The most widespread misconception about KYC is that it ends when a mandate is taken on. In fact ongoing diligence begins there, and in practice that part carries the greater load.
This article describes how to set up a review cycle that produces the evidence as a by-product rather than as an extra task. The wider context is in the guide to the family office operating system. It does not replace legal advice; assessment in the individual case remains with the responsible person.
Why onboarding is the easier part
A check describes a state at a point in time. Ownership changes, identity documents expire, a person can become a politically exposed person through an election, and the wealth structure develops in directions not foreseeable at onboarding.
Without recurring checks, the file after a few years describes a relationship that no longer exists in that form. The difference between a maintained and an unmaintained file becomes visible exactly when it matters — at a bank enquiry, an audit, or a supervisory review.
The rhythm follows the risk
There is no uniform cycle for all mandates. The risk-based approach requires that relationships with elevated risk be reviewed more often than low-risk ones. Risk-increasing factors typically include complex or opaque structures, links to certain jurisdictions, unusual transaction patterns, and the involvement of politically exposed persons.
A cycle identical for all mandates does not formally satisfy the approach: it is too costly for the low-risk ones and too lax for the high-risk ones. Your own organisation must set which rhythms apply to which risk classes — and justify that setting.
Triggers outside the cycle
Alongside the fixed rhythm, events should be defined that trigger a review regardless of the calendar: a recognisable change in ownership, a change in management or governing bodies, unusual transactions, adverse coverage, or an external indication.
An organisation that only works the calendar and has not defined these triggers is effectively monitoring only half. The calendar captures the expected; the triggers capture what actually becomes relevant.
The real problem is visibility
In practice, periodic review rarely fails because somebody refuses it. It fails because the due date is not visible. Where deadlines live in a separate list maintained by one person, the compliance of an entire practice depends on that person’s discipline and presence.
Due reviews therefore belong where the mandate is run, so they surface in the daily workflow rather than waiting in a side file. That is not a technical nicety but the difference between a process and an intention.
Producing the evidence as a by-product
The central idea: a workflow that produces the documentation as a by-product beats a retrospective documentation exercise. Where onboarding, screening, assessment and review happen in the system, the audit trail builds itself — who changed what and when is recorded without anybody noting it separately.
Where the same work is spread across mail, drive and spreadsheet, the connection must be re-established by hand at every review. Every system break is a place where evidence goes missing.
A review with no finding also belongs documented
A frequently overlooked point: a review producing no change belongs recorded just as much as one with a finding. An empty period in the file is, under review, indistinguishable from an omitted control. Documenting only when something changed produces a file with gaps, although the work was done.
What a cycle contains concretely
A review typically covers the currency of identification documents, confirmation or correction of the beneficial owners, a fresh check for politically exposed persons among those involved, reconciliation of actual against expected business activity, and a reassessment of the risk rating.
Where a change emerges, additional enquiries or an adjustment to the rhythm follow. How that flow looks in a mandate operation is shown in FLIORE for compliance officers.
In summary
Compliance rarely fails for lack of diligence and almost always for lack of demonstrability. Three things make the difference: a rhythm that follows risk and is justified; defined triggers outside the calendar; and a process that produces evidence while the work is being done. All three are organisational work, not a question of individual conscientiousness.