The KYC refresh process brings an existing customer's due diligence file back into line with what the bank knows about the customer today: it confirms what has changed, updates the affected parts of the file, re-screens anyone new, re-runs the customer risk rating, asks the customer for anything missing and has a second person approve the result. Run on a calendar, the process starts on a due date and covers the whole file. Run on events, it starts when something relevant changes and covers only the sections that change touches, which is how the OCC has asked banks under enforcement to work. Botminds' Perpetual KYC (pKYC) runs the event-driven version, with agents doing the detection and drafting and an analyst and a separate QC reviewer making every decision.
The example on this page is a fictional sample customer as it runs through the solution: Tidewater Freight Brokers LLC, a Delaware freight broker banked by the equally fictional Corvane National Bank, rated Medium and last fully reviewed on March 11, 2025.
The same three years on two clocks: the calendar waits, events act
- ReviewQ1 25
- Two material changes wait for the next date11 quarters
- ReviewQ1 28
- ReviewQ1 25
- Quiet5 quarters
- ACHQ3 26
- OwnerQ4 26
- Backstop clock, High risk4 quarters
- Next
What is a KYC refresh?
A KYC refresh is the update of an existing customer's due diligence, as opposed to the due diligence done when the customer first opens an account. In US rules it is the "maintain and update customer information" duty of ongoing customer due diligence, done on a risk basis. Banks also call it a periodic review, a KYC review or a KYC update, and the trade sometimes uses refresh for the event-driven kind and periodic review for the calendar kind.
A refresh is not remediation and not re-onboarding. It assumes the file was complete and correct at its last review and asks what has moved since. That assumption is why the process can be section by section: a file that was right in March 2025 is still right in every section nothing has touched.
The calendar KYC refresh cycle, step by step
The calendar KYC refresh cycle starts when a file's review date arrives and ends when a checker signs it off. In most banks it runs in six steps, repeated for every file whose date has come up, whether or not anything changed.
The analyst first works out what has changed, searching the registry, the core banking system and the screening history. Then each section of the file is re-collected or re-documented, the owners and control persons are re-screened, the risk rating is re-run, a request goes to the customer for anything missing, and finally a QC reviewer checks the work before the systems are updated. The customer is often asked to re-certify information the bank already holds, because the cycle does not distinguish between what changed and what did not.
Where an analyst's hours go on one corporate file: calendar against event refresh (our estimate)
Calendar review, all nine sections · 13.5 h
- Find what changed 2 h · 15%
- Re-collect sections 6 h · 44%
- Screen, rate, request 3.5 h · 26%
- Maker and QC 2 h · 15%
Event refresh, two sections, agents drafting · 1.0 h
- Check drafts and sources · 20%
- Screen, rate, request, detect · 30%
- Maker and QC · 50%
Why a full re-collection still misses changes
A full review on a date can be thorough and still be late, and it can be repeated and still be stale. The calendar's first failure is timing: a change that lands the month after a review waits years. Its second failure is subtler: when every file is reviewed in the same way on schedule, reviews drift toward confirming what the last review said.
FinCEN found exactly that in its October 2026 action against Bank of America, which reviewed higher-risk customers quarterly: "in some instances, Bank personnel repeated observations from one quarter to another, and the relevant observations failed to take into account information about the customer's activities relevant to assessing the risk" (FinCEN, Bank of America, 2026). Frequent reviews were not the problem. Reviews that did not start from what had changed were.
The older version of the same failure is the checklist. Describing a bank's Moscow onboarding, New York's Department of Financial Services found manual procedures that worked as a checklist, with staff intent on gathering documents rather than questioning what the customer had told them (NYDFS, Deutsche Bank, 2017). A periodic review built as a document checklist invites the same mechanical work, every few years.
The event-driven KYC refresh process in seven steps
The event-driven KYC refresh process starts with a change and follows it through the file. In the OCC's 2022 order against USAA, the bank was told to collect due diligence information at opening, again on a risk-based cycle, and whenever events showed information missing, a profile out of date, or activity that did not fit the profile (OCC, USAA FSB, 2022; the trigger events regulators have named collects the orders). Those three event types are the backbone of most trigger policies, and the steps below turn them into a process.
First, an event arrives from a source system and is linked to a customer: a registry filing, a core banking change, a screening hit, an adverse media article, a transaction monitoring alert or a change in the client lifecycle system. Second, it is decided material or not under a numbered rule, with the reason kept either way. Third, the sections it touches are identified and redrafted, each new value with a source. Fourth, any new party is screened and the risk rating re-run on the factors that moved. Fifth, a request to the customer is drafted if something is missing. Sixth, an analyst approves as maker. Seventh, a different reviewer approves as checker and the systems of record are updated.
On Tidewater, that sequence took 52 minutes of elapsed time. The Panama registry filing arrived at 9:14 AM; the event was judged material at 9:15 under two rules, a new owner of 25% or more and ownership through a country in the bank's highest risk tier; the agents had drafted two sections by 9:17 and the refresh reached analyst Priya Natarajan at 9:18; she approved as maker at 9:29 and QC reviewer Daniel Okonkwo approved at 10:06.
Step three in Perpetual KYC (pKYC): every redrafted value opens its source document
Which sections of a KYC file need refresh?
Only the sections the event touches, which is why the file has to be organised into sections in the first place. A KYC file that is one long document cannot be refreshed in part; a file of named sections, each with its own last-reviewed date and its own sources, can. The sample bank's corporate files have nine.
Nine sections of a corporate KYC file, and the events that usually touch each
| Section | Events that usually touch it | Typical evidence |
|---|---|---|
| 1 · Identity and registration | Name change, new registered address, annual report, dissolution | Registry filing, certificate of good standing |
| 2 · Beneficial owners and control | New or departing owner of 25% or more; new control person | Registry entry, certification, share register |
| 3 · Nature and purpose | New line of business, merger, product use outside the stated purpose | Customer statement, relationship manager note |
| 4 · Expected activity | New product, sustained deviation from the activity profile | Transaction monitoring, product records |
| 5 · Geographies | New country of operation, ownership or counterparties; change in country risk tier | Registry, wire history, country risk policy |
| 6 · Products and services | New account type or service, such as ACH origination | Core banking and lifecycle records |
| 7 · Screening and adverse media | List update, new party, adverse article | Screening results with identifiers used |
| 8 · Related parties | New signer, guarantor or affiliate | Core banking signer records |
| 9 · Documents and certifications | Expired document, new certification | Document imaging |
Two sections are touched far more often than the rest: screening, by every list update, and expected activity, by monitoring. Ownership changes are rarer and matter more, and they are where the event-driven process earns its keep. The trigger events regulators have named map onto these sections almost one for one.
An address change is not an owner change
The event-driven process scales only if small changes stay small. FinCEN's FAQ B.19 sets the scale: an updated address for an existing beneficial owner whose identity has already been verified can usually be confirmed with the customer by phone and reflected in the bank's systems, without full re-certification, while a new beneficial owner must be identified, certified and verified as at account opening (CDD Rule FAQs, B.19 and B.20). FAQ B.20 adds that the elements of identification and verification at a triggering event are the same as at opening.
In the sample bank, that line is written into the trigger policy. A consumer's move from Ohio to Florida is not material under rule T-02, because a move within the US matters only if the new address is a commercial mail receiving agency, a PO box or a top-tier risk country; the call is kept with its reason and may be sampled by QC. A new 30% owner is material under T-07 and starts the full refresh of the ownership section, including a new certification from the customer.
Steps four and five in Perpetual KYC (pKYC): parties re-screened, rating re-run, request drafted
The KYC periodic review checklist, rewritten for events
A periodic review checklist lists every document to collect. An event refresh checklist lists every decision to make, and most of them concern what not to redo.
A KYC refresh checklist for one event
- Is the event linked to the right customer?
Legal name and registry number, not name alone; an uncertain link goes to a person.
- Which numbered rule makes it material, or not?
Keep the rule and the reason either way; a not-material call is still a decision.
- Which sections does it touch, and which does it leave alone?
The untouched sections keep their own last-reviewed dates.
- Does every new value cite its source?
A registry entry, a lifecycle record or a document on file, opened in one click.
- Are new parties screened, with the identifiers used to clear any similar name?
A potential true match goes to the sanctions team, never cleared in the refresh.
- Which rating factors moved, and is the new rating proportionate?
Proposed until maker and checker approve.
- What, if anything, must the customer supply?
Only what the event made missing; checked for tipping off before it is sent.
- Did a different person approve each item?
Maker and checker are different people, item by item.
What the refresh leaves for the examiner
An examiner testing a refresh program asks two questions, and the event-driven process answers both with evidence rather than a schedule. The FFIEC's beneficial ownership procedures ask whether the bank "has adequate risk-based procedures for updating customer information, including beneficial owner information, and maintaining current customer information" (FFIEC examination procedures, beneficial ownership). Its customer due diligence procedures then "select a sample of customer information" and test whether it supports the risk profile (FFIEC examination procedures, CDD).
For a sampled file, a section-level refresh leaves a trail an examiner can follow: the event, the rule that made it material, the sections touched, the sources, the screening, the rating factors, the maker and the checker, and the dates on every section. For an event closed without action it leaves the rule and the reason, and whether QC sampled it. Testing an event-driven KYC review with planted events covers how to show that those closures were right in aggregate, not just one by one.
Questions people ask
What is the KYC refresh cycle?
It is the interval at which a bank re-reviews existing customers' files, usually set by risk tier in the bank's own policy, for example one, three or five years. US rules set no cycle; the EU AMLR caps it at one year for higher-risk customers and five for others from July 2027. In an event-driven program the cycle becomes a backstop for files no trigger has reached.
What is the KYC periodic review process?
It is the calendar version of a refresh: on the due date, an analyst re-documents every section of the file, re-screens owners and controllers, re-runs the rating, writes to the customer and passes the file to a checker. The event-driven version runs the same steps on only the sections an event touched.
How do you do a KYC refresh on a corporate customer?
Start from what changed: identify the event and the sections it touches, refresh those with sources, screen any new owner or control person, re-run the rating factors that moved, ask the customer only for what is missing and have a second person approve. A new beneficial owner must be collected, certified and verified, per FinCEN's FAQ B.19.
What is the KYC review process for a customer who does not respond?
The bank's procedures should set deadlines, reminders and consequences in advance. The OCC's 2024 order against TD Bank required procedures that impose consequences, promptly, on customers who do not supply the CDD information asked of them, which in practice range from restricting products to exiting the relationship under the bank's policy.
How long does a KYC refresh take?
It depends on the file and the customer's response time, which usually dominates. On the fictional sample customer above, the event refresh took 52 minutes from filing to second approval; the customer then had until November 5 to return a signed certification.