How often should KYC be updated? The US, EU and UK answer differently

How often should KYC be updated? In the United States, as often as risk requires and whenever monitoring shows that something relevant has changed, with no fixed interval in any rule. FinCEN says there is no categorical requirement to update customer information on a periodic schedule, so the familiar cycle of one year for high-risk customers, three for medium and five for low is a policy many banks choose, not a legal minimum. The European Union is about to answer differently: from 10 July 2027 its Anti-Money Laundering Regulation caps the gap between updates at one year for higher-risk customers and five years for everyone else. Botminds' Perpetual KYC (pKYC) is designed for the US model, refreshing files on trigger events, with a backstop review interval a bank can set to meet the strictest rule it operates under.

How often must customer due diligence be updated in the US?

US banks must update customer due diligence on a risk basis, with no interval set by rule. The ongoing due diligence element of the AML program requires procedures to "maintain and update customer information" on a risk basis, including the beneficial owners of legal entity customers (31 CFR 1020.210). FinCEN's FAQ F.6 adds that updating follows from what normal monitoring turns up, and that there is no categorical schedule, continuous or periodic.

The examination manual says the same thing from the examiner's side. "The ongoing monitoring element does not impose a categorical requirement that the bank must update customer information on a continuous or periodic basis", the FFIEC writes, before adding that the bank "may establish policies, procedures, and processes for determining whether and when, on the basis of risk, periodic reviews to update customer information should be conducted" (FFIEC BSA/AML Manual, CDD). A schedule is allowed and common. It is not required.

Two practical consequences follow. A US bank that never updates a file until its calendar date has not broken a timing rule, but it has a problem if monitoring showed a change and nothing happened. And a US bank that drops the calendar entirely has not broken a rule either, provided it can show that changes found by monitoring lead to updates. Perpetual KYC, defined from the US rule, starts from that point.

How often should KYC be updated for high-risk customers?

Under US rules, whenever the risk calls for it; under many banks' own policies, at least once a year; and under the EU AMLR from July 2027, at least once a year by law. That convergence on one year is why "annual review" is so often mistaken for a federal requirement. It is not one in the US. It is a common bank policy, and in the EU it will be a ceiling.

What US banks actually do with high-risk customers is often more frequent than a refresh. Describing banks on the Southwest border, the GAO reported one that monitors high-risk customers' transactions "every 3 months, compared to every 6 months for medium-risk customers", and another that asks for three months of prior bank statements from some high-risk businesses, work it called "very time-consuming" (GAO-18-263). That is transaction review, not a full file refresh, but it is exactly the kind of monitoring that produces the triggers an event-driven program acts on.

Where the one, three and five year cycle comes from

The tiered cycle is an operational convention, and its appeal is administrative: it spreads a bank's back book across years in predictable batches. It became the default long before regulators clarified that the rule set no schedule, and it survives because it is easy to plan staff around and easy to show an auditor. Its weakness is that it is blind between the dates.

The sample bank used on these pages had one: Medium-rated customers were reviewed every 36 months. Its customer Tidewater Freight Brokers, a fictional Delaware freight broker, had a full review on March 11, 2025, and was next due in March 2028. On October 22, 2026, a Panamanian company bought 30% of it. Under the calendar, that change would have sat in the file unseen for 17 months.

The EU answer: hard maximums from 10 July 2027

From 10 July 2027, EU banks must update customer information at least every year for higher-risk customers and every five years for all others. The regulation's text is direct: the period between updates "shall be dependent on the risk posed by the business relationship and shall not in any case exceed: (a) for higher risk customers to which measures under Section 4 of this Chapter apply, 1 year; (b) for all other customers, 5 years" (Regulation (EU) 2024/1624, Art. 26(2)).

Two details matter for a bank planning its program. The caps are ceilings, not a schedule: the same article ties the interval to risk, so an EU bank is still expected to act on changes between the dates. And the caps apply to the customer information being kept up to date, which a section-level, event-driven refresh can satisfy, provided every section is touched within the limit. A file whose owners were refreshed last month but whose nature-and-purpose section dates from four years ago is a five-year problem in waiting, not a solved one.

As a regulation it applies directly in every member state, so the numbers will not vary by country. It applies to most obliged entities from 10 July 2027; certain football agents and clubs follow in 2029.

The UK and FATF answer: reviews, without a number

The UK and the global standard setter both require existing records to be reviewed and kept up to date, and neither fixes an interval. The UK Money Laundering Regulations 2017 define ongoing monitoring to include "undertaking reviews of existing records and keeping the documents or information obtained for the purpose of applying customer due diligence measures up-to-date" (MLR 2017, regulation 28). How often is left to the firm's risk assessment.

The FATF Recommendations take the same line and add an emphasis. The interpretive note to Recommendation 10 asks institutions to keep data "up-to-date and relevant by undertaking reviews of existing records, particularly for higher-risk categories of customers", and to apply due diligence to existing customers according to how material and risky they are, at suitable moments (FATF Recommendations, R.10 and INR.10). The recommendation also lists a trigger in its own right: due diligence is required when the institution "has doubts about the veracity or adequacy of previously obtained customer identification data".

A global bank's refresh policy is the strictest overlay

A bank with customers in several jurisdictions needs one policy that satisfies the strictest rule each customer falls under, and from July 2027 that is usually the EU's. For a US-only bank, event-driven refresh with a risk-based backstop is fully compliant. For a group with an EU entity, the same design works if the backstop for EU customers is set no longer than the AMLR ceilings and runs per section, so that no part of a file goes past the limit.

That is why the backstop interval is a setting, not a constant. In the sample bank, a High-risk customer with no trigger gets a backstop review 12 months after its last refresh; the bank could choose 24 months for US customers and 12 for an EU book. Tidewater, re-rated High on October 22, 2026, has its backstop on October 22, 2027, unless another event refreshes it first.

The overlay has one trap. A global policy written to EU ceilings and applied to the whole book quietly turns a US bank back into a calendar shop, with the cost that brings. The better design applies the ceiling only where the law applies and keeps the US book event-driven. The KYC refresh process, moved from the calendar to events, shows the section-level mechanics that make that split workable.

How often should KYC be updated for low-risk customers?

For low-risk customers, the US answer is still "when something relevant changes", and in practice most low-risk files change rarely and modestly. Many banks review them every five years or not at all outside events; the EU will require an update at least every five years. What matters more is how a low-risk change is handled when it does arrive.

FinCEN draws a useful line in FAQ B.19: if the only update is "a change of address for an existing beneficial owner", a full new certification is probably unnecessary and the bank may confirm it verbally, while a change of beneficial owner means the new owner must be "collected, certified, and verified" (CDD Rule FAQs, B.19). Low-risk events mostly fall on the first side of that line.

A low-risk change in Perpetual KYC (pKYC): decided and kept with its reason, not reviewed in full

Notice the other dates on that screen. Most sections of Lena Marsh's file carry a last-reviewed date of June 2, 2022. Under US rules that is fine if nothing relevant has happened. Under an EU-style five-year ceiling, the remaining sections would come due by June 2027, and a backstop setting would have to catch them. The same file can be compliant in one jurisdiction and overdue in another.

Writing a refresh frequency policy that holds up

A refresh frequency policy holds up when every interval and every trigger can be traced to a rule or to the bank's own risk assessment. The checklist below is a starting point for the policy owner.

Questions people ask

Is an annual KYC review required in the US?

No. FinCEN's FAQ F.6 says there is no categorical requirement to update customer information on a periodic schedule, and the FFIEC manual says the same. Annual review of high-risk customers is a common bank policy; regulators expect updates driven by risk and monitoring.

What is the KYC update frequency under the EU AMLR?

From 10 July 2027, at most one year between updates for higher-risk customers subject to enhanced measures and five years for all other customers, under Article 26(2) of Regulation (EU) 2024/1624. The interval must still depend on risk, so these are ceilings rather than targets.

What are the AML periodic review requirements for US banks?

The requirement is to maintain and update customer information on a risk basis under 31 CFR 1020.210, not to review on a calendar. Examiners test whether the bank's procedures for updating are adequate and whether customer information supports the risk profile; a schedule is one acceptable way to do that.

How often should KYC be updated for medium-risk customers?

The US rule sets no figure. Many banks use three years; the EU's five-year ceiling covers them from 2027. Under an event-driven model, a medium-risk file is refreshed when a trigger touches it, with a backstop review only if it stays quiet.

Does a KYC refresh mean re-collecting every document?

No. A refresh updates what has changed or gone stale. FinCEN's FAQ B.19 says an address change for an existing owner can usually be confirmed verbally without full re-certification, while a new beneficial owner must be collected, certified and verified.