Ongoing CDD and Transaction Monitoring
Ongoing CDD is continuous
Ongoing CDD is not a one-off onboarding step. It requires you to keep customer information current, monitor transactions and activity, and review the relationship on a risk-based cycle. Higher-risk customers should be reviewed more frequently; low-risk customers less so. A trap is treating CDD as complete once the file is opened.
Transaction monitoring
Monitoring means establishing a baseline of expected activity and detecting deviations. Effective monitoring uses risk-based rules and thresholds (e.g., unusual volumes, structuring below reporting thresholds, rapid movement of funds, activity inconsistent with the customer's profile). Alerts must be investigated and documented, and outcomes fed back into the risk assessment and CDD.
Triggers for review
Review should be triggered by significant transactions, changes in ownership or control, changes in the nature of the relationship, adverse media or PEP status changes, and periodic cycles. When a customer cannot or will not provide updated information, consider whether to restrict or end the relationship and whether a SAR is warranted.
Worked example
A customer with a modest salary profile suddenly receives multiple small deposits from unrelated third parties and immediately transfers them offshore. Monitoring flags the pattern; you investigate, cannot establish a legitimate explanation, and escalate to a SAR.
Rule of thumb
Know the customer's normal, so you can spot the abnormal. Monitoring without a documented expected-activity baseline is not effective monitoring.