KYC trigger events: a list built from regulators' own orders

KYC trigger events are changes in a customer's circumstances that should make a bank update the customer's due diligence file now rather than at the next scheduled review: a new owner or control person, a new country, activity that no longer matches the expected profile, information that turns out to be missing, a screening hit or adverse news. They matter because US rules tie the duty to update to what the bank learns through monitoring, not to a calendar, so the trigger list is where that duty becomes concrete. The useful thing about the list is that regulators have written most of it in their own orders. Botminds' Perpetual KYC (pKYC) holds a bank's list as a numbered, versioned trigger policy and decides every incoming event against it, keeping the rule and the reason for each call.

What triggers a KYC review?

A KYC review is triggered by any information the bank learns, through normal monitoring, that is relevant to the customer's risk profile. That is FinCEN's formulation, and it is deliberately open: the rule does not list events. What turns it into a list is the bank's own trigger policy, and the strongest policies borrow their categories from what regulators have ordered banks to watch for when programs failed.

Those orders converge on a short set. The OCC's 2022 cease-and-desist order against USAA required due diligence at opening, periodically by risk, "and also when events indicate information is missing or incomplete, profiles need to be updated, or activity does not match the customer profile", and required the bank to develop "triggering criteria to maintain and update customer information" (OCC, USAA FSB, 2022). The checklist above adds the ownership and doubt triggers from FinCEN and FATF.

Ownership and control changes: the trigger with the most law behind it

A change of beneficial ownership is the clearest trigger, because the rule defines the threshold. Under 31 CFR 1010.230 a beneficial owner is each individual holding a quarter or more of a legal entity customer's equity, directly or through others, plus one individual with significant responsibility for running it (31 CFR 1010.230(d)). An event that creates a new 25% owner, removes one or replaces the control person changes the answer to a question the rule makes the bank ask.

FinCEN's February 2026 order narrowed when banks must re-identify owners, and in doing so named the trigger. Banks may now limit identification and verification of a company's owners to the first account, to any later time when the bank knows of facts that give it reasonable cause to doubt the ownership information it already has, and as their risk-based ongoing due diligence requires (FinCEN, FIN-2026-R001; FinCEN's 2026 CDD rule relief reads the order). Relief at the second account makes the trigger more important, not less: once the bank stops re-asking at every account, events are the main way it learns that owners changed.

Indirect ownership is where events get subtle. In the fictional sample used on these pages, a Panamanian company, Marisol Logistics Holdings, bought 30% of Tidewater Freight Brokers, a Delaware LLC. Marisol is wholly owned by one person, so that person became a 30% indirect owner of Tidewater, above the 25% line, without his name appearing on Tidewater's own documents. The filing that revealed it came from the Panama Public Registry.

Activity that does not match the customer profile

Activity outside the expected profile is the trigger that connects transaction monitoring to the KYC file. It does not mean every alert reopens the file; it means a pattern that changes what the bank believes about the customer should change the file too.

FinCEN's October 2026 action against Bank of America shows what happens when that link is missing. It describes a customer taken on as a small-to-medium commercial business expecting $1 million to $4 million in annual sales, which then received wires from high-risk jurisdictions many orders of magnitude larger than that (FinCEN, Bank of America, 2026; expected account activity shows how a profile should catch it). The profile said one thing, the activity another, and the profile was not the one that moved.

In the sample bank, the same morning's event list shows how the trigger reads in practice: "Three wires to a new country in five days, $412,600", from the transaction monitoring system, for a marine supply company. It was judged material and sent to an analyst the same morning.

Missing information, and event-driven information generally

Missing information is a trigger in its own right, and the OCC has twice written it into orders. The broader category, information that makes an update prudent, is the one the OCC used to describe the whole program in its 2024 order against TD Bank.

"…when the Bank obtains event-driven information indicating that it would be prudent to obtain updated information in order to understand the nature of its customer relationships and generate and maintain an accurate customer risk profile."

OCC consent order AA-ENF-2024-77, TD Bank, N.A., October 2024

The same order required procedures to find, and promptly fix, files missing required CDD information (OCC, TD Bank, 2024). Two practical triggers follow. A field that monitoring needs and the file lacks, such as expected activity for a business that has just started originating payments, is an event. So is a new product: in the sample bank, a customer asking to originate ACH payments was material, because it changes the products and expected activity sections.

Screening hits and adverse media: triggers with a filter

A sanctions or PEP list update and an adverse media match are triggers, but most of them should end as closed "no action" calls, not refreshes. FinCEN has said the CDD rule does not categorically require "the performance of media searches or particular screenings" on every customer (CDD Rule FAQs, F.4). Where a bank does screen, the trigger is a real match or a relevant article, not every similar name.

That filter is what keeps the trigger list workable. In the sample bank, the same morning's adverse media trigger, "Owner quoted in a local zoning dispute story", was not material and was kept with its reason. A sanctions list update the evening before touched 3,964 customers with similar names, and all but 23 were cleared on two or more identifiers. Customer due diligence refresh when one event hits thousands covers how those mass triggers are handled.

Does a change of address trigger a KYC review?

A change of address is an event, but usually not one that needs a full review. FinCEN's answer in FAQ B.19 is that an updated address for an existing, already-verified beneficial owner can generally be confirmed with the customer verbally and updated in the bank's systems, without re-certification. A change of owner is different and requires the new owner to be collected, certified and verified.

Most trigger policies therefore make an address change material only in specific cases. The sample bank's rule T-02 treats a move within the United States as not material unless the new address is a commercial mail receiving agency, a PO box or in a country in the top tier of its country risk policy. A move abroad, or to a mail drop, is a different event.

Does a periodic review trigger a beneficial ownership update?

No, not by itself. FinCEN's FAQ B.18 says banks have no obligation to solicit or update beneficial ownership "as a matter of course" during regular or periodic reviews, absent specific risk-based concerns; the obligation arises when monitoring turns up information relevant to the customer's risk, including a possible change of owner. A periodic review that re-collects owners from every customer is a policy choice, and one that asks customers for paperwork the rule does not require.

The flip side is that the periodic review is not a defence either. If the bank learned of a new owner in July and the periodic review was due in March of the following year, the duty arose in July. That is the gap an event-driven program closes, and the definition of perpetual KYC rests on exactly these two FAQs.

Material change in KYC: writing the threshold

A material change is one the bank's written policy says requires an update, and the work is in writing the policy precisely enough that two analysts reach the same answer. Each rule needs a number, a plain-language test, the sections it touches and a version. The sample bank's policy is versioned; its rules read like this.

The last row is the important one. A trigger policy is not finished when it is written; it is finished when its closures pass testing. In the sample bank, the screening and media family's pass rate fell to 96.1% after QC disagreed with five closures under T-19, all lawsuits with money claims over $1 million. A rule review opened, and the draft change would make those events material. How to test event-driven KYC review with planted events covers the testing side.

In Perpetual KYC (pKYC) every verdict can be questioned, and every answer cites the rule

Why are event-driven reviews important from a regulatory perspective?

Because enforcement keeps finding the gap between a policy that says files are updated and files that are not. FinCEN's 2026 action against Canaccord Genuity, a broker-dealer, found that although its policies had recently begun to require such updates, many existing customers' files had not yet been brought up to that standard (FinCEN, Canaccord Genuity, 2026). The OCC's orders against USAA and TD Bank responded to failures of that kind by naming triggers.

There is a quieter reason too. A trigger list makes the bank's judgement visible. An examiner who asks why a file was not updated after a given event can be shown the rule in force that day and the reason the event was closed. Without a list, the only answer is that the calendar date had not arrived, which FinCEN's own FAQs say is not how the duty works.

Questions people ask

What is a trigger event in KYC?

A trigger event is a change in a customer's circumstances that the bank's policy says requires an update to the due diligence file before the next scheduled review. Common ones are a new owner of 25% or more, a new control person, a new country of operation or ownership, activity outside the expected profile, a new product, a screening match or relevant adverse news.

What is a material change in KYC?

A change the bank's written trigger policy defines as requiring an update, measured against a threshold rather than a feeling. A new owner crossing the 25% line in 31 CFR 1010.230 is material by any policy; a move within the same country usually is not.

Event-driven reviews should be conducted when?

When monitoring shows information relevant to the customer's risk profile: in the OCC's USAA order, when information is missing, a profile is out of date or activity stops matching it. The bank's trigger policy turns that into numbered rules.

Does a new product trigger a KYC review?

Often, when it changes the customer's risk or expected activity. Adding ACH origination, international wires or remote deposit capture changes what the account will be used for, so most trigger policies make such a product material for the products and expected activity sections.

Should every adverse media hit trigger a KYC refresh?

No. FinCEN's FAQ F.4 says the CDD rule does not categorically require media searches at all. Where a bank screens media, its policy should decide which kinds of article are material; the rest should be closed with a reason and sampled by quality control.