August 15, 2026

High-Risk Customer Reviews: Building a Defensible Process

Axle Team

Key takeaways

Regulators do not prescribe a review schedule. FinCEN is explicit that updating customer information is risk-based — which means your cadence must be self-justified and consistently executed.
A defensible review ends in a decision — retain, restrict, or exit — with a named approver, not just a refreshed profile.
Trigger-based reviews catch moving risk faster than calendar-based ones; mature programs run both and can show why.
Most periodic review hours go into rebuilding profiles from scratch. Structure the file so each review documents what changed since the last one.

A defensible high risk customer review process combines a risk-based cadence, defined trigger events, a documented evidence standard, and a clear decision — retain, restrict, or exit — approved at the right level. Regulators do not prescribe a schedule; they expect you to justify yours, follow it, and evidence every conclusion, including “no change.”

What a high risk customer review process must cover

The FFIEC BSA/AML Examination Manual frames enhanced due diligence as a design obligation: the institution decides when additional information is collected and what it consists of, then owns those decisions in the exam.

Customers that pose higher money laundering or terrorist financing risks, (i.e., higher risk profile customers), present increased risk exposure to banks. As a result, due diligence policies, procedures, and processes should define both when and what additional customer information will be collected based on the customer risk profile and the specific risks posed.
— FFIEC BSA/AML Examination Manual, Customer Due Diligence

The manual also rejects treating “high risk” as one undifferentiated bucket:

Even within categories of customers with a higher risk profile, there can be a spectrum of risks and the extent to which additional ongoing due diligence measures are necessary may vary on a case-by-case basis.
— FFIEC BSA/AML Examination Manual, Customer Due Diligence

Practically, that means tiering within the high-risk population — an MSB with domestic flows and a foreign PEP-connected holding company should not share a review template or a cadence just because both carry the same rating label.

Cadence: periodic, trigger-based, or both

FinCEN settled the schedule question in its 2020 CDD FAQs — there is no mandated refresh cycle:

There is no categorical requirement that financial institutions update customer information on a continuous or periodic schedule. The requirement to update customer information is risk based and occurs as a result of normal monitoring.
— FinCEN, FIN-2020-G002, FAQs Regarding Customer Due Diligence Requirements

That freedom cuts both ways. Whatever cadence your procedures set becomes the standard you are examined against, and a missed annual review is a finding even though no rule required annual reviews in the first place.

Calendar-based: fires on a fixed schedule tied to risk rating (e.g., every 12 months for high-risk). Strength: predictable resourcing and easy-to-evidence completeness. Watch-out: profiles go stale between cycles, and workload spikes at period end.
Trigger-based: fires on events — SARs or repeat alerts, ownership changes, adverse media, expected-vs-actual activity drift. Strength: catches risk when it actually moves. Watch-out: needs reliable event feeds, and completeness is harder to prove.
Hybrid: both of the above. Strength: defensible baseline plus responsiveness. Watch-out: requires dedup logic so one customer is not reviewed three times in a quarter.

The review itself, step by step

Pull the prior review and its risk rationale. That is your baseline — not the onboarding file.
Refresh screening: sanctions, PEP status, and adverse media on the customer and its beneficial owners. This is the same discipline that drives screening adjudication — every hit dispositioned with reasoning, not a checkbox.
Compare expected to actual activity over the review window. Material drift is the single strongest signal in the file — investigate it, don't just note it.
Update KYC facts that changed: ownership and control, geographies, products in use, licensing status.
Reassess the risk rating with documented reasoning — including when it stays the same. An unexplained “still high” is as weak as an unexplained downgrade.
Decide: retain, retain with conditions (activity restrictions, enhanced monitoring), or exit. Route the decision to the approval level your procedures specify.
Record the decision, the evidence behind it, and the next review date or trigger conditions.

The delta problem: where review hours actually go

In practice, the expensive part of a high risk customer review process is not the hard cases — it is the large majority of reviews that conclude “no material change.” They cost hours anyway, because the file does not make the prior state legible: evidence is scattered across screening tools, the core system, and shared drives, and the last narrative cannot be trusted as a baseline. So the analyst rebuilds the entire profile from scratch to prove nothing happened.

The fix is structural, not motivational: make the prior review the explicit baseline and make the current review a documented delta — what changed, what did not, and what evidence supports each line. That is also the honest pitch for AI agents in EDD: an agent assembles the refreshed evidence picture and drafts the delta narrative, and the analyst spends their time judging the exceptions instead of reproducing the baseline. That division of labor is how Axle approaches enhanced due diligence reviews.

FAQ

How often should high-risk customers be reviewed?

No rule sets a frequency. Annual reviews for high-risk relationships are a widely used convention, with longer cycles for lower tiers, but FinCEN's 2020 FAQs confirm the obligation is risk-based. Set a cadence you can defend, write it down, and meet it.

What triggers an off-cycle high-risk customer review?

Common triggers: a SAR filing or repeated alerts, material ownership or control changes, credible adverse media, expansion into new products or geographies, and material deviation from expected activity. Define the list in procedures so “should this have triggered a review?” has an answer.

Do we have to update beneficial ownership information at every review?

No. Updating is risk-based: when monitoring surfaces a change relevant to the customer's risk — including beneficial ownership — you must update the information and reassess the risk profile. Institutions may still choose periodic refreshes on a risk basis, and many do for their highest tier.

If your periodic review backlog is growing faster than your team, see how Axle runs enhanced due diligence reviews — or start with the AI readiness playbook to gauge where agents fit your program.

High-Risk Customer Reviews: Building a Defensible Process

More from the blog