The rise of continuous KYC
Know Your Customer has operated as a series of fixed moments for a long time. Starting with verifying a customer at onboarding, reviewing them periodically, and intervening when something appears to have changed. But financial crime rarely unfolds according to scheduled review cycles. Corporate structures evolve overnight, sanctions lists shift daily, and customer risk profiles can change in an instant.
That disconnect is driving growing interest in continuous KYC. Rather than treating due diligence as a compliance checkpoint, financial institutions are increasingly exploring how technology can transform KYC into a living, data-driven process that monitors risk as it emerges. Advances in automation, real-time data integration and AI are making this transition increasingly achievable, promising stronger compliance while reducing unnecessary friction for legitimate customers.
In part 1 of The Future of Trust: Rethinking KYC in a Digital Financial System, we jumped into why traditional KYC no longer works and the reasons why it may be hitting its limit in today’s world.
For the second article of this four-part series, we examine why traditional KYC is no longer sufficient for an increasingly dynamic risk landscape, and how continuous KYC is emerging as the next evolution in customer due diligence.
What continuous KYC looks like
What does continuous KYC look like in practice? For Duco van Lanschot, co-founder and CEO of Duna, the honest answer that he sees is that most institutions still don’t know, because most of them haven’t done it.
Van Lanschot explained, “They have done more frequent KYC. The same files get pulled off the shelf and stamped, just on a tighter schedule. The unit of work never changed. Continuous KYC starts from a different premise. The work that the compliance team does is the change to the customer file between reviews: a beneficial owner added or removed, a director appearing on a sanctions list, a court filing landing in adverse media, a registered address shifting into a higher-risk jurisdiction.”
For the Duna CEO, these are the clear moments when a customer’s risk profile actually moves, and are the key moments the system has to act on. “Registries and watch lists are monitored in the background; the analyst is brought in when something material has happened.”
In practice, van Lanschot is clear that the architecture has to change in three distinct ways. First of all, he thinks the data has to be live – for example, daily PEP, sanctions and adverse media screening, as well as continous monitoring of corporate registry feeds.
“Second, the compliance rules themselves have to act on those signals automatically,” he states. “A material event triggers re-KYC.” And third, Van Lanschot highlights the case is no longer a folder, and is instead a living record that updates as the world updates, with every decision and AI suggestion logged.
He finished, “The industry has used “point-in-time KYC” as if it were a working solution. The market simply tolerated it because the alternative was too operationally expensive. The architecture for ongoing monitoring now exists, and the cost of running it has fallen far enough that there is no remaining excuse.”
While terms such as “continuous KYC”, “ongoing KYC” and “perpetual KYC” are now commonplace across the industry, Jon Elvin, strategic risk advisor at Saifr, cautions that they often describe very different approaches in practice.
“The labels of ‘ongoing KYC’, ‘continuous monitoring’ or ‘perpetual’ may describe the same objective, but it does not mean the same from firm to firm or vendor to vendor-solution execution,” he says.
Despite the differing approaches, the direction of travel is clear. Firms are looking to reduce manual reviews, shorten KYC refresh cycles and incorporate a wider range of risk signals into the customer lifecycle. Rather than relying solely on periodic reviews, continuous KYC uses automated triggers, such as changes to beneficial ownership, account signatories, business registration status or adverse media, to determine when a customer should be reassessed.
Transactional behaviour can also act as a catalyst, with unexpected activity prompting a KYC refresh alongside wider investigations. Elvin believes the ability to orchestrate these risk signals consistently is becoming critical as financial crime evolves.
“Risk is not present in clean defined timeframes or along functional boundaries,” he says, pointing to the growing use of AI-powered language and signal intelligence to identify risks that would otherwise remain hidden across disconnected datasets.
This is proving particularly valuable when monitoring complex corporate ownership structures, where changes in control or sanctions exposure can emerge rapidly and are increasingly difficult to detect through manual processes alone.
Zurab Kotaria, co-founder and CEO of Identomat, believes continuous KYC means moving away from treating verification as a one-time onboarding event.
He added, “A customer may be legitimate when they join a platform, but their risk profile, business activity, ownership structure, sanctions exposure, or transaction behaviour can change over time.”
In practice, Kotaria states, continuous KYC combines periodic reviews with event-driven monitoring “Instead of asking every customer to repeat the same verification process at fixed intervals, firms should be able to identify meaningful changes and respond proportionately.”
This he adds can include a change in a businesses’ beneficial ownership, new adverse media, unusual transaction patterns, a sactions update or inconsistencies between a customer’s stated profile and their activity.
Scott Nice, CRO at Label, stresses that continuous KYC is often talked about as if it simply means reviewing customers more frequently. However, in practice, he believes it should be a much bigger shift than that.
“It is the move from static, point-in-time compliance to a more dynamic operating model where changes in customer risk are identified, assessed and acted on as they happen, or much closer to when they happen,” Nice said. “Traditional KYC has always carried a structural weakness: a customer is onboarded, reviewed on a periodic cycle, and then often left largely untouched unless a trigger event occurs. In a digital financial system, that model is becoming increasingly difficult to defend.”
Nice adds that continuous KYC in practice means connecting customer data, transactional activity, sanctions, behavioural data, ownership information, document changes, risk indicators and adverse media screening in a more joined up workflow.
Nice remarked, “It does not mean every minor change needs to create a full refresh. That would be operationally impossible and commercially damaging. The key is risk-based monitoring, where meaningful changes are identified, prioritised and routed into the right workflow with a clear audit trail. A change in ownership, a new jurisdictional exposure, a shift in transactional behaviour or a material adverse media event should not have to wait until the next scheduled review to be understood.”
The biggest change in the view of the Label CRO is that KYC becomes less of an onboarding exercise and more of a lifestyle discipline.
“Onboarding remains important, but risk does not stay fixed after the customer is approved. In many firms, the real risk accumulates after onboarding, when the customer’s behaviour, structure, products, activity or geography begins to change. Continuous KYC is about recognising that reality and building controls around it.”
The practical challenge here is not just technology, it also stretches to operating model design. “Continuous KYC requires better data quality, stronger workflow, clearer exception handling, and a more intelligent approach to prioritisation. Without that, it can quickly become another source of alert fatigue.”
Nice views the goal here should not be to create more work for compliance teams, but it should be to identify the changes that matter, cut the noise and give analysts enough context to make better decisions more quickly.
Tim Khamzin, CEO of Vivox AI, believes that continuous KYC is not about running identity checks more frequently, but it is about maintaining a dynamic view of customer risk by combining changes in ownership, corporate structure, sanctions exposure, adverse media, transactional behaviour and other risk signals into an ongoing assessment.
He said, “The challenge is no longer collecting more data. It is identifying which changes are material, responding proportionately and maintaining a clear rationale for every compliance decision. That changes the conversation from ‘How fast can we verify identity?’ to ‘How quickly can we detect meaningful change, explain it and evidence every decision?’”
Kevin McGuinness, global head of strategy at Napier AI, added that continuous KYC means moving away from static, point-in-time checks toward ongoing monitoring that reflects a customer’s real risk profile as it changes – triggered by behaviour, transactions or external data, not just a periodic review date.
He said, “AI can genuinely improve this by spotting relevant changes faster and reducing noise from manual re-screening, but it introduces new risks around explainability and over-reliance on model outputs.”
Continuous KYC marks a shift away from compliance driven by the calendar and towards compliance driven by risk. Rather than relying on scheduled reviews, institutions are increasingly looking to identify changes in customer risk as they happen, allowing due diligence to become a continuous process rather than a periodic exercise.
Jason Palleschi, director of solutions marketing, financial crimes risk management at Quantifind, says this shift is gathering momentum across the industry. Reflecting on a recent Quantifind roundtable with senior compliance leaders from banking, payments, insurance and consulting, he says “one theme emerged consistently: the traditional refresh cycle is no longer sufficient.” While customer risk can change overnight, many KYC programmes still depend on refresh cycles that take place annually, or even less frequently.
“In practice, continuous KYC means moving beyond fixed refresh cycles and toward continuous monitoring that triggers reviews when meaningful risk changes occur,” Palleschi explains. Instead of reassessing every customer on a fixed timetable, firms monitor changes in ownership, sanctions exposure, adverse media, network relationships and other indicators that could materially alter a customer’s risk profile.
AI and entity resolution are central to making this practical, helping firms separate “routine changes from meaningful risk events” so compliance teams focus where risk has genuinely evolved. As participants at the roundtable noted, “the goal is not to create more reviews, but to create more relevant reviews by separating noise from material risk.” In short, “the goal isn’t to review everything continuously. It’s to continuously identify what matters.”
Despite growing consensus, Palleschi believes most firms are still on the journey. The biggest hurdles are not necessarily AI” but fragmented data, legacy systems, disconnected workflows and governance challenges.
Even so, he argues that “real-time compliance is no longer a theoretical future state. The transition is already underway.” The institutions that move fastest, he concludes, will be those able to combine “trusted data, explainable AI, and operational workflows into a single decision-making process”, underpinned by strong governance and a clear strategy for turning continuous intelligence into action.
For Comply Exchange, continuous KYC is about replacing periodic reviews with a model of ongoing monitoring that keeps customer risk assessments up to date in real time.
Rather than reviewing customers at fixed intervals, organisations maintain what the company describes as “a live picture” of their customer base by connecting to real-time data sources, including sanctions feeds, adverse media, corporate registry updates and transaction behaviour signals. “When something changes, it triggers a review automatically. There’s no waiting for the calendar.”
The result is a more targeted approach to compliance. Instead of repeatedly conducting routine rechecks, compliance teams can focus their attention on customers whose risk profiles have genuinely changed, significantly reducing the gap between a material event occurring and the organisation becoming aware of it.
According to Comply Exchange, the implications extend beyond operational efficiency. “This shift changes more than the process. It changes the role of the compliance function itself,” moving compliance away from periodic administration and towards continuous, risk-led oversight.
Can AI improve KYC?
Is AI able to improve KYC without creating new risks? Van Lanschot thinks this is the case, but only if it is done in the right way, with him seeing two paths.
He remarked, “The first is to deploy AI agents on top of existing legacy systems. This is where most institutions are starting, because it is the least disruptive. You take a workflow tool designed for human reviewers, wrap an LLM around it, and have the team use it for summarisation and case prep. You will get a productivity uplift. You will also inherit every weakness of the system: poor data quality, unstandardised human judgment baked into the rules, and an audit trail never designed to explain an agent’s decision. AI sitting on top of that is hard to defend against a regulator.”
The Duna co-founder detailed that the second path is to build AI-native. The compliance rules, the data which it is run on, and the cases analysts work in are all designed from the ground up to be used by both humans and agents. “Every decision is configurable, repeatable, and logged. The same case produces the same answer every time, with every step in the decision visible to the analyst and the regulator. AI in compliance has a higher bar than AI in customer support.”
Here, the cost of a wrong answer in customer support is a lost customer, and the cost of a wrong answer in AML is a regulatory finding, a fine and a name in the newspaper, he said.
Van Lanschot added, “Three things become non-negotiable: explainability, determinism, and live tracking of deltas. At a recent roundtable we ran with senior compliance leaders, one team reported a 50% reduction in time spent on false positives, with higher consistency than the human baseline. AI in compliance is an architecture problem and the infrastructure underneath has to be built for it.”
For Kotaria, he believes AI can improve KYC substantially, particularly by helping compliance teams process large volumes of information, identify anomalies, prioritise higher-risk cases, and reduce repetitive manual work.
He added, however, that it should not become a black box that makes high impact compliance decisions without transparency or accountability.
Kotaria explained, “The most effective use of AI is to support human judgement rather than replace it entirely. Firms need clear governance around data quality, model monitoring, explainability, bias testing, and escalation processes. An AI system may help identify which cases require attention, but there must still be a clear and auditable rationale behind the final decision.”
Elvin believes AI has the potential to significantly improve KYC by helping firms detect risk signals at a scale and speed that would be impossible manually. However, he warns that the technology is equally available to financial criminals. “AI is also a tool for bad actors,” he says, noting that it can be used to create increasingly convincing fraudulent documents, fabricated company histories and other false indicators that make illicit activity appear legitimate.
He also cautions against treating AI as an infallible decision-maker. “Some professionals are employing the ‘just trust the machine and outcome’ mindset and stop questioning things,” Elvin says. Instead, he argues that AI should strengthen human decision-making rather than replace it. Continuous monitoring, he adds, helps reduce the window in which customer risk can change unnoticed, but it is not a substitute for professional judgement.
According to Elvin, one of the biggest challenges facing firms is avoiding overconfidence in AI and automation. While some executives see AI-driven continuous monitoring as a route to lower costs and stronger compliance, he believes that assumption risks creating new vulnerabilities if governance fails to keep pace.
Human oversight, ongoing model monitoring and the ability to respond quickly to changing risks, whether sanctions, model drift or emerging financial crime typologies, remain essential. As he puts it, “Risk and exploitation will still occur,” making transparent governance and continuous validation just as important as the technology itself.
Khamzin says that AI has a role to play, but he believes regulators are unlikely to reward automation alone.
“They’ll reward explainability, governance and operational consistency. As AI becomes embedded in compliance operations, firms will increasingly be expected to demonstrate not only what decisions were made, but how they were reached, what evidence supported them and where human oversight was applied,” said the Vivox AI CEO.
“The winners won’t be the firms with the most AI. They’ll be the firms that can show, at any moment, why they trust a customer, adapt when that risk changes and produce an audit trail that regulators can readily follow.”
Khamzin’s final opinion here is that the debate is no longer whether firms should move to continuous KYC. He explained, “The regulatory direction has already been set. With the EU’s new AML framework, AMLA and the single rulebook are raising the bar from periodic customer reviews to consistently demonstrating that firms understand customer risk as it evolves, not just at onboarding.”
AI has the potential to transform KYC, but its success will depend less on the sophistication of the models than on the strength of the governance surrounding them. According to Nice, AI delivers the greatest value when it enhances compliance processes rather than attempts to replace them.
Nice argues that KYC teams are still burdened by fragmented systems, inconsistent documentation, manual reviews and duplicated effort, leaving analysts to interpret large volumes of information under significant time pressure. AI can ease that burden by summarising information, extracting data from documents, identifying inconsistencies, prioritising cases and detecting anomalies, enabling analysts to understand customer risk more quickly.
Its real value, however, lies in helping firms move “from static review to contextual review”. Nice explains that AI can identify whether changes in customer behaviour are genuinely unusual, highlight inconsistencies in ownership information, detect conflicting documentation and connect disparate data points that might otherwise be overlooked. Used effectively, he says, it makes KYC “more accurate and more responsive.”
Yet Nice is equally clear that AI introduces new risks if it is treated as a substitute for governance or human judgement. “KYC decisions need to be explainable, challengeable and evidenced,” he says.
Where AI contributes to a risk rating, escalation or customer decision, firms must understand how the output was generated, what data informed it and who remains accountable. “Automation does not change who is accountable, it changes how accountability must be designed, governed and evidenced.”
Ultimately, Nice believes the greatest threat is not AI itself, but poor foundations. “The biggest risk is AI operating on poor data inside weak processes,” he says. Incomplete or inconsistent customer data can simply accelerate flawed decision-making, while poorly governed models risk introducing bias, false confidence and decisions that cannot be reconstructed.
The firms that realise AI’s full potential, he concludes, will be those that use it to strengthen human judgement, improve workflows and enhance the evidence underpinning every compliance decision, rather than removing people from the process altogether.
Comply Exchange believes AI has the potential to significantly strengthen KYC, particularly by helping compliance teams cope with the growing volume and complexity of customer data. Rather than replacing human analysts, the technology is proving most valuable when used to accelerate and enhance their decision-making.
According to the company, AI can process vast quantities of unstructured data far faster than any manual team, identify patterns across customer portfolios that might otherwise go unnoticed and surface adverse media or behavioural signals that traditional rule-based systems are likely to miss. These capabilities are particularly valuable for a compliance function that has long struggled with data overload.
However, Comply Exchange stresses that the risks are just as real. AI models trained on historical datasets can inherit existing biases, while automated decisions made at scale are often more difficult to explain to regulators than manually documented reviews. The company also warns that the greater an organisation’s reliance on AI without appropriate human oversight, the greater the risk that errors go undetected and quietly proliferate.
The firms seeing the strongest results, Comply Exchange argues, are not those that have “handed KYC to an algorithm”, but those that have embedded AI within a robust governance framework.
In these organisations, AI-generated outputs are reviewed, decisions are documented and compliance teams retain clear accountability. Ultimately, the company believes AI can substantially improve KYC, but only when the governance framework surrounding it is every bit as rigorous as the model itself.
Palleschi, meanwhile, believes that AI is quickly becoming indispensable to modern KYC. As customer bases expand and risk signals multiply, he argues that manual processes alone are no longer capable of monitoring millions of customers effectively.
Palleschi says technologies such as AI, entity resolution and network analysis are increasingly essential for uncovering hidden relationships, prioritising risk, reducing false positives and accelerating investigations. However, he emphasises that success depends on how the technology is deployed. “The key is deploying AI in a way that increases transparency rather than reducing it.”
According to Palleschi, the strongest implementations use AI to resolve entities, prioritise alerts, uncover hidden relationships and summarise customer risk, while maintaining “clear evidence, audit trails, and human oversight.” Based on Quantifind’s experience, institutions achieve the best outcomes when “AI augments analyst judgment rather than attempts to replace it.”
With robust governance, explainability and human-in-the-loop controls, Palleschi believes AI can strengthen both risk detection and operational efficiency without introducing unacceptable new risks. Indeed, he says many compliance leaders are beginning to view AI “not as a source of additional risk, but as an important tool for managing risk at scale.”
Real-time compliance: Are firms ready?
A million-dollar question for many is whether companies are ready for real-time compliance.
Here, van Lanschot is clear that most are not, and the gap here is clearly widening. He gave the example of a roundtable hosted a few months ago by Duna with senior compliance leaders from a range of well-known global financial institutions and FinTechs.
“We asked the room a simple question: who here is using AI in a meaningful production workflow, beyond chatbots? Three out of 15 raised their hands. That is roughly the state of the market,” he succintly remarked.
Most teams in the view of the Duna CEO are not “behind” on AI in any sophisticated sense, instead, they have simply not started. The firms that have started, meanwhile, are already pulling away.
He explained, “They are solving the painful operational bottlenecks: false positives, document chasing, lifecycle reviews. The ROI is showing up in months. The next 12 to 24 months will make the distance between the two groups visible.”
The reason readiness lags is not capability in the view of van Lanschot. Tech, data and talent all exist, the bottleneck is instead in the architecture.
He detailed, “Most institutions are running on workflow systems optimised for certain steps to happen in sequence. They are actions-first instead of data-first. Real-time is a property of the architecture itself. You can’t get there by relabelling a quarterly batch job.”
Instead, ready in his view looks like a small set of conditions. Compliance rules are codified and version-controlled, not living in a word document. Customer data flows in continously, risk decisions are explainable at the level of the individual signal that drove them, the team is structured around exception handling rather than case-by-case manual view and the AI layer is deterministic and auditable.
Van Lanschot concluded, “For two decades, compliance has been holding the line for the financial system, largely alone. The second wave of AI is its turn. It brings the tools, and the recognition, this function has long been due.”
The answer to this question for McGuinness is partially. “The appetite is there, but many are still constrained by legacy infrastructure and data quality issues that need solving before real-time becomes reliable rather than just fast. What rarely gets said out loud is that bolt-ons and overlay approaches don’t modernise AML operations.”
He explained that if rule changes still take months, latency still prevents real‑time decisions, and upgrades remain annual events rather than continuous improvements, the core problem hasn’t been solved. It’s just been disguised.
“Configurable, risk-based approaches are fundamental to real-time screening to manage capacity and consumption. Blanket screening every customer and transaction in real-time against every list regardless of sanctions versus PEPs would be incredibly inefficient,” concluded McGuinness.
Elvin believes the debate has moved beyond whether firms are ready for real-time compliance. “It is here and will grow,” he says. The bigger challenge, he argues, is ensuring firms adopt it responsibly rather than simply moving faster for the sake of speed.
That starts with clearly defining where real-time controls add value, testing new approaches alongside existing processes and establishing meaningful performance metrics. Elvin also stresses the importance of documenting how controls are monitored, maintaining contingency plans if automated processes fail and ensuring there is sufficient transparency across the compliance function.
Just as importantly, firms need to prepare their workforce for changing roles, with investment in upskilling and managing the cultural shift that comes with greater automation. While early deployments have delivered promising results in areas such as onboarding, continuous KYC, adverse media screening and AML investigations, Elvin warns against measuring success by activity alone.
Many firms have increased capacity and reduced false positives, but have simply filled that capacity with additional data and reviews that do little to improve outcomes. “Doing more for more sake does not always mean it is a better process,” he says, arguing that firms should remain focused on effectiveness, proportionality and understanding when enough information has been gathered to reach a confident compliance decision.
Comply Exchange believes also that this is not fully the case, but that the gap is closing.
The firm said, “Real-time compliance operations require more than good technology. They require clean, structured, accessible data. They require integration between systems that have historically operated in silos. They require compliance teams with the skills and capacity to act on live alerts rather than batch reviews. And they require a regulatory environment that accommodates the shift.”
Many organizations are still working through the foundational steps, believes the firm, and legacy infrastructure makes real-time data feeds difficult to ingest cleanly. “Alert volumes from continuous monitoring can overwhelm teams who aren’t resourced or structured to handle them. Without the right workflows in place, real-time monitoring can create noise rather than clarity,” said Comply Exchange.
Label’s Nice is firm in the thought that most firms are not fully ready for real-time compliance operations, although many are moving in that direction.
He explained, “The ambition is clearly there. Financial institutions want faster onboarding, better customer experience, more responsive risk detection and more efficient compliance teams. The issue is that real-time compliance depends on foundations that many firms are still trying to fix.”
Real-time compliance requires clean data, integrated systems, clear ownership of decisions, well-designed workflows and the ability to act on information quickly.
In the view of Nice, many institution’s foundations in this area remain fragmented. “ Customer data may sit across multiple systems. Risk information may be interpreted differently by different teams. Reviews may still rely heavily on manual processes, spreadsheets, email approvals and institutional knowledge. In that environment, real-time compliance can become more of an aspiration than an operating reality.”
Additionally lies the control question. Real-time does not always mean instant approval or automatic action in every case. In regulated environments, he outlines, speed still has to be balanced with accountability.
He added, “Firms need to understand what can be automated, what should be escalated, and where human review is still required. A real-time model without proper controls can create just as much risk as a slow manual model.”
Nice concluded, “The firms that are closest to being ready are those that have already invested in data architecture, workflow automation, API-based integration, monitoring and clear governance. They are not just digitising old processes. They are redesigning compliance around better information flows and clearer decision-making. That is where the market needs to go. Real-time compliance will not be achieved by adding a new interface to an old operating model. It requires a more connected, evidence-led and risk-based way of running compliance.”
Palleschi’s view here is that whilst most firms recognize that compliance must become more continuous and intelligence-driven, few have fully reached that state.
He said, “The biggest obstacles are not necessarily AI. They’re fragmented data, legacy systems, disconnected workflows, and governance challenges. At Quantifind, we see many institutions making meaningful progress by investing in data modernization, entity resolution, workflow automation, and AI-assisted risk monitoring. The industry is increasingly focused on how to operationalize continuous monitoring, even as firms continue to debate the pace and scope of adoption.”
Palleschi concluded with the idea that real-time compliance is no longer a theoretical future state, the transition is already underway, and the institutions that move fastest will be those that can combine trusted data, explainable AI, and operational workflows into a single decision-making process.
He finished, “As we heard repeatedly from industry participants, success will depend not only on technology, but also on strong governance, cross-functional alignment, and a clear strategy for turning continuous intelligence into action.”
Finally, Kotaria is succinct – many firms are moving in this direction, but readiness for real-time compliance still varies widely.
He detailed, “In our experience, the biggest challenge is not necessarily the lack of technology. It is making sure that identity data, AML screening, ownership information, and monitoring processes are connected in a way that gives compliance teams a clear picture of risk as it changes.”
