Ongoing monitoring means checking, for as long as you act for a client, that what you know about them is still true, and keeping a dated record that you did, including the checks that found nothing. The Money Laundering Regulations ask for two things: that you watch whether the client’s activity still fits what you know about them, and that you review and update the information you gathered at onboarding.
- What ongoing monitoring is
- Two kinds of review: when something changes, and on a schedule
- What a review has to do, and what it does not
- What counts as evidence
- What the register can tell you between reviews, and what it cannot
- A review record you can copy
- FAQ
What ongoing monitoring is
Ongoing monitoring is the continuing review of a business relationship. Under MLR 2017 regulation 28, the firm must scrutinise transactions throughout the relationship and review existing records so that customer due diligence documents and information remain up to date.
In practice, this means checking whether:
- Transactions fit your knowledge of the client, its business and its risk profile.
- The source of funds needs checking because a transaction appears inconsistent.
- Existing identity, ownership and business information is still accurate.
- The client’s risk assessment remains appropriate.
The obligation is not satisfied by completing checks at onboarding and then leaving the file untouched. Ongoing monitoring must show what you checked and what you concluded.
Two kinds of review: when something changes, and on a schedule
You need two review routes: an event-driven review when relevant circumstances change, and a periodic review based on your client risk assessment. There is no fixed legal interval. Your firm sets the frequency for each risk class in its own policy and reviews sooner when a trigger event occurs.
Events that must prompt an update include:
- A change in the client’s identity.
- A change in beneficial ownership.
- A change in the service provided.
- Information that is inconsistent with what you know.
- Knowledge, suspicion or another cause for concern.
Other events may also justify a review, such as a new engagement, a restarted engagement, a significant change in key office holders, a PEP becoming involved, or a significant change in business activity or countries of operation.
MLR regulation 27 requires existing customers to be reviewed at other appropriate times on a risk-based approach and when relevant circumstances change. The client risk assessment should support the review frequency you set. If a suspicious activity report has been made, take care not to disclose information in a way that could amount to tipping off.
What a review has to do, and what it does not
An ongoing review does not automatically mean repeating every customer due diligence step. The review can update the information you hold and change the risk assessment or verification where circumstances have changed. A low-risk client with no relevant change may therefore have a short review, but it still needs a record.
A review should establish whether:
- The information held remains accurate and sufficient.
- The client’s activities and transactions remain consistent with your knowledge of the relationship.
- The client risk assessment needs updating.
- Further identity, ownership or verification work is required.
- A transaction requires a source-of-funds check because it appears inconsistent.
The guidance gives the example of a significant capital injection where the shareholders appear not to have the resources to provide it. That situation may require a source-of-funds check under the transaction-monitoring duty. It is separate from enhanced due diligence source-of-funds work for high-risk third countries.
What counts as evidence
Evidence is a dated client record showing what you checked, which source you used, what you found and what action followed. It should also identify the reviewer and the next review date. A recorded conclusion of “no change found” is evidence; an undocumented check is difficult for a supervisor to verify.
A useful review record contains:
| Record field | What to document |
|---|---|
| Client and relationship | Client name, identifier and services provided |
| Review date | The date the check was completed |
| Reason for review | Periodic review or the event that triggered it |
| Checks performed | Records, transactions, ownership, identity and risk information checked |
| Sources | Official register, client confirmation, transaction records or other source used |
| Result | Changes found, no change found, or information requiring investigation |
| Action taken | Updated risk rating, further verification, source-of-funds work or discrepancy report |
| Reviewer | Name or role of the person who completed the review |
| Next review date | The date set under your risk-based policy |
When updating CDD or carrying out ongoing due diligence, AMLGAS 5.7.4 requires an excerpt from the PSC register, or a record that the register holds no information. If your findings materially differ from the PSC register, the discrepancy must be reported to Companies House under AMLGAS 5.7.6 and MLR regulation 30A. AMLGAS 5.7.10 says this should happen as soon as reasonably practicable, normally within 15 working days of establishing the discrepancy.
Keep CDD records and supporting records of ongoing monitoring for five years from the end of the business relationship. This follows MLR regulation 40 and AMLGAS 3.6.18.
What the register can tell you between reviews, and what it cannot
The UK Companies House register can reveal filed changes to a company, but it cannot replace your own review of the relationship. It does not show every fact relevant to AML monitoring, and deciding whether a change affects the risk assessment or calls for further work stays with your firm.
| The UK register can show | The UK register cannot show |
|---|---|
| A new or departed director | A change in the services you provide |
| A change to people with significant control | Transactions or source of funds |
| Liquidation, strike-off or dissolution | Where the client actually trades |
| A change of registered office | A new PEP connection |
| New company filings | Information the company has not filed |
A register entry is filed information. It is not proof that every part of the client file remains correct. You still need to consider the client’s activity, transactions, services, ownership information and any information received from the client.
For UK clients, EntityWatch re-reads Companies House on a schedule, records each check with its date and source, and tells you when a director, a person with significant control or the company status changes. The file then shows the checks that found nothing as well as those that found something. See how EntityWatch keeps a UK client file current.
A review record you can copy
Use the following structure for a periodic or event-driven review. Adapt it to your own policy and client risk assessment. The important point is to record the check, the source, the conclusion and any action, including when the conclusion is that no change was found.
CLIENT REVIEW RECORD
Client:
Company number:
Services provided:
Client risk class:
Review date:
Review type: [Periodic / Event-driven]
Reason for review:
Checks completed:
- Identity and company details:
- Directors and key office holders:
- Beneficial ownership / PSC information:
- Registered office and company status:
- Business activity and countries:
- Transactions and source of funds, where relevant:
- Sanctions and PEP screening, where relevant:
Sources checked:
- Source name:
- Source link or document reference:
- Date accessed:
Result:
[No change found / Changes found / Further investigation required]
Changes identified:
Action taken:
[No further action / Information updated / Risk assessment updated /
Further verification requested / Source-of-funds check completed /
Discrepancy reported / Possible sanctions match flagged for review]
Reviewer:
Next review date:
Reason for next review date:
Supporting documents retained:If nothing has changed, write that clearly. For example: “Companies House record checked on [date]. PSC, directors, registered office and company status reviewed. No change found. No further action required.” Keep the underlying source and any supporting document with the record.
FAQ
How often do I have to review an existing client?
There is no fixed interval in the regulations. Periodic reviews are risk-based and should be set in your own policy by risk class. Review sooner when a trigger event happens, such as a change in identity, beneficial ownership, service, relevant information or cause for concern. This follows AMLGAS 5.2.6 and 5.2.7 and MLR regulation 27(8)(b).
Do I have to redo full customer due diligence at each review?
No. AMLGAS 5.2.8 allows ongoing CDD to involve reviewing and updating the information held, and updating the risk assessment or verification where circumstances have changed. The extent of the work should reflect the facts and the client’s risk.
Do I need a new PSC register excerpt when I review a client?
Yes, when updating CDD or carrying out ongoing due diligence. Obtain an excerpt from the PSC register or establish that it holds no information. If there is a material discrepancy, report it to Companies House as soon as reasonably practicable, normally within 15 working days of establishing it.
How long must I keep records of ongoing monitoring?
Keep CDD records and supporting records of ongoing monitoring for five years from the end of the business relationship. The requirement is set out in MLR regulation 40 and AMLGAS 3.6.18.
Is a review that found no change worth recording?
Yes. Record the date, what you checked, the source, the result and “no change found”. Without a dated record, a supervisor cannot see that the review happened or what information supported your conclusion.
Put your first UK client under monitoring free in EntityWatch. Enter a UK company number and EntityWatch reads Companies House, creates the client file with its sources and checks the register again on a schedule. You approve every file. It is free for up to five companies.
Last reviewed: 16 September 2026.
This article is general guidance, not legal advice.
This content was generated with artificial intelligence.