Compliance teams have been working around the same fundamental flaw for decades. You verify a user when they open an account, assign them a risk tier, and then – unless something dramatic happens – you do not look again for another year or three. By the time the next scheduled review rolls around, the picture can look very different from what is on file.
That is the problem pKYC (perpetual KYC) is designed to solve. And as financial crime grows more sophisticated and regulators grow less patient, the industry is finally starting to take it seriously.
Defining Perpetual KYC
Perpetual KYC – commonly abbreviated as pKYC – is a model of continuous customer due diligence where risk profiles are monitored and updated in real time rather than on a fixed schedule. Instead of checking in on a user every 12 or 36 months, a pKYC system watches for changes continuously and flags them the moment they occur.
Those changes might include a customer appearing on a new sanctions list, a change in their company’s ownership structure, adverse media coverage linking them to financial crime, or unusual transaction patterns that do not match their profile. Under a traditional periodic model, any of these could go undetected for years. Under pKYC, they trigger a review immediately.
The technical foundations are nothing new – APIs, automated data feeds, AI-driven screening tools. What is changed is how they are being assembled into compliance workflows, and how urgently regulators are signaling that the old way of doing things is not good enough anymore.
The Annual Review Issue
The standard argument for periodic KYC has always been that it is manageable. You know how many reviews you need to run each quarter, you staff accordingly, and you keep the regulator happy by demonstrating a documented refresh cycle.
The problem is that financial crime doesn’t follow a schedule. A customer who was clean at onboarding can be designated on a sanctions list six months later. A company director can become politically exposed midway through a business relationship. A transaction pattern that looked normal in January can start looking suspicious by March. Fixed-cycle reviews create windows – sometimes very long ones – during which these changes go unnoticed.
Global fines for compliance failures exceeded US$19 billion in 2024 alone. That number reflects, in large part, situations where institutions simply were not watching closely enough, not because they were negligent, but because their compliance infrastructure was built around a rhythm that no longer matches the speed of risk.
Regulators have taken note. The Financial Action Task Force (FATF) encourages ongoing monitoring as part of its Recommendation 10, the EBA AML Guidelines require continuous assessment of business relationships, and the UK’s FCA supports dynamic, data-driven customer risk management as a sign of effective governance. These aren’t aspirational guidelines – they’re the direction regulators are actively moving in, and firms that fall behind will find it increasingly difficult to justify their approach.
From Calendar Triggers to Event Triggers
At its core, pKYC replaces the calendar trigger with the event trigger. Rather than asking “when was this customer last reviewed?”, the system asks “has anything changed since we last looked?”
Data flows in continuously from multiple sources, and the platform reconciles that information against existing customer profiles. When a discrepancy or red flag is detected, it generates an alert and routes it for human review or, in lower-risk cases, auto-resolves it. The data sources typically feeding a pKYC system include:
- Sanctions and watchlist databases (OFAC, UN, EU consolidated lists)
- Politically exposed persons (PEP) registries
- Adverse media and negative news feeds
- Corporate registry updates and beneficial ownership changes
- Internal transaction monitoring signals
This is why API-first architecture matters so much to pKYC implementation. With APIs, all data orchestration can occur at the same time, enabling institutions to bring together the different components of pKYC and process resulting changes altogether – or automatically trigger downstream actions based on the risk level of what has been detected.
The practical upshot is that compliance teams spend less time on routine refresh cycles and more time on the alerts that actually warrant human attention. Low-risk customers move through the system quietly. High-risk flags surface fast.
This is also where KYC (Know Your Customer) verification technology becomes more than just an onboarding tool. The same identity verification and document authentication infrastructure that validates a customer at sign-up can feed into ongoing monitoring – flagging if a document expires, if identity data is updated across external registries, or if a person’s risk classification changes based on fresh intelligence.
Cost, Experience, and the Commercial Argument
Beyond the regulatory angle, there is a straightforward commercial argument for pKYC. Periodic reviews are expensive. They are labor-intensive, they create operational spikes, and they frustrate customers who get repeated outreach requests for documents they have already submitted.
According to PwC’s Financial Crime Report 2024, organizations adopting pKYC models can reduce KYC maintenance costs by up to 40% while improving detection accuracy. Fewer manual cycles mean fewer resource-heavy backlogs. Event-driven reviews mean remediation efforts are targeted at actual risk rather than spread thinly across the entire customer base.
The customer experience argument is just as compelling. Nobody enjoys being asked to resubmit their passport for the third time in five years. Perpetual KYC minimizes unnecessary customer interactions, updating records silently in the background, and only engaging the customer when a genuine risk or compliance gap is detected. For financial institutions competing on seamless digital experience, this matters.
KYC spending is projected to grow 140% over the next five years, rising from US$9.2 billion in 2024 – a figure that reflects both regulatory pressure and recognition that the underlying technology now makes continuous monitoring genuinely scalable.
A Few Reasons Compliance Teams Are Making the Switch
- Real-time risk visibility. Compliance teams always work from a current picture of the customer, not one that was accurate 18 months ago.
- Reduced remediation costs. No more mass refresh projects eating up entire quarters. Changes are handled as they happen, in manageable batches.
- Better AML and fraud detection. Suspicious activity is flagged in the context of a living customer profile, not in isolation from historical data.
- Stronger audit trails. Continuous monitoring creates a richer, more defensible record of due diligence for regulators.
- Improved customer experience. Customers are only re-engaged when there’s a genuine reason – not because a calendar says it is time.
It would be misleading to frame pKYC as a clean technology upgrade. The operational shift is significant, and institutions that underestimate it tend to run into trouble. The three most common points are:
- Data fragmentation. A continuous monitoring model is only as good as the data feeding into it. Fragmented customer records across legacy systems, inconsistent data quality across business lines, and gaps in third-party data coverage can all undermine the program before it gets off the ground.
- Cultural adjustment. Time-based reviews give compliance teams a predictable workload. pKYC replaces that predictability with event-driven alerts – a meaningful shift in how teams plan capacity and escalate issues. Compliance staff accustomed to structured review cycles need time and process support to adapt.
- Governance design. pKYC systems produce alerts, but humans still need to act on them. Defining who reviews what, at what threshold, and within what timeframe requires careful process design – not just good technology.
What the Regulators Are Actually Signaling
The regulatory direction is unmistakable. The EU’s AMLD6 framework, FATF’s ongoing mutual evaluations, and the forthcoming EU Anti-Money Laundering Authority (AMLA) are all pushing toward a model where “ongoing monitoring” means something more substantive than an annual file review.
During the 2024 mutual evaluations, several jurisdictions cited a lack of real-time screening as a deficiency, even where annual reviews were pristine. That’s a significant signal. Doing periodic reviews correctly is no longer sufficient proof of an effective AML program. Regulators want to see that institutions can respond to risk as it emerges, not just document that they’ve checked boxes on schedule.
For institutions still running primarily periodic models, this is not cause for panic – but it is cause for a serious roadmap conversation. Migrating to pKYC does not happen overnight, and the institutions that start building the infrastructure now will be in a much stronger position when examiner expectations catch up with where the guidance is already heading.
Conclusion
The goal is not to monitor everything constantly. It is to monitor the right things, triggered by the right signals, with the right human oversight backing it up. That is what separates effective pKYC from a compliance tool that generates noise without improving outcomes.
Financial institutions that get that balance right do not just tick a regulatory box. They build a compliance function that is genuinely equipped for the pace of modern financial crime – and that is a meaningful competitive advantage.
Try for free 
