Ongoing Monitoring and Trigger Events: Refreshing Client Due Diligence

Customer due diligence does not end when a client is onboarded. The UK accountancy sector guidance expects firms to keep monitoring the relationship and to refresh what they know when something changes. This guide sets out, in plain language, what ongoing monitoring means in the 2026 guidance, which events should prompt a refresh and how to build a simple review cycle. For the starting point, see our guide to KYC and customer due diligence for accountancy practices.

Where this guide comes from

We used the CCAB's Anti-Money Laundering, Counter-Terrorist and Counter-Proliferation Financing Guidance for the Accountancy Sector, July 2026, which states at paragraph 1.3.1 that it has been approved by HM Treasury and is based on the law as of 1 July 2026. Paragraph numbers below are the guidance's own. We did not read the regulations themselves. This is general information, not legal advice.

What the guidance requires

Paragraph 4.5.5 is direct: regardless of the risk categorisation, businesses must monitor the client relationship, with the level varying by risk. Paragraph 5.2.5 adds that established business relationships should be subject to customer due diligence procedures throughout their duration, and that how often you review depends on both event-driven and periodic triggers.

Event-driven triggers

Paragraph 5.2.6 lists events that should prompt a review. They include a change in the beneficial ownership of the client, and information that is inconsistent with the business's knowledge of the client. Other triggers it names are the start of a new engagement and a significant change in the client's business activity. Paragraph 5.1.3, on when due diligence is required, also mentions appropriate points during the lifetime of the relationship and any doubt about the reliability of the identity information. Our guide to ultimate beneficial ownership explains why ownership changes matter.

Periodic reviews

Paragraph 5.2.7 says periodic reviews are risk-based, using the firm's own risk assessment under Chapter 4. The guidance does not set a fixed number of years. Paragraph 5.1.6 says customer due diligence for existing clients should be reviewed where it is necessary, timely and risk-appropriate. Paragraph 5.2.8 reassures firms that ongoing due diligence may involve updating existing information and risk assessments rather than repeating every step.

Refreshing the firm-wide picture

Monitoring is not only about individual clients. Paragraph 4.2.4 requires the firm's risk assessment to be refreshed regularly by periodic reviews and also by event-driven reviews when events affect money laundering, terrorist or proliferation financing risk. Paragraph 3.6.11 adds that a new service should be followed by greater monitoring for a period after it is introduced. Our guide to the firm-wide AML risk assessment shows how the pieces fit together.

Monitoring and the source of funds

Paragraph 5.2.9 ties monitoring to transactions: under regulation 28(11)(a), firms must scrutinise transactions during ongoing monitoring and, where necessary, the source of the client's funds. Paragraph 5.2.10 says source of funds checks are needed where a transaction appears inconsistent with the firm's knowledge of the client. The monitoring, in short, is meant to notice when something does not fit.

An illustrative example

The following is a made-up example, not a case from the guidance. A practice prepares the annual accounts for a small trading company. During the year the company's shareholders change, and a new director asks the practice to start advising on a group restructure. Under paragraph 5.2.6 each of those is a trigger: a change in beneficial ownership, and the start of a new engagement. A sensible response is to update the ownership information, confirm the new beneficial owners, consider whether the client's risk rating moves, and record the outcome on the file, rather than waiting for the next annual review.

Recording your reasoning

The guidance repeatedly returns to documentation. Paragraph 5.3.8 asks firms to set criteria for enhanced due diligence in their procedures, and the wider guidance expects a firm to be able to show how it reached its decisions. A short, dated file note stating the trigger, the checks done and the conclusion is usually enough to show that monitoring happened. It also protects the individual who made the call when a supervisor asks later.

Practical steps (our suggestions)

• Add a "review due" date to every client record, driven by the client's risk rating, and show it on a dashboard.
• Turn the trigger list into a short checklist for engagement partners: ownership change, new engagement, change in activity, inconsistent information.
• When a trigger fires, record what changed, what you re-checked and whether the risk rating moved.
• Make sure the person who hears about a change, often a junior or an administrator, knows to pass it on.
• Review your policy after any new service launch. Our CPD courses can help refresh team knowledge.

What we could not confirm

The guidance does not give a fixed review cycle, and we have not suggested one as a requirement. We did not read the text of the regulations, the guidance's chapters after section 5.4 or any HMRC-specific expectations. We also have not covered requirements outside the UK. Check the full guidance and your supervisor's expectations before finalising your procedures.

Frequently asked questions

How often must I review a client's due diligence?

The guidance says periodic reviews are risk-based and does not set a fixed interval.

Do low-risk clients need monitoring?

Yes. Paragraph 4.5.5 says monitoring applies regardless of the risk categorisation, with the level varying by risk.

What counts as a trigger event?

Examples in paragraph 5.2.6 include a change in beneficial ownership, inconsistent information, a new engagement and a significant change in activity.

Do I redo all the due diligence at each review?

Not necessarily. Paragraph 5.2.8 says ongoing due diligence may involve updating information and risk assessments.

Does a new engagement for an existing client count as a trigger?

Yes. Paragraph 5.2.6 lists the start of a new engagement as an example of an event-driven trigger.

Is monitoring only about transactions?

No. The guidance covers monitoring the relationship as a whole, including changes in ownership and activity, as well as scrutiny of transactions.

Explore more guides in our AML and KYC hub.