A Know Your Business check is a photograph, not a live feed. The moment it’s taken, it’s accurate — registration confirmed, directors verified, ownership mapped, sanctions lists cleared. The moment after, the business it describes keeps moving: a shareholder sells a stake, a director resigns, a holding company gets added to a sanctions list, a subsidiary’s status quietly flips from active to dissolved. Most onboarding programs still treat that photograph as if it stays accurate indefinitely, re-checking only when a periodic review calendar says it’s time. “Perpetual KYC” is the name the industry has settled on for the alternative: verification that keeps running after onboarding, triggered by what actually changes in a company’s record rather than by the calendar.
01A point-in-time check expires the moment it’s issued
Every KYB (know-your-business) program starts the same way: confirm the entity exists, confirm who owns it, confirm who runs it, screen all of them against sanctions and watchlists, file the result, move on. That workflow answers one question well — was this company clean on the day we checked? — and answers a different, more consequential question not at all: is it still clean today?
The gap between those two questions is where most real exposure accumulates. A company onboarded eighteen months ago as a clean, wholly domestic small business can, without anyone at the onboarding institution doing anything wrong, end up eighteen months later with a new majority shareholder who is a sanctioned person, routed through a jurisdiction the original check never had reason to look at. Nothing in the original file was false. It was simply a description of a company that no longer exists in that form.
Perpetual KYC (also called continuous or always-on KYC) is a compliance model in which customer and company records are monitored on an ongoing basis — against registry filings, sanctions and watchlist updates, and adverse media — so that a material change triggers re-verification immediately, rather than waiting for the next scheduled periodic review. Continuous due diligence is the underlying practice; perpetual KYC is the operating model built around it.
Still verifying once and hoping it holds?
02Perpetual KYC vs. traditional periodic review
Periodic review isn’t negligent — it’s the default most programs inherited from a paper-filing era when re-checking every customer continuously simply wasn’t operationally possible. The two models differ less in intent than in what triggers a re-check, and in how long a stale fact can sit in a live file before anyone looks at it again.
| Dimension | Traditional periodic review | Perpetual / continuous KYC |
|---|---|---|
| Re-check trigger | A fixed calendar date — annually for high-risk, every 3-5 years for standard risk | A material change event — ownership shift, sanctions hit, adverse media, status change |
| Worst-case exposure window | Up to the full review interval — months to years | The lag between the change filing publicly and the monitoring pass picking it up — typically hours to days |
| Effort distribution | Batched, periodic spikes — an annual backlog of every file due that cycle | Spread continuously, with volume concentrated on the subset of files that actually changed |
| Clean, unchanged files | Still get a full manual re-review at the scheduled date, regardless of whether anything changed | Consume almost no review effort — nothing changed, so nothing escalates |
| Dependency | A review team with capacity to work through the queue on schedule | Reliable, frequently-refreshed source data — registries, sanctions lists, media feeds — feeding the monitoring layer |
| Regulatory framing | Satisfies a minimum review-cycle expectation | Aligns more directly with the ongoing, risk-sensitive due diligence FATF Recommendation 10 actually describes |
(annual cycle)
Onboarding
Ownership change occurs
~6 months undetected
Caught at next review
Perpetual KYC
(event-driven)
Onboarding
days
Caught within days
Onboarding verified
Risk event occurs
Detected / re-checked
Looked at side by side, which part actually matters — which model eventually catches the change, or how long it sits unseen first? The event is identical in both rows; only the exposure window moves.
03The four events that should restart verification on their own
A continuous-monitoring program doesn’t watch everything with equal intensity — it watches for a short list of events that are each, on their own, sufficient reason to re-open a file regardless of where it sits on the review calendar.
Ownership change
A new shareholder crossing a disclosure threshold, an existing stake growing past 25% or 50%, or a change in the ultimate beneficial owner chain is the single highest-value trigger, because ownership is what every other screening decision is downstream of. It also depends on correctly recognizing that two filings describe the same entity before a change can even be detected — the matching problem covered in Entity Resolution and Ownership Graphs. The same discipline applies to re-verifying ownership on an ongoing basis, not just at onboarding, which is the throughline of UBO Verification Workflow: From Initial Check to Ongoing Monitoring.
A sanctions or watchlist update
Sanctions lists change on their own schedule, set by regulators and geopolitics, not by any customer’s review date. A company or an individual in its ownership chain can be added to a list the day after a clean onboarding check — the file was right when it was checked and wrong an hour later, through no input error at all. This is precisely the case Sanctions Screening and Beneficial Ownership walks through: a clean entity check at the entity level says nothing about whether an owner two layers up just got added to a list.
An adverse media hit
A fraud indictment, a regulatory enforcement action, or credible reporting tying a company or its principals to financial crime is a signal that frequently arrives before, not after, the underlying registry or sanctions data catches up — which is exactly why it has to be monitored as its own trigger rather than inferred from registry status. Adverse Media Screening vs. Beneficial Ownership Verification covers why the two checks answer different questions and both need to run continuously, not just once.
A registry status change
A company moving from active to dissolved, into administration, or into liquidation is a direct, often registry-sourced signal that the relationship itself needs reassessment — continuing to transact with, or extend credit to, an entity that no longer legally exists in its onboarded form is a problem a periodic review calendar can leave undetected for months.
04How a monitoring trigger actually gets detected
Naming the four trigger categories is the easy part. How does a change made inside a company registry’s own back-office system end up, hours or days later, as a flagged alert in a compliance queue? Mechanically, almost every monitoring pipeline reduces to the same three stages: ingestion, diffing, and triage.
Ingestion. Few registries, sanctions authorities, or media sources push changes out the moment they happen. OFAC updates its Specially Designated Nationals List on an ad hoc, intraday basis whenever a designation action occurs, but most company registries publish only a renewed filing index or a bulk extract on their own schedule. In practice, that means most “continuous” monitoring is frequent, scheduled polling against a source — re-pulling a record or re-downloading a list extract at a short, fixed interval — rather than a true real-time push. The detection lag a program actually delivers is the polling interval plus however long processing takes, not zero, which is why a program’s real cadence matters more than its label.
Diffing. A newly pulled record is compared against the last stored version field by field, not as a single whole-record hash. Field-level diffing is what lets a cosmetic change — a reformatted address, a re-ordered officer list — get treated differently from a substantive one, like a status field moving from Active to Dissolved or a shareholding percentage crossing 25%. Hash the whole record instead, and every formatting refresh looks identical to a material change, which is a fast way to make reviewers start ignoring the alerts.
Triage. Once a field-level change is flagged, it’s scored by category and confidence before anyone sees it: an exact name-and-identifier match against a sanctions list escalates immediately; a weak, name-only fuzzy match queues for human review; an address reformat auto-clears and gets logged, not alerted. That triage layer, more than the underlying matching logic, usually decides whether a monitoring program is actually usable at volume or simply produces a queue nobody can keep up with.
Ownership change
New UBO, stake crosses 25%/50%
Sanctions / watchlist
List update, new designation
Adverse media
Fraud, enforcement reporting
Registry status
Active → dissolved/liquidation
Ingest & diff against last-known state
Field-level comparison, not whole-record hash
Severity & confidence scoring
Auto-clear
No match — file stays active
Queue for review
Weak match or ambiguous event
Escalate now
Confirmed hit — relationship paused
05A missed ownership change, worked through the math
What does it actually take for a sanctioned stake to form inside a company’s ownership without a single re-check ever catching it? OFAC’s so-called 50% Rule — its published FAQ 401 — supplies a clean, worked illustration, because the way it defines a “blocked” entity is less intuitive than it looks.
The rule: any entity owned, directly or indirectly, 50% or more in the aggregate by one or more blocked (sanctioned) persons is itself blocked automatically — as a matter of law, the moment the ownership threshold is crossed, whether or not OFAC ever adds that entity’s own name to the SDN List. Two details make this harder to catch than a single owner crossing 50% on their own.
The 50% is aggregated across every blocked owner, not tested one owner at a time. A single sanctioned shareholder holding 30% doesn’t trigger the rule by itself. Two unrelated sanctioned shareholders, each holding 25% and designated under entirely different sanctions programs, aggregate to 50%, and the entity becomes blocked the instant the second one is designated — with no single stake anywhere near the threshold on its own.
Blocked status passes down through ownership layers in full, not pro-rated. Take a hypothetical three-tier structure: a logistics company is 70% owned by a parent holding company and 30% owned by two individual minority investors. At onboarding, screening the logistics company’s own direct shareholder list clears cleanly — none of its three listed owners match a sanctions list, because none of them do. Eighteen months later, two of the parent holding company’s own shareholders — one who already held 35% of the parent, and another newly acquiring 18% — are both designated in the same enforcement round. Combined, blocked persons now hold 53% of the parent, which crosses the 50% Rule and makes the parent itself a blocked entity in its entirety. Because the parent owns 70% of the logistics company, and a blocked entity’s stake counts in full rather than scaled down by how it became blocked, the logistics company inherits blocked status too — through a layer of ownership nobody re-screened, because nothing in the logistics company’s own, direct shareholder record ever changed.
Nothing about this scenario required an error in the original screening. It required a monitoring program that watches ownership two layers up a structure, not only at the entity being onboarded — exactly the kind of UBO-level, ownership-graph monitoring the trigger categories above are built to catch, and exactly what a screening pass run once, at onboarding, structurally cannot.
06How fast does company data actually move? A live check
It’s one thing to argue in the abstract that company records don’t stay static. It’s another to measure it. We queried a live, stratified sample of 400 companies from Zavia’s own dataset — 50 each across eight countries (the US, UK, Germany, France, Italy, the Netherlands, Singapore, and Australia), sampled 2026-10-20 — to see how much of that sample was sitting in a state other than straightforwardly active, and how long it had been since each record’s underlying registry data was last refreshed.
Methodology note. The 10.5% figure reflects how each record happened to be tagged in Zavia’s dataset at query time, not an independent audit of each company’s official register status — company status fields vary in granularity by jurisdiction and some records sit in intermediate categories that aren’t a clean active/inactive split. The point isn’t the precise percentage; it’s that in a sample this size, a meaningful share of companies were not simply, uniformly “active,” and a quarter of records hadn’t been touched by a refresh cycle in over a month — which is exactly the gap a one-time check can’t see into.
74.5% refreshed ≤30 days
25.5% stale >30 days
Average time since last refresh across the sample: 28 days
Status mix, same sample
89.5%
Active
Active (89.5%)
Other status (10.5%)
Ongoing KYB monitoring is only as useful as the refresh cycle feeding it, which is why Zavia connects directly to official company registries across 173 countries rather than re-selling a static, periodically-rebuilt dataset — so a re-check against Zavia’s data reflects the registry as it stands now, not as it stood whenever an aggregator last rebuilt its snapshot.
07This isn’t just operational hygiene — it’s what regulators already expect
“Perpetual KYC” is industry shorthand, not a defined regulatory term, but the underlying obligation it describes is not new. The Financial Action Task Force’s Recommendation 10 calls on institutions to conduct ongoing due diligence on business relationships, including scrutiny of transactions throughout the relationship, with reviews of existing customer records that intensify for higher-risk categories — a standing obligation to keep checking, not a one-time clearance.
In the US, the FFIEC’s BSA/AML Examination Manual treats customer due diligence, including ongoing monitoring, as a core pillar of an effective compliance program, and FinCEN’s Customer Due Diligence Rule folded beneficial ownership identification into that same ongoing framework rather than treating it as a closing condition at account opening. Neither framework uses the word “perpetual,” but both describe the same underlying expectation the term has come to stand for: due diligence that doesn’t end when onboarding does.
What’s shifted is less the regulatory text than what’s operationally possible. Continuously checking every customer against every data source was never realistic in a paper-filing, manual-review world, which is why periodic review intervals became the practical default. Direct, frequently-refreshed access to registries, sanctions lists, and media sources is what makes event-driven, continuous monitoring achievable at scale now — closing the gap between what the rules have always implied and what compliance teams can actually operate.
Registries change daily. Does your monitoring?
08Setting a re-check cadence by risk tier
Should a dormant shell company with no transaction activity sit on the same review clock as an operating subsidiary that files fresh officer changes every quarter? Treating every file identically is the exact inefficiency a risk-based program is supposed to eliminate, and both FATF’s Recommendation 1 and the EBA’s guidelines on money-laundering and terrorist-financing risk factors (EBA/2021/02, as amended by EBA/GL/2023/03) build the same principle into the rules themselves: due diligence — including how often and how closely a file gets re-examined — should scale with the risk the customer actually presents, not run on one interval for everyone.
In practice, most programs running event-driven triggers end up organizing risk into three rough tiers.
High risk — politically exposed persons, entities tied to jurisdictions FATF has flagged for increased monitoring, or ownership structures layered through several holding entities. All four trigger categories run continuously with no exceptions, backed by a short periodic review as a backstop against whatever the triggers structurally can’t see.
Standard risk — the bulk of an onboarded book. Ownership and sanctions triggers, the two highest-value categories, run on every file; adverse media and status monitoring run alongside them, with a longer periodic backstop behind the whole set.
Low risk — stable, well-understood entities with simple, unchanged ownership. The same cheap, portfolio-wide sanctions and ownership triggers keep running, since they cost little to apply broadly once built, but the periodic backstop interval stretches out considerably, because a full manual re-review of a file that triggered nothing returns little for the reviewer-hours it consumes.
The question a risk-tiered program is actually answering isn’t “how often do we check this file” — once triggers are running, that part happens continuously for everyone. It’s “how long can the periodic backstop safely be,” because the backstop’s only real job left is catching the narrow set of changes that never surface anywhere a monitoring feed is watching.
09Five checks before calling a monitoring program “continuous”
A program that runs a batch refresh once a quarter and calls it continuous monitoring hasn’t actually changed its exposure window — it’s just renamed a periodic review with a shorter interval. Run these five checks against any program claiming to do this.
1. Confirm what re-triggers a review, not just how often one runs. If every re-check still fires on a calendar date rather than on an ownership change, sanctions update, adverse media hit, or status change, the program is periodic review with a faster clock, not continuous monitoring.
2. Check the lag between a source event and a detected one. A sanctions list update that takes weeks to propagate into screening defeats the purpose of monitoring continuously — the relevant measure is detection lag, not refresh frequency in the abstract.
3. Verify ownership changes are detected at the UBO level, not just the direct-shareholder level. A new majority owner introduced two layers up through an intermediate holding company should trigger the same re-check as a direct shareholder change; if it doesn’t, the monitoring stops exactly where the risk concentrates.
4. Sample how many “no change” files still get a full manual review. If unchanged, clean files are still consuming reviewer hours on a fixed schedule, the operational benefit of continuous monitoring — effort concentrated on what actually changed — isn’t being realized.
5. Confirm escalations are routed by severity, not volume alone. A continuous feed that pushes every minor filing update to a human reviewer at the same priority as a sanctions hit will get triaged the same way an overloaded alert queue always does: by being ignored.
10Where automation should stop and a reviewer should start
Continuous monitoring is built to auto-clear the overwhelming majority of unchanged files and auto-escalate the clear-cut hits. Three situations fall in between, and deserve a human reviewer rather than a threshold decision.
A sanctions-list name match with weak identifying detail. A common name matching a watchlist entry with no shared date of birth, nationality, or identifier is exactly the kind of ambiguous hit that should pause for review rather than auto-clear on a low score or auto-escalate on a high one.
An ownership change that coincides with a legitimate corporate event. A merger, an internal reorganization, or a legal name change can look, to an automated matcher, identical to a suspicious change in control. The event needs to be identified as a known, legitimate corporate action before the system treats it as routine.
Adverse media that’s allegation-stage, not adjudicated. A news report naming a company in an ongoing investigation is meaningfully different from a completed enforcement action, and a monitoring system that escalates both the same way either over-triggers on every allegation or, if tuned down to compensate, misses the adjudicated cases that matter most.
11What a stale file actually costs
A missed re-check rarely announces itself as a missed re-check. It shows up as a relationship manager approving a credit line renewal for a company that was quietly dissolved four months earlier. It shows up as a payments provider processing transactions for a merchant whose majority owner was added to a sanctions list the previous quarter, discovered only when a regulator asks why. It shows up as weeks of remediation work tracing exactly when a now-sanctioned ownership stake first appeared, because nothing in the file flagged it at the time.
None of those outcomes required an error in the original onboarding check. They required only that nothing re-checked the file between then and now. That’s the gap perpetual KYC is built to close — not by distrusting the original verification, but by refusing to treat it as permanent.
Verify once, monitor continuously
Zavia monitors official registries in 173 countries — continuously, not once.
12Glossary
13Frequently asked questions
What is perpetual KYC?
Perpetual KYC, also called continuous or always-on KYC, is a compliance model in which a company’s or customer’s record is monitored on an ongoing basis against registry filings, sanctions and watchlist updates, and adverse media, so that a material change triggers re-verification immediately rather than waiting for the next scheduled periodic review.
How is perpetual KYC different from traditional periodic review?
Periodic review re-verifies every file on a fixed calendar interval regardless of whether anything changed. Perpetual KYC instead re-verifies in response to specific trigger events — an ownership change, a sanctions list update, an adverse media hit, or a registry status change — so review effort concentrates on files that actually changed rather than being spread evenly across a scheduled batch.
What events should trigger a re-check outside the normal review cycle?
The four highest-value triggers are an ownership or beneficial-ownership change, a sanctions or watchlist update affecting the company or anyone in its ownership chain, a credible adverse media hit, and a registry status change such as a move into dissolution, administration, or liquidation.
Is ongoing monitoring actually required by regulators, or is it just best practice?
FATF Recommendation 10 calls on institutions to conduct customer due diligence on an ongoing basis, including scrutiny of transactions throughout a business relationship and review of existing records, with more intensive review for higher-risk customers. In the US, the FFIEC’s BSA/AML Examination Manual and FinCEN’s Customer Due Diligence Rule build ongoing monitoring and beneficial ownership identification into the same standing framework. “Perpetual KYC” is an industry term for an operating model; the underlying ongoing-due-diligence obligation it implements is already a regulatory expectation.
Does perpetual KYC replace periodic reviews entirely?
Not necessarily. Many programs run continuous, trigger-based monitoring alongside a lighter periodic backstop review, so that a file still gets a full look on a schedule even in the absence of a detected trigger, as a check against gaps in monitoring coverage rather than as the primary mechanism.
How quickly does company data actually change?
A live, stratified sample of 400 companies across eight countries from Zavia’s dataset, queried 2026-10-20, found 10.5% carrying a status other than cleanly “Active” at the moment of the check, and 25.5% of the sample hadn’t had their underlying registry data refreshed in over a month — concrete evidence that a company’s record a few months into a relationship is not reliably the same as the one verified at onboarding.
Can continuous monitoring be fully automated?
Most unchanged files and most clear-cut matches can be handled automatically. Ambiguous sanctions-name matches with weak identifying detail, ownership changes that coincide with a legitimate corporate reorganization, and allegation-stage adverse media that hasn’t been adjudicated are cases that still warrant a human reviewer rather than an automatic threshold decision.
For the matching problem that sits underneath detecting an ownership change at all, see Entity Resolution and Ownership Graphs. For how a sanctions hit on an owner differs from a clean entity-level check, see Sanctions Screening and Beneficial Ownership, and for the full lifecycle from first verification through ongoing monitoring, see UBO Verification Workflow: From Initial Check to Ongoing Monitoring.
