September 11, 2026

Periodic KYC Refresh: Risk-Based Scheduling That Scales

Axle Team

Key takeaways

No U.S. rule mandates a fixed periodic KYC refresh interval. FinCEN is explicit that updating customer information is risk-based and driven by ongoing monitoring.
The familiar 1/3/5-year cadence is an industry convention, not a regulatory requirement — defend your schedule with your risk assessment, not with "everyone does it."
Examiners look for trigger-driven reviews layered on top of any calendar cycle: activity changes, ownership changes, negative news, law enforcement inquiries.
The scaling problem is not the review itself — it is the outreach chase cycle and the cohort spikes a calendar-based program creates.
The direction of travel is event-driven refresh with AI doing the data gathering, and humans deciding what a material change means.

A periodic KYC refresh is a scheduled re-review of a customer's information and risk rating. U.S. rules set no fixed interval: FinCEN's CDD Rule requires risk-based updates driven by ongoing monitoring. Most programs pair a risk-tiered calendar cycle — shortest for high-risk customers — with event-driven triggers that force a review when something material changes.

What a periodic KYC refresh actually requires

Start with what the rule does not say. There is no BSA provision that requires re-papering every customer every N years. When FinCEN answered this question directly in its 2020 CDD FAQs (FIN-2020-G002), the answer was unambiguous:

"There is no categorical requirement that financial institutions update customer information on a continuous or periodic schedule. The requirement to update customer information is risk based and occurs as a result of normal monitoring."
— FinCEN, FAQs Regarding Customer Due Diligence Requirements (FIN-2020-G002), August 2020

The same guidance adds that institutions "on the basis of risk, may choose to review customer information on a regular or periodic basis" — permission, not obligation. What you must have is documented policy: FinCEN expects institutions to establish processes "for determining whether and when, on the basis of risk, to update customer information to ensure that customer information is current and accurate."

That distinction matters at exam time. A bank that runs a 3-year cycle it cannot tie to its risk assessment is in a weaker position than one running a 5-year cycle with a well-documented trigger framework. The periodic KYC refresh schedule is a control you design, and you own the rationale.

Triggers first, calendar second

The FFIEC BSA/AML Examination Manual frames updating the same way, and names the events that should prompt a review:

"The requirement to update customer information is event-driven and occurs as a result of normal monitoring."
— FFIEC, BSA/AML Examination Manual, Customer Due Diligence

The manual's factors for when to review a relationship include significant and unexplained changes in account activity, changes in employment or business operation, changes in ownership of a business entity, red flags from suspicious activity monitoring, law enforcement inquiries, negative media hits, and the time elapsed since the risk profile was last assessed. Time is on the list — but it is one factor among seven, not the organizing principle.

For higher-risk customers, the manual is more direct: information from higher-risk customers "should be reviewed more closely at account opening and more frequently throughout the term of their relationship with the bank." That is the regulatory basis for tiered cadences.

A risk-based refresh schedule that scales

High — Common cadence (convention, not regulation): Annual review. Trigger overlay: All triggers route to immediate review; EDD scope.
Medium — Common cadence (convention, not regulation): ~3-year cycle. Trigger overlay: Ownership changes, activity deviations, adverse media.
Low — Common cadence (convention, not regulation): ~5-year cycle or trigger-only. Trigger overlay: Material triggers only; negative-consent outreach where policy allows.

To build the program:

Tie each tier's cadence to your enterprise risk assessment and write the rationale down — this is the document the examiner reads first.
Define your trigger catalog from the FFIEC factor list, and map each trigger to a required action and owner.
Scope the review by tier: a low-risk refresh confirming nothing changed should not use the same checklist as a high-risk EDD review.
Stagger due dates. Anchoring refresh dates to onboarding anniversaries means every growth quarter comes back as a workload spike years later.
Track completion, aging, and outreach non-response as management metrics — an overdue-refresh backlog is a finding waiting to be written.

Here is the observation that rarely makes it into policy documents: the expensive part of a periodic KYC refresh is not the analyst review — it is the chase cycle. A file goes into outreach, the customer ignores two emails, the case sits in pending for six weeks, and the analyst touches it four times before anything is decided. The fix is sequencing: exhaust internal data, registries, and screening sources first, and only contact the customer for the specific items you genuinely cannot verify independently. Programs that flip the order — outreach last instead of first — cut most of the touches per file and reserve restriction-or-exit decisions for true non-responders on material gaps.

Where AI agents change the economics

A refresh review is mostly evidence-gathering: pull the file, re-run screening, check registries for ownership changes, compare expected versus actual activity, and write up whether the risk rating still holds. That profile — high volume, repeatable steps, judgment at the end — is exactly where agentic automation earns its keep. FATF flagged this direction in its review of new technologies:

"AI and machine learning tools or solutions can also generate more accurate and complete assessments of ongoing customer due diligence and customer risk, which can be updated to account for new and emerging threats in real time."
— FATF, Opportunities and Challenges of New Technologies for AML/CFT, July 2021

This is what Justin, Axle's KYC refresh agent, is built for: working the refresh queue end to end — gathering evidence, re-screening, flagging material changes — and handing your team a documented file with the judgment call framed, not buried. Because agents absorb the volume, the cadence-versus-trigger tradeoff loosens: you can afford to run triggers continuously instead of saving everything for the calendar date. See how the pieces fit together on the Axle platform, or put your own refresh backlog numbers into the ROI calculator.

FAQ

How often should KYC be refreshed?

No U.S. regulation sets a frequency. FinCEN requires risk-based updating driven by ongoing monitoring, and permits — but does not require — a regular review cycle. Common convention is annual for high-risk customers with longer cycles for lower tiers, always combined with event-driven triggers.

Is perpetual KYC replacing the periodic KYC refresh?

Increasingly, yes — in design if not in name. Because the regulatory requirement is already event-driven, a program that monitors triggers continuously and refreshes on material change is closer to the rule's intent than a pure calendar cycle. Most institutions run a hybrid while they build trigger coverage.

Do we have to update beneficial ownership at every periodic review?

No. FinCEN's 2020 FAQs confirm there is no categorical obligation to update beneficial ownership on a schedule; updates are required when monitoring surfaces a relevant change. If ownership information turns out to be stale during a review, update it and reassess the risk rating.

Drowning in refresh backlog? Meet Justin, the KYC refresh agent — and see what a trigger-driven program looks like when the evidence-gathering runs itself.

Periodic KYC Refresh: Risk-Based Scheduling That Scales

More from the blog