands. In the UK, Companies House publishes changes to officers and persons with significant control, so they can be checked, but only if someone looks. Regulation 27(9) names a change in the customer's identity or beneficial owner first.

Jurisdictions. FATF publishes its two lists after each plenary, in February, June and October. On 30 October 2026, three jurisdictions were subject to a call for action (the DPRK, Iran and Myanmar) and 18 were under increased monitoring, and four came off increased monitoring: Bulgaria, Côte d'Ivoire, the Democratic Republic of the Congo and Monaco. (Source: FATF, 30 October 2026)

Documents. Passports, identity cards and other evidence expire. A file that was complete at onboarding can go out of date without anyone touching it.

The business itself. Customers change what they sell, where they sell it and how much money moves. Regulation 27(9) names a change in the purpose or intended nature of the relationship as a reason to look again.

What a lifetime programme looks like

None of this needs a big programme. It needs a few decisions, written down, and the means to act on them.

1. A cadence for every risk band

Decide how often each risk band is re-screened and how often it gets a full review, and have your MLRO approve it. They're different things. Re-screening checks names against lists. A review re-checks what you know about the customer: who owns it, what it does, whether your documents are current and whether its risk band is still right. Under the EU regulation, the gap between updates can't exceed one year for customers under enhanced due diligence, or five years for anyone else.

2. Re-screening of the customer and its people

Screen the company, its directors and its beneficial owners, not just the name on the account, at the cadence each band sets. Decide what you'll do between screenings when a new designation is published. For EU credit and financial institutions from July 2027, "upon any new designation" is the rule.

3. A watch on the registry

A change in ownership or control is the clearest sign that a customer's identity or beneficial owner has changed. Re-check the registry on a schedule, and compare who is listed now with who was listed when you approved the customer.

4. Document expiry dates, tracked

Record the expiry date of every document that has one, and ask for a new document before it lapses, not after.

5. Triggers, not just dates

Define what counts as a change in circumstances: a new owner, a new country, a sanctions or PEP match, adverse media, a pattern of transactions that doesn't fit. Each should open a review, whatever the calendar says. Regulation 27(8)(b) and Article 26(3) both ask for this.

6. A second pair of eyes, and a record

Every review should end in a decision someone owns: the risk band confirmed or changed, enhanced due diligence opened or closed, the relationship kept or ended. For higher-risk customers, have a second person sign it off. The record should show what was checked, what was found, who decided and when.

7. A recorded exit

When a relationship ends, record the date. It starts the five-year retention period, under regulation 40(3) in the UK and Article 77(3) in the EU. At the end of that period, both require you to delete the personal data, with limited exceptions.

Questions to ask of your programme

• When was your lowest-risk customer last re-screened, and when will it be next?
• Would you know if a customer's person with significant control changed tomorrow?
• Which of your customers did FATF's October 2026 update touch?
• How many documents on file have expired?
• For your last ten reviews, could you show who decided, on what evidence, and when?
• For a customer who left last year, do you know the date your five-year retention period started?

What First Mile Labs does today, and what's coming

We built First Mile Labs around the whole relationship, and we say plainly which parts are live.

Live today, on every plan:

• Every customer is enrolled in monitoring the day it's approved. Each run re-screens the company and its people against sanctions and PEP lists, at the cadence the customer's risk band sets: by default weekly for Critical, monthly for High, quarterly for Medium and yearly for Low. You can change it per customer, from daily to yearly, or per band on Cruise and Charter.
• Registry refresh, if you switch it on, flags a change in company status or registered address. It also names who joined or left as an officer or owner, and whose shareholding changed, where your registry source lists them. An analyst adds a new name to the case, and it's re-screened from then on.
• Document-expiry alerts at 90 days, at 30 days and on the day, if you switch them on.
• When a run finds something, the case owner gets an alert to review.

Live on Lift and above:

• Monitoring review cases that re-score the customer and close with a second person's sign-off.
• Evidence requests when enhanced due diligence is triggered.

Coming:

• Periodic review: customers confirm or update their details on a schedule.
• Adverse-media re-checks after approval.
• High-risk jurisdiction lists kept in step with FATF and EU updates.
• A re-request sent automatically when a document expires.
• Ending a relationship, with the record-keeping clock started for you.

Monitoring runs on a schedule. It re-screens at the cadence your risk band sets, not on each new designation, so set your cadences with that in mind.

The lifecycle page shows each stage and its status, and the monitoring page has the detail.

First Mile Labs builds KYB and KYC onboarding, risk decisioning and monitoring for banks, payment institutions and e-money institutions. If you're working out what your programme needs after day one, book a demo.