Perpetual KYC (pKYC)

What is perpetual KYC (pKYC)?

Perpetual KYC (pKYC) is a model in which a bank updates a customer's KYC file when something changes, instead of waiting for a fixed review date. It is also called event-driven KYC or continuous KYC. It builds on customer due diligence (CDD) and changes when the work happens, not what the file has to contain.

How is perpetual KYC different from periodic review?

In a periodic model, each customer gets a risk rating and a refresh cycle to match, such as every year for high risk and every few years for lower risk. A customer whose situation shifts the week after a review stays stale until the next date, and many scheduled reviews find nothing new.

In a perpetual model, signals start the review. Many banks keep a periodic cycle as a backstop for customers who produce no signals.

What events trigger a perpetual KYC review?

Each bank sets its own triggers from its risk assessment. Common ones are:

• A change in beneficial ownership or control, reported by the customer or found in a corporate registry.
• New adverse media about the customer or a related party. See adverse media screening.
• A sanctions or watchlist update that creates a possible match.
• A shift in transaction patterns, such as new geographies, higher volumes or new counterparties.
• A registry change, such as a new legal name, address or a company being struck off.

A minor signal may only need a record update, while a serious one may call for enhanced due diligence (EDD).

What do US rules require?

US rules do not use the term "perpetual KYC." The text of 31 CFR 1020.210, 31 CFR 1010.230 and FinCEN's 2026 order below contains no reference to perpetual, continuous or event-driven KYC. What the rules require is ongoing customer due diligence, and pKYC is one way to meet it.

For banks, 31 CFR 1020.210(a)(2)(v) requires risk-based procedures for ongoing customer due diligence. These include ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information, which includes information on the beneficial owners of legal entity customers.

Beneficial ownership identification is set out in 31 CFR 1010.230. On February 13, 2026, FinCEN issued ruling FIN-2026-R001, which gives covered institutions exceptive relief from identifying and verifying beneficial owners at each new account opening. Identification and verification still apply when a legal entity customer first opens an account, when the institution learns facts that reasonably call earlier information into question, and as needed under its risk-based ongoing due diligence procedures. The last two are event-driven by nature.

What does perpetual KYC need to work?

• One customer record. Signals must attach to a single view of the customer and its related parties.
• Reliable data feeds. Sanctions lists, media, registries and monitoring alerts need to arrive in a usable, timely form.
• Risk scoring. Written rules should say which signals lead to which level of review.
• An audit trail. Each trigger, the evidence reviewed and the approver should be recorded.

Where do AI agents help with perpetual KYC?

Most of the effort in pKYC is operational, and AI agents can take on the routine parts. They watch trigger sources and match each signal to the right customer. They assemble the refresh case with registry extracts, screening results and a summary of what changed. They route exceptions and unclear matches to an analyst with the evidence attached.

A person approves any change to a risk rating and any decision to exit a customer. For related reading, see how KYC automation works, the KYC and KYB tools roundup and KYB automation for banks and fintechs.

Zamp builds AI employees that run back-office work end to end, with approval gates, a Needs Attention queue for items that need a decision and a full audit trail.

Frequently asked questions

Is perpetual KYC required by US regulators?

No rule requires it by name. Banks must run risk-based ongoing due diligence and keep customer information current on a risk basis under 31 CFR 1020.210(a)(2)(v). Whether they meet that through calendar reviews, event-driven reviews or both is a risk-based decision.

What is the difference between pKYC and periodic KYC review?

Periodic review refreshes a file on a schedule set by risk rating. Perpetual KYC refreshes it when a trigger event occurs. Many banks keep a periodic cycle as a backstop.

Does perpetual KYC mean customers are re-verified constantly?

No. Monitoring is continuous, but a customer is contacted or re-verified only when a signal calls for it. Many signals lead to a quiet file update or no action.

Can AI agents run perpetual KYC on their own?

They can handle monitoring, case preparation and file updates. Decisions to change a risk rating or exit a customer stay with a person, and the audit trail should show who approved each one.