Perpetual KYC (pKYC): a definition grounded in the US rule

Perpetual KYC (pKYC) is the practice of keeping a customer's due diligence file current by refreshing it whenever something relevant about the customer changes, such as a new owner, a new country or activity that no longer fits the profile, instead of re-reviewing the whole file on a fixed date. It matters because the calendar model spends most of its effort on files where nothing has changed while real changes wait unseen until the next due date. In the United States, perpetual KYC needs no new permission: the customer due diligence rule asks banks to update customer information on a risk basis, and FinCEN has said it does not require a fixed schedule. Botminds' Perpetual KYC (pKYC) is a solution built on that reading, in which agents watch trigger events and refresh only the sections of a file each one touches.

"There is no categorical requirement that financial institutions update customer information on a continuous or periodic schedule. The requirement to update customer information is risk based and occurs as a result of normal monitoring."

FinCEN, CDD Rule FAQs, question F.6 (2020; re-issued May 6, 2026)

What does pKYC stand for?

pKYC stands for perpetual know your customer, also written perpetual KYC. Know your customer is the industry's name for the identification and due diligence a bank carries out on its customers; perpetual describes when the due diligence is refreshed, which is all the time, as events arrive, rather than at intervals. The legal term in the United States is not KYC at all but customer due diligence, and the duty pKYC serves is the ongoing part of it.

The abbreviation is mostly searched alongside the names of software vendors, which says something about how the idea reached banks: as a product category before it was a compliance concept. This page defines it from the rule instead, so a reader can tell what any product would have to do to deserve the name.

Perpetual KYC meaning in banking: the rule it rests on

In banking, perpetual KYC means meeting the ongoing customer due diligence requirement by updating on events. That requirement is the fifth element of a bank's AML program under 31 CFR 1020.210, often called the fifth pillar: risk-based procedures for understanding the nature and purpose of each relationship well enough to build a customer risk profile, and for "conducting ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information", which includes the beneficial owners of legal entity customers (31 CFR 1020.210).

Two words in that text do the work: "on a risk basis". They leave the bank to decide how and when information is updated, as long as the method follows from risk. FinCEN's answers to the industry's questions, re-issued in consolidated form on May 6, 2026, spell out what that means for a schedule: there is none in the rule. The obligation to update arises "as a result of normal monitoring", which is exactly what a trigger is.

FinCEN made the same point about beneficial ownership in 2018. Asked whether routine periodic reviews oblige a bank to re-collect a company's owners, it answered no: a scheduled review does not by itself oblige the bank to collect ownership again, and the obligation arises when the bank "becomes aware of information about a customer or an account, including a possible change of beneficial ownership information, relevant to assessing or reassessing the customer's overall risk profile" (CDD Rule FAQs, B.18). Read together, F.6 and B.18 describe perpetual KYC in FinCEN's own words, without using the term.

Is perpetual KYC required?

No US rule requires perpetual KYC by name, and no US rule requires a calendar either. What the rule requires is that customer information is maintained and updated on a risk basis, and that a change the bank learns of through monitoring leads to an update. A bank can meet that with periodic reviews, with event-driven refresh or, as most do, with a mix.

What regulators have ordered, when a bank's program failed, is the event-driven part. In consent orders against USAA in 2022 and TD Bank in 2024, the OCC required banks to collect updated information when events show it is needed, alongside risk-based criteria for periodic review. The trigger list regulators have written into their own orders sets out those events one by one. The pattern in enforcement is not that a calendar was illegal, but that changes between the dates went unnoticed.

Outside the US the answer is different. From 10 July 2027 the EU's Anti-Money Laundering Regulation sets maximum intervals between updates of customer information, so an EU bank will need both triggers and a calendar ceiling. How often KYC should be updated in the US, EU and UK compares the three.

Periodic review against perpetual KYC, line by line

The difference between periodic review and perpetual KYC is the unit of work. A periodic review takes the whole file on a date. Perpetual KYC takes one event and the sections of the file it touches, and gives each section its own date.

The fifth row is the one that decides whether perpetual KYC is an improvement or a risk. A program that only acts on material events, and lets the rest disappear, has traded one blind spot for another. A program that keeps every not-material call with its reason, and tests a sample of them, can show an examiner what it chose not to do and why.

Ongoing customer due diligence is the legal name for it

Ongoing customer due diligence is the US regulatory term for what the industry calls KYC refresh, and perpetual KYC is one way of doing it. Searchers often meet the phrase in a training question, "ongoing customer due diligence requires which of the following", and the answer is the four elements above: understand the relationship, build a risk profile, monitor and report, and maintain and update on a risk basis.

The practical consequence is that perpetual KYC cannot be bolted onto a bank that does not monitor. Triggers come from monitoring: transaction monitoring alerts that show activity outside the profile, screening hits after a list update, registry filings, changes in the core banking system. A bank whose monitoring is weak has nothing to be perpetual about. FinCEN's 2024 order against TD Bank describes the opposite end: a backlog of about 1.6 million customers who had never been risk-scored at all (FinCEN, TD Bank, 2024). No refresh model, periodic or perpetual, reaches a customer who was never profiled.

Continuous KYC, dynamic KYC, perpetual KYC: the same idea?

Mostly, yes. Continuous KYC and perpetual KYC are used interchangeably for event-driven refresh. Dynamic KYC usually stresses the risk rating, which moves as information arrives, rather than the file. Progressive KYC is different: it describes collecting more information as a customer takes on riskier products, which is an onboarding idea, not a refresh one.

The Wolfsberg Group, a standards body formed by global banks, uses plain language for the shift. Its 2022 guidance on digital customer lifecycle risk management recommends that banks "evolve from traditional periodic refresh cycles to a more effective trigger-based approach", and describes the goal as "refreshing customer data on a trigger (rather than periodic) basis, dedicating resources effectively to priority risks in realtime" (Wolfsberg Group, 2022). That is guidance from an industry standards body, not a rule, but it is the clearest description of the model in print.

What perpetual KYC is not

Perpetual KYC is not real-time re-onboarding, it is not continuous screening and it is not remediation. It does not re-verify a customer's identity each time an event arrives; it updates the sections the event affected. Screening against sanctions lists is an input to it, not the same thing. And KYC remediation, a time-boxed project to bring a back book up to a new standard, is a different job with a deadline and an end.

Nor is it a reason to stop reviewing quiet files. The historic failure on the other side is just as instructive: describing a bank's Moscow securities desk, New York's Department of Financial Services found that, once clients were taken on, nobody reviewed or re-verified them at intervals (NYDFS, Deutsche Bank, 2017). A perpetual program with no backstop review for a file that never generates a trigger would repeat that mistake in a modern form.

The three decisions that make a bank's KYC perpetual

A bank becomes perpetual not by buying software but by writing down three things its program currently leaves implicit. Each is a policy choice the US rule leaves to the bank, and each is something an examiner can ask to see.

The first is the trigger policy: a numbered list of the events that count as material, each with its threshold and the sections of the file it touches. "A new direct or indirect owner of 25% or more" is a rule; "significant change in ownership" is not, because two analysts will read it differently. The policy also needs a version number and an owner, because the answer to "why was this event closed?" is only as good as the rule in force that day.

The second is the backstop: how long a file may go with no trigger before someone looks at it anyway. A high-risk customer that has generated no event in a year is either genuinely quiet or invisible to the bank's monitoring, and only a review tells which. The backstop is where the old calendar survives, as a safety net rather than the main mechanism.

The third is the test for the events nobody acted on. Every not-material decision should keep its rule and its reason, and a fixed share of them should go to a reviewer who did not make them, sorted by kind of trigger, with a pass rate the bank watches. Without that, an event-driven program cannot show it is catching what it should. The KYC refresh process, moved from the calendar to events follows all three decisions through one refresh.

What perpetual KYC looks like on one customer file

On one file, perpetual KYC looks like nine sections with nine clocks. Take a fictional sample bank, Corvane National Bank, and one of its customers, Tidewater Freight Brokers LLC, a Delaware freight broker rated Medium and last fully reviewed on March 11, 2025. On October 22, 2026, a filing arrives from the Panama Public Registry: a Panamanian company has bought a 30% interest in Tidewater.

Perpetual KYC (pKYC) in one picture: one event, two sections lit, seven left alone

Under a 36-month calendar, nothing would have happened until March 2028. Under perpetual KYC, the event was judged material within a minute under two written rules (a new owner of 25% or more, and ownership through a country in the bank's highest risk tier), the two sections were redrafted with sources, the new owner was re-screened and the rating moved from Medium 41 to High 63, all proposed. An analyst approved the change as maker at 9:29 AM and a different QC reviewer approved it at 10:06 AM.

Each section keeps its own date; the backstop replaces the calendar

Questions people ask

What is the difference between perpetual KYC and KYC remediation?

Perpetual KYC is how a bank keeps files current from now on; remediation is a one-off project to bring existing files up to a standard they never met. A bank often needs remediation first, because event-driven refresh assumes each file starts with a complete profile to compare changes against.

Does perpetual KYC remove the need for periodic reviews?

Not completely. Most designs keep a backstop review for files with no trigger for a set period, and the OCC's 2024 order against TD Bank required both event-driven collection and risk-based rules setting how often each customer is reviewed. What disappears is the full re-collection of unchanged files on a fixed date.

Do banks need regulator approval to move to perpetual KYC?

There is no approval step in the US rule, which sets no schedule. A bank does need the change written into its BSA/AML program, approved under its own governance and able to show examiners how each event was decided, including the ones closed without action.

Is perpetual KYC only for large banks?

No; the rule is the same for every bank. What scales with size is the number of events, so a small bank can often run event-driven refresh with its existing monitoring and a written trigger policy, while a large bank needs the event volume handled by software and sampled by quality control.

What triggers a perpetual KYC review?

Whatever the bank's written trigger policy calls material, usually a change of ownership or control, a new country or product, activity outside the expected profile, a screening hit or adverse news. FinCEN's FAQ B.19 draws one practical line: a new beneficial owner must be collected, certified and verified, while a changed address for an existing owner can usually be confirmed verbally.