The KYC periodic review analyst, after perpetual KYC

A KYC periodic review analyst re-opens a customer's due diligence file when the calendar says it is due, re-collects each section, re-screens the owners, re-runs the customer risk rating and sends the file to a second person to check. Under many banks' policies the date comes round every year for a high-risk customer and every three or five years for the rest, whether or not anything about the customer has changed. Perpetual KYC (pKYC) moves the trigger from the date to the change itself, and that reshapes the analyst's job more than it shrinks it: the periodic review team becomes an event desk that works material changes and a quality control desk that tests the changes nobody acted on. Botminds' Perpetual KYC (pKYC) is built around exactly those two seats.

The people and numbers on this page come from a fictional sample bank, Corvane National Bank, as it runs through the solution: 64 KYC analysts, 22 QC reviewers and a corporate customer called Tidewater Freight Brokers LLC. Research figures come from regulators and are linked where they appear.

What does a KYC periodic review analyst do today?

A KYC periodic review analyst brings an existing customer's file back up to the bank's current standard on a fixed cycle. The job has five recurring parts: find out what changed since the last review, re-collect and re-document each section of the file, re-screen the owners and control persons against sanctions, politically exposed person and adverse media lists, re-run the customer risk rating, and write to the customer for anything missing. A second person then checks the work before the file closes.

That two-person shape is not new to refresh work. Describing how 11 banks handled due diligence at account opening, the GAO found that front-line staff collect the information and a second person, often the BSA/AML officer, checks that it is complete and looks for warning signs (GAO-20-574). Periodic review copies the pattern: an analyst prepares, a checker signs. The difference is that at opening there is a new customer to learn about, while at a periodic review the analyst is usually confirming that an existing customer is still the customer the file describes.

The role sits inside a larger occupation that the government does count. The Bureau of Labor Statistics has no series for "KYC analyst"; the work is classified with compliance officers, an occupation of 436,400 jobs in 2025, projected to reach 453,100 by 2035, with a median wage of $80,730 (BLS Employment Projections). That figure covers all industries, not banks alone, so it is a ceiling on the population, not a count of refresh analysts.

Why the calendar makes the periodic review seat repetitive

The calendar decides which file an analyst opens, not whether that file needs work. FinCEN's own answer to the question of a fixed schedule is that there is "no categorical requirement" to update customer information on one; the obligation is risk based and arises from normal monitoring (CDD Rule FAQs, F.6). What perpetual KYC means under the US rule sets out that reading in full. The schedule is the bank's own policy, and most of the time a policy review lands on a file where nothing material has happened.

The cost of that is easy to see in one sample file. Tidewater Freight Brokers had its last full review on March 11, 2025, rated Medium; under the bank's 36-month calendar the next one was due in March 2028. In the 19 months after that review, five events reached the file. Two were material: an ACH origination service added in July 2026, which changed two sections, and a new owner in October 2026, which changed two more. A full review in 2028 would have re-collected all nine, long after both.

The second bar is the important one. With the drafting removed, half of what remains is the review and approval by two people. That is where the job goes: from re-typing a file into judging a change.

Will perpetual KYC replace periodic reviews?

No, not entirely, and regulators have said as much in their own orders. In its October 2024 consent order against TD Bank, the OCC required a due diligence program that collects updated information when events call for it, and in the same article required "risk-based criteria establishing how often to conduct periodic reviews of customers" and a quality control check that the bank's CDD policies and procedures were actually followed (OCC consent order AA-ENF-2024-77; how to size that check is in KYC quality assurance sampling). Events, a cadence and quality control: the order asks for all three.

What pKYC replaces is the full re-collection on a date. What it keeps is a backstop: a review that runs if no trigger arrives within a set time. In the sample bank that is 12 months for a High-risk customer, a setting the bank chooses. Tidewater, re-rated High after a new owner in Panama on October 22, 2026, now has a backstop review on October 22, 2027, in case nothing else reaches the file first.

For the analyst this means two kinds of work instead of one. Most of the week goes to event refreshes. A smaller, predictable share goes to backstop reviews of files that have been quiet for a long time, which are now rarer and more interesting, because a high-risk customer with no events in a year is itself worth a look.

The event desk: what a KYC refresh analyst does instead

A KYC refresh analyst on an event desk works changes, not dates. Each item in the queue is one event that the bank's trigger policy calls material, routed with a service level by risk tier, and each arrives with the sections it touched already drafted and sourced. The analyst's work is to check the draft, add what only a person with the customer's context can add, and decide as maker.

At the sample bank on October 22, 2026, 2,318 events came in between midnight and 9:24 AM. 146 were material and went to analysts; the other 2,172 were logged as not material, each with its rule and reason. One of the material ones, a filing with the Panama Public Registry showing a new 30% owner of Tidewater, reached analyst Priya Natarajan at 9:18 AM with a one-business-day deadline. She saw two of nine sections changed: beneficial owners and geographies.

What the event desk sees in Perpetual KYC (pKYC): only the touched sections

Her eleven minutes went on three things the agents could not do. She opened the registry entry behind the new owner and checked the sellers against the old percentages. She read the proposed rating change, Medium 41 to High 63, factor by factor. And she added one line of her own to the geographies section, suggested from twelve months of wire history: no Panama transaction activity. Then she approved as maker with a reason code, and the refresh moved to a different person.

The skills that matter shift with the seat. Speed at gathering documents matters less. Judgement about whether a change is real, whether a rating move is proportionate and whether a customer message says too much matters more, because those are the decisions the analyst now signs. A bank that hires for the event desk should test for that judgement, not for familiarity with a document checklist.

The checker seat: who does KYC quality control?

KYC quality control is done by a reviewer who did not prepare the work, and under pKYC that reviewer has two jobs, not one. The first is the familiar one: approve or return each change an analyst prepared. The second is new: test the events that were closed with no action, because those are where an event-driven program can fail silently.

At the sample bank, QC reviewer Daniel Okonkwo approved Tidewater's refresh at 10:06 AM as five separate items: the owners section, the geographies section, the rating, the request to the customer and a new enhanced due diligence review due November 21. He could have returned any one of them alone. The screen shows that the checker differs from the maker, and the system will not let an analyst approve her own work.

In Perpetual KYC (pKYC) the checker approves item by item, and cannot be the maker

The second job is the one the old periodic review seat never had. Every day the solution draws 10% of the "no action" calls, by trigger family, for QC to grade; that sampling rate is a design target and a bank setting. On October 22 that was 217 calls across the team, 42 of them in Daniel's queue. When a family's pass rate falls under a floor, 97% in the sample bank, a review of the rule behind it opens for the head of KYC operations.

What the head of KYC operations owns after the switch

The head of KYC operations stops managing a calendar backlog and starts managing a flow. The numbers that matter are the open material events, how many are inside their service level, the pass rates by trigger family, and the bulk changes, such as a country risk policy change, that touch thousands of files at once.

Bulk changes are where the old model broke down worst. One policy change used to become thousands of tickets. In the sample bank, two countries moved to the highest tier of the country risk policy on October 15, touching 2,186 customers; 1,804 kept their rating and were logged unchanged, and 382 rating increases were prepared as one batch, approved by a checker on a 38-file sample. Customer due diligence refresh when one event hits thousands walks through that batch.

The head also owns the rules. A trigger rule change is drafted in operations, tested against recent events and approved by the BSA officer, with model risk involved as the bank's own governance decides. That makes the trigger policy a living document with a version number, which is what an examiner will ask for when asking why a given event was closed.

How many KYC analysts does a bank need after pKYC?

Fewer people re-collecting files and more people judging changes, but no regulator or independent study gives a ratio, and a bank should be wary of anyone who quotes one. The honest way to size the two desks is from the bank's own numbers: the rate of material events per thousand customers, the minutes each takes to decide, the share of "no action" calls sampled and the minutes each sample takes to grade.

The table also shows why the QC desk does not shrink in proportion. Every change still needs a second person, and the daily sample adds work the calendar model never did. Corvane staffs 22 QC reviewers against 64 analysts, and that is the point: under pKYC the evidence that the program works is produced by the checkers. The KPIs and program math for a KYC tracking system turns those inputs into a business case.

KYC periodic review job description: what to rewrite

A job description written for a calendar team asks for the wrong things. It lists document collection, outreach volumes and turnaround per file. For an event desk, the requirements are closer to an investigator's: reading registry filings and ownership chains, judging whether a change is material under a written rule, and writing a short, defensible reason.

Examiners judge the process more than the individual call. The FFIEC manual says a bank with an established and effective risk decision process should not be faulted for a single customer decision unless that decision weakens the CDD program as a whole or comes with bad faith or other aggravating factors (FFIEC BSA/AML Manual, CDD). That is an argument for hiring people who write their reasons down, and for a QC seat that reads them.

The cost of not changing the operating model shows up in enforcement. FinCEN found that a broker-dealer, until December 2022, "did not maintain any process to require consistent updates to CDD and customer risk profiles", with updates "occurring on a limited, ad hoc basis" (FinCEN, Canaccord Genuity, 2026). Ad hoc updating is what a team with no event desk and no sampling ends up doing, whatever its calendar says.

Questions people ask

What does a KYC refresh analyst do?

A KYC refresh analyst updates an existing customer's due diligence file: confirming what changed, re-documenting the affected sections, re-screening new parties, re-running the risk rating and asking the customer for anything missing. In an event-driven program the analyst works only the sections an event touched and approves the change as maker; a different reviewer approves it as checker.

What is a KYC refresh team?

It is the team that keeps existing customers' files current, as distinct from the onboarding team and from a time-boxed remediation project. Under perpetual KYC it usually splits into an event desk that works material changes and a QC desk that approves changes and samples the events closed without action.

Is a periodic KYC review specialist the same as a KYC analyst?

Usually yes; banks use periodic review specialist, refresh analyst and KYC analyst for overlapping roles. There is no federal occupational series for any of them: the BLS counts the work under compliance officers, 436,400 jobs across all industries in 2025.

Who does KYC quality control?

A reviewer who did not prepare the work. The OCC's 2024 order against TD Bank required quality control to confirm the CDD procedures were being followed. Under pKYC the checker also grades a daily sample of the events closed without action, which is the only way to show those closures were right.

Does perpetual KYC mean fewer KYC analysts?

It means less re-collection work and more judgement work. Every change still needs a maker and a different checker, and the daily sample of "no action" calls is new work, so the QC desk tends to grow while the re-collection desk shrinks. Size both from a replay of your own trigger events rather than from a vendor ratio.