In today’s evolving risk environment, customer due diligence doesn’t end once an account is opened. Regulatory expectations—and practical risk management—require organizations to perform ongoing due diligence to monitor customer activity over time and respond to changes that could impact risk exposure.
Ongoing due diligence is a critical part of a strong BSA/AML compliance program, ensuring that organizations can identify unusual activity, reassess customer risk profiles, and take appropriate action before small issues escalate into regulatory or reputational problems.
In this article, we’ll explain what ongoing due diligence means, identify common events that should trigger a review, and outline how your organization can build an effective response framework. By understanding and managing ODD effectively, you can strengthen your compliance posture, better protect your organization, and meet examiner expectations with confidence.
What is Ongoing Due Diligence?
Ongoing due diligence is the process of continuously monitoring and reassessing customer relationships after the initial onboarding and account opening stages. While traditional Customer Due Diligence (CDD) focuses on gathering information during onboarding—such as verifying identity, understanding the nature of the relationship, and assessing initial risk—ODD ensures that the risk profile remains accurate over time as circumstances evolve.
In short, ongoing due diligence is about keeping customer information current and adjusting risk management efforts based on new behaviors, activities, or external information. This process allows organizations to detect changes that may indicate increased risk, suspicious activity, or the need for enhanced monitoring.
Unlike the initial CDD process, which is typically a one-time review at onboarding, ongoing due diligence is a continuous, risk-based process. Higher-risk customers require more frequent and detailed monitoring, while lower-risk customers may only need periodic updates or reviews triggered by specific events.
Ongoing due diligence is a regulatory expectation outlined in the FinCEN CDD Rule and reinforced by guidance in the FFIEC BSA/AML Examination Manual. Regulators expect organizations to actively monitor and update customer profiles when warranted—not simply file information away at onboarding and leave it untouched. Without an effective ODD process, organizations risk missing red flags, failing to detect suspicious activity, and falling out of compliance with BSA/AML obligations.
Regulatory Expectations for Ongoing Due Diligence
Regulators make it clear: due diligence is not a one-time event. Organizations are expected to perform ongoing monitoring of customer relationships and update customer information as new risks emerge. This expectation is outlined in the FinCEN CDD Rule, reinforced in the FFIEC BSA/AML Examination Manual, and echoed by federal and state regulatory agencies during BSA/AML examinations.
Ongoing due diligence is a key part of a risk-based BSA/AML program and should include the following elements:
- Monitoring for unusual or suspicious activity across accounts and products.
- Maintaining and updating customer information when changes in risk factors occur.
- Reassessing the customer’s risk profile based on new information or behavioral changes.
- Filing Suspicious Activity Reports (SARs) when appropriate, based on the results of monitoring and investigation.
Importantly, the FinCEN CDD Rule specifically emphasizes that organizations must understand the nature and purpose of the customer relationship and conduct ongoing monitoring to:
- Identify and report suspicious transactions, and
- Maintain and update customer information on a risk basis.
This doesn’t mean re-verifying every customer’s information on a rigid schedule. Instead, it means organizations must react to risk indicators or material changes in customer behavior, ownership, or business operations that would impact the risk assessment.
Regulators expect to see that organizations have implemented formal processes for identifying when ongoing due diligence is triggered, conducting reviews, updating customer profiles, and documenting the results. Failure to perform effective ongoing due diligence is a common exam finding and may lead to regulatory criticism, enforcement actions, or heightened supervisory attention.
Common Triggers for Ongoing Due Diligence
Ongoing due diligence is designed to be a risk-based process, meaning it is triggered when specific events or changes occur that could impact a customer’s risk profile. Recognizing these triggers early and responding appropriately is critical to maintaining an effective BSA/AML program.
Significant and Unexplained Changes in Account Activity
When a customer’s transaction patterns suddenly shift—such as a spike in transaction volume, larger-than-usual dollar amounts, new transaction types, or transfers to high-risk jurisdictions—this should trigger a closer look. Activity that is inconsistent with the original expected use of the account is often a red flag for potential suspicious activity.
Law Enforcement Inquiries, Subpoenas, or 314(a) Matches
Receiving a subpoena, a National Security Letter (NSL), or notification of a match to a 314(a) information request signals that the customer may be involved in an investigation. Organizations must escalate these matters and often update customer profiles based on findings from the inquiry.
Negative News or Adverse Media
Discovering negative news—such as allegations of fraud, financial crimes, regulatory violations, or adverse legal proceedings involving a customer—should immediately trigger a reassessment of the customer’s risk. Organizations should have monitoring tools or periodic checks in place to detect emerging adverse information.
Changes in Beneficial Ownership, Control, or Business Operations
For entity customers, significant changes to beneficial owners, business structure, or the nature of the business itself should prompt an updated customer profile review. These changes may alter the risk level associated with the account.
Geographic Risk Changes
If a customer begins transacting with, expanding into, or receiving funds from high-risk jurisdictions—such as countries designated by the FATF as non-cooperative or regions associated with heightened financial crime risk—this should trigger additional due diligence.
Dormancy Followed by Sudden Activity
Accounts that were previously inactive but suddenly experienced high levels of activity, particularly large deposits or international wires, should be flagged for review. Dormant account reactivation is a common tactic for money laundering.
Reluctance or Refusal to Provide Updated Information
When a customer hesitates or refuses to provide updated information requested during periodic reviews or event-driven reviews, it can indicate an attempt to evade scrutiny. Such behavior should elevate the account’s risk profile and may warrant enhanced monitoring or account closure.
How to Respond to Ongoing Due Diligence Triggers
Detecting a trigger event is only the first step—an effective ongoing due diligence (ODD) program requires a clear, consistent process for how to respond when changes or red flags are identified. A risk-based and well-documented approach is essential to meeting regulatory expectations and protecting your organization.
Identify and Escalate the Event
Once a trigger is detected—whether through transaction monitoring alerts, adverse media screening, or other channels—the matter should be escalated to the appropriate compliance or risk management team for further investigation. Clear escalation paths should be established so that staff knows exactly how and where to report potential issues.
Conduct a Targeted Review of the Customer Profile
Compliance staff should review the customer’s original risk assessment, onboarding documents, transaction history, and any previous investigations. The review should focus on understanding whether the new activity or information represents a material change to the customer’s risk level or business relationship.
Depending on the situation, it may also involve reaching out to the customer to request updated information, such as:
- Source of funds or source of wealth
- Purpose and nature of transactions
- New beneficial ownership or control structures
- Updated business description or geographic footprint
Update the Risk Rating and Customer File
If the review reveals that the customer’s risk profile has changed, the customer’s risk rating should be updated accordingly. For example:
- A moderate-risk customer may need to be reclassified as high risk.
- A previously low-risk customer may now require enhanced due diligence (EDD) measures. All findings, supporting documentation, and risk rating changes must be thoroughly documented in the customer file to create an audit trail.
Determine Appropriate Next Steps
Depending on the results of the review, the organization may:
- Maintain the relationship with updated monitoring parameters
- Place the account under heightened monitoring
- File a SAR if necessary
- Exit the relationship if the risks are unmanageable or if the customer refuses to provide required information
Decisions must be risk-based, consistent with the organization’s policies, and well-documented.
Document Everything Thoroughly
Documentation is critical. Organizations should maintain records of:
- The trigger event
- The steps taken to investigate
- Communications with the customer (if applicable)
- Findings and analysis performed
- Any risk rating changes and rationales
- Final decisions made and actions taken
Clear documentation ensures the organization can defend its actions to regulators and internal stakeholders if questions arise later.
Best Practices for Managing Ongoing Due Diligence
Building an effective ongoing CDD program requires more than reacting to individual events—it requires a structured, proactive framework that integrates ongoing monitoring into daily operations. By following these best practices, organizations can improve the consistency, effectiveness, and defensibility of their ODD efforts.
Implement Risk-Based Customer File Reviews
Organizations should schedule periodic reviews of customer files based on risk levels:
- High-risk customers should undergo more frequent and detailed reviews (e.g., annually or semi-annually).
- Moderate- and low-risk customers may require less frequent, event-driven reviews unless new information emerges.
Formalizing periodic reviews ensures that customer information stays up to date even in the absence of a specific trigger.
Integrating Ongoing CDD into Transaction Monitoring and Case Management Workflows
Rather than treating ongoing due diligence as a standalone process, it should be seamlessly integrated into:
- Transaction monitoring alert reviews
- Customer investigations
- Case management and escalation processes
Maintain Clear Escalation Paths and Procedures
Front-line staff and investigators must know how to escalate unusual activity or customer behavior for further due diligence. Organizations should establish and train staff on clear procedures for:
- Alerting the BSA Officer or compliance team
- Initiating an ongoing CDD review
- Determining when senior management or committees need to be involved
Train Staff to Recognize Ongoing Due Diligence Triggers
Training shouldn’t focus solely on onboarding or initial due diligence. Staff across departments—including front-line bankers, relationship managers, and operations teams—should be trained to:
- Identify risk triggers, such as unusual behavior, negative news, or customer reluctance to provide information
- Understand when and how to escalate concerns
- Document interactions that may be relevant to future ongoing reviews
Prioritize Documentation and Audit Trails
Every CDD event—whether it results in a risk rating change, SAR filing, or no action—should be fully documented. Examiners will expect to see:
- Clear records of what triggered the review
- The steps taken to investigate
- The decision-making rationale
Any resulting changes to monitoring or the customer profile
How RADD Can Help
RADD specializes in helping organizations build, strengthen, and optimize their CDD programs to align with regulatory expectations and evolving risk profiles. Whether you need to design a new CDD framework or enhance an existing process, RADD offers tailored solutions to meet your organization’s specific needs.
Whether you’re preparing for an upcoming exam, seeking to strengthen your compliance program, or responding to examiner feedback, RADD delivers practical, risk-based support to enhance your ongoing due diligence efforts and protect your organization from regulatory and reputational risks.
Conclusion
Ongoing due diligence is a vital part of maintaining a strong BSA/AML compliance program. It ensures that customer risk profiles remain accurate, emerging threats are identified early, and regulatory expectations are consistently met. By recognizing common triggers, responding quickly and appropriately, and integrating due diligence into daily compliance workflows, organizations can stay ahead of risk rather than reacting after issues arise.
A proactive, well-documented CDD program not only strengthens regulatory compliance but also helps protect your organization’s reputation and operational resilience.
RADD is here to help. Whether you need to design, review, or enhance your ongoing due diligence program, our team of compliance experts can deliver practical, tailored solutions to strengthen your customer monitoring framework.
Click here to book your session.