Ongoing Monitoring

Ongoing monitoring means that a firm's checks on a client continue for as long as the relationship lasts. Article 20(1)(f) of the Anti-Money Laundering Regulation (AMLR) lists it among the measures that make up customer due diligence, next to identifying the client and its beneficial owner. It is part of due diligence itself, not a separate exercise that starts later.

Article 26(1) gives the purpose. The firm must make sure that what the client does is consistent with what the firm knows about the client, the client's business activity and its risk profile. Where necessary, this includes information about the origin of the funds and where they are going. The firm must also pick out the transactions that need a closer assessment to decide whether they are suspicious.

The duty attaches to a business relationship. Article 2(1)(19) defines that as a business, professional or commercial relationship with a client that is expected to have an element of repetition or duration, or that later acquires one. No written contract is needed. A retained client is a business relationship. A single transaction for a person the firm does not act for again is not.

The AMLR applies from 10 July 2027 (Article 90). Until then, the national laws that implement the EU anti-money laundering directives apply, and they already contain a monitoring duty in general terms.

Ongoing monitoring involves two tasks: watching what the client does, and keeping the client file current. Article 26 of the AMLR sets out both.

The first task is scrutiny of transactions. The firm compares each transaction with what it expected when it took the client on. A bank does this with software across a very large number of payments. A law firm or an accounting practice does it matter by matter. It looks at who the client is dealing with, how much money is involved, where the money comes from and whether the work still fits the client the firm thought it had. Article 34(2) names the transactions that always need a closer look. The firm must examine the origin and destination of the funds, and the purpose, of any transaction that is complex, unusually large, carried out in an unusual pattern, or without an apparent economic or lawful purpose.

The second task is keeping the relevant documents, data and information on the client up to date (Article 26(2)). In practice that means replacing an identity document that has expired, recording a new address, director or beneficial owner, and revisiting the firm's own risk rating of the client.

Two further rules in Article 26(1) widen the scope. Where a relationship covers more than one product or service, due diligence must cover all of them. Where a firm belongs to a group and the client is also a client of another entity in that group, the firm must take that other relationship into account when it monitors its own.

At least every five years for most clients, and at least every year for higher-risk clients. Article 26(2) says the period between updates depends on the risk the business relationship poses. It then sets two outer limits. For higher-risk customers who are subject to enhanced due diligence, the period must not exceed 1 year. For all other customers it must not exceed 5 years.

These are maximum periods, not a schedule. A firm sets its own review cycle inside them according to each client's risk. It can review a medium-risk client more often than a low-risk one, as long as no client goes past the limit that applies to it.

Lower risk allows lighter monitoring, within limits. Under simplified due diligence a firm may reduce how often it updates customer identification and how closely it scrutinises transactions (Article 33(1)). It must still monitor enough to detect unusual or suspicious transactions. It must also verify regularly that the conditions for simplified due diligence still exist (Article 33(4)).

The calendar is not the only trigger. Certain events require a review whenever they happen, however recently the file was updated.

A client review is triggered by the passing of time, by a change on the client's side, or by something the firm learns. Article 26(2) to (4) and Article 34(2) of the AMLR list the triggers. The table shows each one with the action it requires.

Only the first trigger can be planned in a calendar. The others depend on someone at the firm noticing a change: a client who mentions a new shareholder, a company register entry that no longer matches the file, a payment from an unexpected country. The people who deal with the client day to day therefore need to know what to pass on.

Sanctions checks follow their own rhythm. Their frequency must match the firm's exposure to the risk that sanctions are not applied or are evaded. Banks and other financial institutions must also repeat the check whenever a new designation is made (Article 26(4)).

The firm assesses it, records the assessment and decides whether to report. Article 69(2) requires the firm to assess the client's transactions or activities against every relevant fact it knows. Unusual is not the same as suspicious. A client can have an ordinary explanation, and the firm's task is to obtain it, test it against the file and write it down.

Where the explanation does not hold, the reporting duty applies. A firm that knows, suspects or has reasonable grounds to suspect that funds or activities are the proceeds of criminal activity, or are related to terrorist financing, must report to its national financial intelligence unit, whatever the amount (Article 69(1)). Article 70(2) exempts lawyers, notaries, auditors, external accountants and tax advisors for information obtained while ascertaining a client's legal position or representing the client in court proceedings.

Monitoring can also change a client's risk level without any suspicion. Where the firm identifies an increased risk, it must apply enhanced due diligence (Article 20(2)). The measures in Article 34(4) include obtaining more information on the source of funds, getting senior management approval to continue the relationship, and monitoring more closely by increasing the number and timing of controls.

A client who will not supply updated information raises a different problem. A firm that cannot complete customer due diligence must not carry out the transaction, must end the business relationship, and must consider a suspicious transaction report (Article 21(1)). Article 21(2) sets this rule aside for legal professionals, auditors, external accountants and tax advisors while they ascertain a client's legal position or represent the client in proceedings.

The firm needs a dated record of each review, including the reviews that changed nothing. Article 21(3) requires firms to keep a record of the actions taken to apply customer due diligence, with the decisions, the supporting documents and the justifications. The documents, data and information held must be updated whenever due diligence is reviewed under Article 26.

The same applies to transactions the firm has examined. Article 77(1) requires a record of each assessment of a possibly suspicious transaction, with the information considered and the result, whether or not a report followed.

The test is in Article 20(4). A firm must be able to demonstrate to its supervisor at all times that its measures are appropriate to the risks it has identified. A file that holds an identity check from the day of onboarding and nothing since cannot show that. Checking a client once and never again does not meet Article 26, however thorough the first check was.

A file that does meet it holds a sequence: the first risk assessment, each later review with its date, what was checked, what changed and who decided. An audit trail that records these steps as they happen is easier to rely on than a file put together shortly before an inspection.

Yes, where the firm is an obliged entity. Article 3 covers auditors, external accountants and tax advisors in their professional activities. It covers notaries, lawyers and other independent legal professionals when they act for a client in a financial or real estate transaction, or help to plan or carry out certain transactions. These include buying and selling real property or business entities, managing client money, and creating or managing companies and trusts.

Article 26 makes no exception for the size of the firm. What scales is the method. Article 9 requires internal policies, procedures and controls that are proportionate to the nature of the business, its risks, its complexity and its size. A small practice does not need the transaction-monitoring software a bank runs. It can meet the duty with a list of its clients, a risk rating and a next review date for each, and a clear rule for what staff do when something changes.

More detail comes from the EU's Anti-Money Laundering Authority (AMLA). Article 26(5) required it to issue guidelines on ongoing monitoring by 10 July 2026.