A customer passes screening on Monday. Three weeks later, a sanctions list is updated, the customer takes on a prominent public role, or new reporting links the person to a financial crime investigation.

The original screening result may have been correct. But does it still reflect what the organisation knows today?

This is the challenge of ongoing Anti-Money Laundering (AML) monitoring. A customer’s risk profile can change after onboarding, and a clean screening result is not a permanent guarantee. The challenge is not simply to find new information. It is to determine whether that information relates to the right person, whether it changes the customer’s risk, and what action should follow.

Why a One-Time Check Is Not Enough

Sanctions lists change as authorities publish new designations or amend existing records. A customer who was not a match yesterday may require review today. If screening takes place only when an account is opened, a relevant change could remain undetected until the next scheduled review.

Politically exposed person (PEP) status can change, too. A customer may assume a prominent public role or acquire a relevant relationship. Such changes may require additional due diligence under applicable rules and internal policies. PEP status alone, however, does not establish wrongdoing.

Adverse media presents a different challenge. New reporting may describe an investigation, allegation, enforcement action, or court decision. Yet a negative article does not automatically indicate that the customer has engaged in misconduct.

The system must establish who the report concerns, what the person is alleged or established to have done, and whether the information warrants a change in the customer’s risk assessment.

These are different types of change, but they share one requirement: new information must be evaluated in context before a compliance decision is made.

Five Questions Every Monitoring Process Should Answer

1. Are changes in sanctions data being detected?

Monitoring must account for new designations and amendments to existing records, not simply repeat yesterday’s results.

Teams need visibility into source updates, the records affected, and the customers who may require reassessment. A potential match must then be investigated using appropriate identifiers and the relevant source information.

The objective is not merely to receive an updated list. It is to establish whether the update has consequences for the organisation’s existing customers and compliance obligations.

2. Is a change in PEP status being assessed appropriately?

A newly identified public role or relevant relationship may change the due diligence required for a customer. The appropriate response depends on the role, the applicable rules, the customer’s circumstances, and the organisation’s risk assessment.

Former PEPs may also require continued assessment under relevant requirements and internal policy. Their status should not be treated as a permanent label that automatically determines risk.

Monitoring should identify relevant changes and ensure that the appropriate review takes place, rather than assume that every status change produces the same outcome.

3. Does new adverse media actually relate to the customer?

Names can be shared by different people. An article may contain negative language without making an allegation against the person being screened.

Consider a report about a financial crime investigation that mentions several individuals. A name-matching system may identify a customer whose name appears in the article, even if that customer has no connection to the alleged activity.

This is where context matters.

Review should consider available identifiers, the credibility and relevance of the source, the article’s content, and the role attributed to the person. It should also distinguish allegations from established findings.

A match is a reason to investigate, not a conclusion about the customer’s conduct.

4. Which alerts deserve attention first?

More alerts do not necessarily mean better monitoring.

If every new mention becomes an urgent case, analysts may spend valuable time clearing irrelevant matches. If screening thresholds are too restrictive, potentially significant information may be overlooked.

Prioritisation should consider several factors, including the confidence of the identity match, the nature of the new information, the existing customer risk, and the urgency of the required action.

Clear escalation rules help teams direct human judgement towards cases that need closer examination. They also reduce the risk of treating every alert as equally significant.

5. Can the decision be reconstructed later?

Identifying an alert is only one part of the process. An organisation must also be able to explain what happened after the alert was generated.

Depending on the applicable requirements, its records and controls should support reconstruction of the relevant process, including:

• The source of the information and when it was received.
• The change that triggered the alert and the matching information considered.
• The evidence reviewed and the rationale for the decision.
• The reviewer or authorised decision-maker and the action taken.
• Any escalation, follow-up, or subsequent reassessment.

The exact requirements will vary, but the principle remains important: a decision that cannot be adequately explained is harder to defend during an audit or regulatory review.

Where Continuous Monitoring Can Break Down

Even a well-designed screening process can fail if one part of the operational chain is unreliable.

A source may not update as expected. A customer’s name may be mapped incorrectly. A relevant alert may be generated but fail to reach the responsible team. An analyst may clear a case without recording sufficient reasoning, leaving the next reviewer unable to understand the decision.

These failures are different, and each requires a different control.

That is why monitoring should be tested beyond the point at which a potential match is identified. Teams should also establish whether the information was processed on time, the alert reached the correct workflow, the case was reviewed, and the outcome was documented and escalated where necessary.

Change-based monitoring can help focus attention on new information rather than repeatedly reviewing unchanged records. However, it depends on reliable source coverage, accurate identity resolution, timely processing, and effective integration with case-management workflows.

Automation can support these activities, but it cannot compensate for missing source data or an inadequately designed review process.

From New Information to a Defensible Decision

Continuous AML monitoring is not simply about checking customers more frequently. It is about maintaining an informed view of customer risk as relevant information changes.

KYC2020’s screening and monitoring capabilities help organisations identify relevant risk information and manage screening results within compliance workflows. The value of these capabilities depends on how effectively they support the full process, from identifying a potential match to reviewing the evidence and recording the outcome.

For compliance teams, the objective should be clear: detect meaningful changes, establish whether they concern the right customer, assess their significance, and take the appropriate action under documented policies.

A screening result tells you what the system identified at a particular point in time. Effective ongoing monitoring helps you determine whether new information changes what you should do next.