Perpetual KYC (pKYC) is usually explained as a way to keep customer files from going out of date, and that explanation, while true, leaves out the most interesting part. Periodic KYC reviews each customer when the calendar says so, and that calendar reflects what the supervisor asks for far more than the pace at which a customer’s risk actually changes. The fundamentals of what AML and KYC mean remain the same.
With perpetual KYC, what decides when to look at a customer again is what happens in their relationship with the institution, and that difference has more consequences than it might seem, for compliance and for fraud alike.
What Is Perpetual KYC (pKYC)?
Perpetual KYC is a due diligence model in which customer information is reviewed and updated when a relevant event occurs, such as a change in their data, behaviour or risk level, instead of waiting for the date set by a fixed review calendar.
Put that way, it sounds like a technical upgrade to document management. In practice it demands something far less comfortable, which is defining in advance which changes in a customer are relevant enough to act on, and standing behind that definition in front of the supervisor. The calendar doesn’t disappear. It stays as an upper limit, but it is no longer the only criterion.
It shouldn’t be confused with reusable digital identity, which lets a person reuse a verification they have already completed to sign up for other services. Reusable identity makes it easier to enter new relationships, while perpetual KYC keeps existing ones up to date.
Why Point-in-Time KYC Is No Longer Enough
When I looked at the new role of the CISO in my previous article, the underlying problem was being able to prove, after the fact, that an automated decision had been under control. Something very similar happens with customers, and periodic KYC handles it poorly, because it only leaves evidence on review days. Everything that happens between one review and the next stays out of the file.
And it is precisely in that window that much of the fraud worrying risk teams today takes place. Account takeover starts from identities that were properly verified at the time. Synthetic identities that stay dormant after onboarding pass the initial checks because they are designed not to raise suspicion, and then they wait. Synthetic identity fraud cases follow that pattern with considerable discipline, with months of quiet activity, sometimes spent building a history, before the first meaningful move.
In my view, the core weakness of the periodic model is less its slowness than how predictable it is for anyone who takes the trouble to study it. A known calendar tells an attacker how much room they have.
Add to that a cost any KYC operations team knows well. When the calendar bunches expiry dates together, remediation campaigns follow, with thousands of customers asked for the same documents at once, replies that never arrive, accounts that get restricted and a backlog that takes months to clear. Most of the people who bear that friction are customers with no particular risk at all.
None of this takes away from identity verification (KYC) at onboarding, which remains the foundation of the relationship. What it shows is that a correct verification on day one says little about who is operating the account six months later.
Key Differences Between Periodic KYC and Perpetual KYC
Both models pursue the same goal, knowing the customer, but they approach it with very different logics.
| Periodic KYC | pKYC | |
|---|---|---|
| Trigger | The date set by the review calendar | An event that changes the customer’s risk |
| Frequency | Fixed, based on the assigned risk level | Variable, with the calendar as an upper limit |
| What gets verified | Mainly the data and documents in the file | The data and, at moments of risk, the person themselves |
| Customer friction | Concentrated in mass update campaigns | Spread out and proportional, only when there’s a reason |
| Audit evidence | Snapshots spaced out over time | A continuous history of events, decisions and responses |
If I had to pick one row, it would be the last. When a supervisor reviews a file, checking that it’s up to date is only the starting point, and the conversation tends to move towards how the institution knew it needed updating and what it did next. That question only has a good answer when there’s a history behind it.
What Triggers a Perpetual KYC Review
Each institution defines its triggers according to its own risk model, although in banking and fintech the most common ones tend to repeat:
- Changes to personal or company data, such as a new address, a change of beneficial owner or a change of business activity.
- A device or location that doesn’t match the customer’s history.
- Unusual transactions by amount, frequency or destination.
- Matches on sanctions lists or in adverse media.
- Changes in the customer’s risk rating.
- An identity document reaching its expiry date.
Drawing up this list is the easy part. The hard part, and where a pKYC project succeeds or fails, is deciding what response each event deserves. If every change of address triggers a full review, the model produces more alerts than a team can handle and ends up recreating the very backlog it was meant to clear. A change of address can be handled with a data update, whereas a login from an unknown device followed by a large transfer does justify confirming again who is behind it.
How Perpetual KYC Works Across the Customer Lifecycle
An event-driven model only works if each moment in the relationship produces information that can be used in the next one. That’s why orchestrated identity verification matters so much, since whatever is captured at onboarding, at each login or at each review is tied to the same identity and becomes the reference for later decisions.
1. Onboarding
Digital onboarding combines document verification, facial biometric matching and passive liveness detection, which confirms that a real person is in front of the camera without asking them for extra gestures. Everything that follows will be measured against what is captured here. That’s why onboarding shouldn’t be treated as a step to shorten at any cost.
2. Logins and Sensitive Changes
When a customer logs in from a new device, changes their phone number or email, or modifies the details used to recover the account, biometric re-authentication confirms that they are still the same person verified at onboarding. These are the moments most sought after by anyone trying to take over a legitimate account. They are also the ones where a password or a one-time passcode offers the least certainty.
3. Risk Events
An unusual transaction, a change of ownership or a signal that doesn’t fit the history doesn’t always call for the same response. Re-verification is adjusted to the level of risk. In some cases a light additional check is enough, and in others it makes sense to repeat biometric verification before authorising the transaction.
4. Ongoing Monitoring
Between one event and the next, the relationship keeps generating information. Ongoing AML screening checks customers against sanctions lists, politically exposed persons and adverse media as those lists are updated. Behavioural signals help detect when the way an account is being operated stops resembling its holder’s. None of these sources decides on its own, and their value lies in feeding the triggers described in the previous point.
From Perpetual KYC to Continuous Identity
This is where I think the debate around perpetual KYC falls short. Perpetual KYC solves the compliance side, keeping due diligence up to date when risk changes, and it is part of a broader approach. Continuous identity manages identity as an asset that builds up evidence throughout the relationship, from onboarding to every login and every sensitive transaction. It also uses biometrics to confirm again that the person is who they claim to be at the moments when risk calls for it.
Identity is built at specific moments, such as onboarding or a re-verification, and consulted continuously whenever a decision has to be made about that customer.
In practice, it means deciding with everything already known about that identity and asking for a new verification only when the context justifies it. Subjecting customers to constant checks would be as irritating for them as it would be unhelpful for the institution. An identity with five years of history and several successful verifications offers a very different basis for a decision than one created ten minutes ago, without the latter having to be suspicious. Treating them the same is one of the easiest mistakes to make when a model relies solely on fixed rules.
It’s the same question that closed my analysis of the CISO and AI agents: knowing with certainty whether, on the other side of a transaction, there is a legitimate person, an authorised agent or an impersonation attempt. That’s where perpetual KYC and continuous identity meet, because a flawless file is of little use if nobody knows who is operating the account.
What Regulators Expect From Ongoing Due Diligence
The obligation to review customers during the relationship is nothing new. FATF Recommendation 10 includes ongoing monitoring of the business relationship within customer due diligence, with scrutiny of transactions and keeping the documents, data and information collected up to date. What is changing is the level of detail with which institutions are expected to comply and, above all, their ability to prove it, which is the core of demonstrable KYC.
In the European Union, the EU AML Regulation (2024/1624) sets specific timeframes. Its Article 26 sets a maximum interval between updates of customer information of one year for higher-risk customers and five years for all others. It also requires an earlier review when relevant circumstances change. Read carefully, the article leaves little room for a comfortable interpretation. Five years is the most that is tolerated, and an institution that applies that interval to its entire low-risk portfolio meets the limit but skips the assessment that should determine each interval. The regulation will apply from July 2027.
In Spain, Ley 10/2010 already sets out the ongoing monitoring of the business relationship in its Article 6. This includes scrutinising transactions and keeping customers’ documents, data and information up to date.
In Latin America the direction is the same. In Mexico, the Disposiciones de carácter general under Article 115 of the Ley de Instituciones de Crédito link the updating of customer files to each customer’s risk level. In addition, the reform published in the Diario Oficial de la Federación on 10 July 2026 gives institutions eighteen months to adapt their identification, verification and monitoring processes. In Colombia, ongoing SARLAFT monitoring points in the same direction.
Across all these frameworks, the supervisor’s question ends up being whether the institution detected in time that something had changed and what it did next.
How to Implement Perpetual KYC in Five Steps
Moving from reviewing customers on fixed dates to reviewing them when something changes in the relationship takes more process redesign than technology. If I had to give one piece of advice before getting into the steps, it would be to start by deciding which events should trigger a review and how what was done will be proven afterwards, and to leave the technology for the middle.
- Map the trigger events. Define which changes in the customer’s data, behaviour or risk should trigger a review, and what level of response each one requires.
- Unify identity evidence. Bring together in a single history the onboarding verifications, the authentications and the subsequent reviews, so that every decision starts from everything already known about the customer.
- Re-verify with biometrics at moments of risk. Confirm the person again when the event justifies it, with a level of scrutiny proportional to the risk.
- Orchestrate signals in one platform. An identity orchestration platform allows verification, authentication and the signals from each session to work with the same identity as a reference, so that each trigger is assessed with all the accumulated context rather than with each system’s isolated information.
- Measure and audit. Record which event triggered each review, what was decided and why, and check at regular intervals whether the triggers are still the right ones.
Done well, perpetual KYC changes what an institution can explain about its customers. With the periodic model, it knows what they looked like on the day of their last review. With the perpetual model, it can say what has changed since then, when it found out and what it did about it, which is exactly what it will be asked.
FAQs
It is a model in which customer due diligence is updated when a relevant event occurs, such as a change in data, behaviour or risk. It is applied instead of relying solely on a fixed review calendar.
Periodic KYC reviews the customer at set intervals based on their risk level. Perpetual KYC triggers a review when an event changes that risk, so information stays up to date between one review and the next.
It depends on the regulation and the customer’s risk. The EU AML Regulation (2024/1624), applicable from July 2027, sets a maximum of one year between updates for higher-risk customers and five years for all others. It also requires an earlier review if relevant circumstances change.
Common triggers include changes to personal or company data, a new device or location, unusual transactions, matches on sanctions lists or in adverse media, changes in the customer’s risk rating and the expiry of identity documents.
No. Perpetual KYC keeps information up to date between reviews, while enhanced due diligence remains mandatory for high-risk customers and transactions. Perpetual KYC helps detect earlier when it needs to be applied.
Perpetual KYC is the compliance component, the part that keeps due diligence up to date when risk changes. Continuous identity is the full approach. It builds up the evidence of an identity throughout the relationship and uses biometrics to confirm the person again at the moments when risk calls for it.
It starts by defining the events that should trigger a review and unifying identity evidence. The person is then re-verified with biometrics at moments of risk, and signals are orchestrated in a single platform with an audit trail.
No. Continuous authentication confirms that the person accessing an account is the legitimate user, while perpetual KYC keeps the customer’s due diligence up to date. The two complement each other when biometric re-verification is triggered at moments of risk.
