# The KYC Refresh Mistake That Fails Every FATF Mutual Evaluation: Treating Review Dates as Compliance Proof
The FATF KYC refresh requirement risk based approach is one of the most misunderstood elements of Recommendation 10. Most financial institutions in the Kingdom have built customer review programmes that look compliant on paper: every customer has a refresh date, every review is completed on schedule, and the documentation is filed neatly. Yet when FATF-style mutual evaluations arrive, or when SAMA conducts thematic reviews, these same programmes are flagged for deficiencies.
The problem is not the existence of a refresh schedule. The problem is that the schedule itself has become the trigger. Institutions refresh customer due diligence because a calendar date arrives, not because the customer's risk profile demands it. This creates a dangerous illusion: compliant-looking review dates masking stale, outdated risk assessments that fail to reflect material changes in customer behaviour, ownership, or exposure.
This article examines the common mistakes institutions make when designing KYC refresh programmes, explains why event-driven triggers satisfy FATF assessors where calendar cycles do not, and describes how to build the monitoring layer that makes risk-based refresh operationally feasible.
Mistake One: Treating the Review Date as the Trigger Event
The most widespread error is treating the passage of time as sufficient reason to refresh customer due diligence. An institution sets a policy: high-risk customers reviewed annually, medium-risk every two years, low-risk every three. The compliance team executes these reviews on schedule, collects updated documents, and closes the case.
FATF Recommendation 10 does not prohibit periodic reviews. But it requires that the timing and depth of customer due diligence be determined by risk. A calendar date is not a risk indicator. It is an administrative convenience.
When assessors examine a sample of refreshed customer files, they ask what changed. If the answer is only that twelve months passed, the refresh adds no value. The customer's risk profile remains unchanged, the institution's understanding of the relationship is not deepened, and the exercise becomes a compliance theatre that consumes resources without reducing risk.
Do this instead: Treat periodic reviews as a backstop, not the primary trigger. Design your refresh programme around material events: changes in beneficial ownership, significant shifts in transaction patterns, adverse media hits, changes in business activity, regulatory sanctions in the customer's jurisdiction, or elevation to politically exposed person status. The calendar review becomes a safety net for customers who experience no trigger events, not the main mechanism.
Mistake Two: Refreshing Without Re-Assessing Risk
Many institutions refresh customer information but do not refresh the risk rating. The compliance officer collects updated trade licenses, financial statements, and source-of-wealth declarations, files them in the customer record, and marks the review complete. The customer's risk score remains unchanged from the onboarding date.
This approach satisfies a narrow interpretation of due diligence—information is current—but it fails the risk-based test. If new information does not feed into risk assessment, the refresh is pointless. A customer whose transaction volume has tripled, whose beneficial ownership has shifted to a higher-risk jurisdiction, or whose business activity now includes cross-border trade should not carry the same risk rating assigned three years earlier when the relationship was domestic and low-value.
FATF assessors look for evidence that institutions use refreshed information to adjust risk ratings, enhance monitoring parameters, and escalate due diligence where necessary. A static risk rating in the face of material change signals that the institution is not truly applying a risk-based approach.
Do this instead: Make risk re-assessment a mandatory step in every refresh workflow. The compliance officer should be required to review the customer's current risk score against updated information and transaction history, and either confirm the rating or escalate for re-scoring. Any change in risk rating should automatically trigger adjustments to transaction monitoring thresholds, screening frequency, and due diligence depth.
Mistake Three: Running Refresh in Isolation from Transaction Monitoring
In many institutions, the KYC refresh function and the transaction monitoring function operate in separate silos. The refresh team works from a calendar-driven task list, while the monitoring team generates alerts based on rules and scenarios. The two rarely communicate.
This separation creates a critical gap. Transaction monitoring systems detect anomalies—sudden increases in cash deposits, new counterparty jurisdictions, changes in transaction purpose—that are precisely the trigger events that should initiate a KYC refresh. But if the monitoring team resolves the alert without notifying the refresh team, the opportunity is lost. The customer's profile remains outdated, and the institution misses the chance to understand whether the anomaly reflects a permanent change in risk.
FATF expects institutions to integrate these functions. An alert that reveals a material change in customer behaviour should automatically generate a refresh task. Conversely, a scheduled refresh should pull recent alert history to inform the risk assessment.
Do this instead: Build a feedback loop between transaction monitoring and KYC refresh. Configure your case management system so that certain alert dispositions—particularly those involving pattern changes, new geographies, or unexplained activity—automatically create a refresh task. Ensure that refresh workflows display recent alerts and require the compliance officer to consider them when re-assessing risk.
Mistake Four: Ignoring Adverse Media as a Refresh Trigger
Adverse media screening is often treated as an onboarding control, run once when the customer is accepted and then forgotten. Ongoing adverse media monitoring, if it exists at all, is typically limited to high-risk customers or politically exposed persons.
This is a significant oversight. Adverse media is one of the clearest indicators that a customer's risk profile has changed. A corporate customer involved in a corruption investigation, a beneficial owner sanctioned by a foreign government, or a trading partner accused of sanctions evasion all represent material changes in risk that demand immediate refresh and possible relationship exit.
FATF Recommendation 10 requires institutions to conduct ongoing due diligence, which includes monitoring for information that affects the customer's risk profile. Adverse media is precisely that information. Institutions that fail to monitor it, or that monitor it but do not act on hits, are not meeting the standard.
Do this instead: Implement continuous adverse media screening for all customers, with alert thresholds calibrated to risk. High-risk customers should be screened daily or weekly; medium-risk monthly; low-risk quarterly. Any confirmed adverse media hit should trigger an immediate refresh task, not a note in the file for the next scheduled review. The compliance officer should assess whether the adverse information changes the risk rating, requires enhanced due diligence, or justifies relationship termination.
Mistake Five: Documenting the Refresh but Not the Decision
Institutions often document what they did during a refresh—documents collected, databases checked, forms signed—but fail to document why they concluded the customer's risk profile remains acceptable. The file shows that a review occurred, but not what the reviewer thought about what they found.
FATF assessors look for evidence of judgment, not just process. They want to see that the compliance officer considered the updated information, weighed it against the customer's risk rating and transaction history, and made a reasoned decision. A checklist of completed tasks is not sufficient.
This becomes particularly important when a refresh reveals information that could be interpreted as increasing risk—a new beneficial owner from a higher-risk jurisdiction, a change in business activity, a spike in transaction volume—but the institution decides the risk remains acceptable. Without documented reasoning, the decision looks arbitrary or, worse, like the institution is ignoring red flags.
Do this instead: Require a narrative assessment in every refresh. The compliance officer should document what new information was obtained, how it compares to the baseline, whether it affects the risk rating, and why the relationship remains acceptable (or why enhanced measures are now required). This narrative should be reviewed and approved by a supervisor for high-risk customers. The goal is a file that tells a story, not just a series of ticked boxes.
Mistake Six: Treating Enhanced Due Diligence as a One-Time Event
When a customer is classified as high-risk—whether at onboarding or after a refresh—institutions typically apply enhanced due diligence: additional documentation, senior approval, more frequent reviews. But many treat this as a one-time elevation. Once the enhanced measures are applied and the customer is accepted, the institution reverts to routine monitoring.
FATF Recommendation 10 requires ongoing enhanced due diligence for high-risk customers. This means not only more frequent refresh cycles, but also deeper inquiry at each refresh. The compliance officer should be expected to verify source of wealth and source of funds again, to probe changes in business activity, to scrutinize beneficial ownership more closely, and to assess whether the relationship still makes sense given the institution's risk appetite.
Institutions that apply enhanced due diligence once and then treat subsequent refreshes as routine are not maintaining the heightened vigilance that the risk classification demands.
Do this instead: Differentiate the refresh workflow by risk tier. High-risk refreshes should require additional steps: re-verification of source of wealth, review of recent transaction patterns against expected activity, enhanced adverse media screening, and senior sign-off. The workflow should enforce these steps, not leave them to the compliance officer's discretion. The goal is to ensure that enhanced due diligence is truly ongoing, not a box ticked at onboarding.
Building the Monitoring Layer That Feeds Event-Driven Refresh
The shift from calendar-driven to event-driven refresh is not simply a policy change. It requires a monitoring infrastructure that detects trigger events and routes them to the refresh team.
This infrastructure has four components:
Transaction monitoring integration. The transaction monitoring system must be configured to flag pattern changes, not just rule violations. A customer whose monthly transaction volume doubles, whose counterparty profile shifts to new jurisdictions, or whose transaction purposes change should generate an alert even if no specific rule is breached. These alerts should feed into the refresh queue.
Ongoing screening. Sanctions, PEP, and adverse media screening must run continuously, not just at onboarding. The screening system should be integrated with the customer database so that any new hit generates a task for the compliance team to assess and, if material, initiate a refresh.
Beneficial ownership monitoring. Changes in beneficial ownership are among the most significant risk triggers, yet many institutions only verify ownership at onboarding. Implement a process to monitor corporate registry updates, annual report filings, and customer notifications of ownership changes. Any change in beneficial ownership should trigger an immediate refresh.
Case management workflow. The case management system should consolidate trigger events—alerts, screening hits, ownership changes—and create refresh tasks automatically. The compliance officer should see all relevant information in a single view: the original risk assessment, recent transaction history, screening results, and the specific event that triggered the refresh.
This monitoring layer is not a luxury. It is the operational foundation that makes risk-based refresh feasible. Without it, institutions are forced to rely on calendar cycles because they have no other mechanism to identify when a customer's risk profile has changed.
How Independent Assessment Identifies Refresh Programme Weaknesses
Institutions preparing for FATF-style assessments or SAMA thematic reviews often believe their KYC refresh programmes are sound because reviews are completed on time and documentation is in order. The weaknesses described in this article—calendar triggers, static risk ratings, siloed workflows—are not visible in completion metrics.
An independent assessment of your AML/CTF program against the SAMA rules and the FATF Recommendations examines whether your refresh programme is truly risk-based. The assessment includes a review of policies, risk assessment and governance, as well as sample testing of customer files and alerts to determine whether refreshes are triggered by material events, whether risk ratings are updated, and whether the institution's understanding of the customer relationship deepens with each review.
The assessment is delivered over 5–8 weeks and includes an independent AML/CTF assessment report, findings rated by severity, a remediation roadmap, and a board summary. The process follows four stages: plan (scope, risk profile and sample design), review (policies, risk assessment and governance), test (customer files, alerts and reports), and report (rated findings, roadmap and board summary). The assessment is designed to serve as independent testing of your AML/CTF program, and the sample is risk-based and agreed with you, typically covering every high-risk segment.
The assessment does not simply confirm that refreshes occur. It evaluates whether the refresh programme reduces risk, whether it integrates with transaction monitoring and screening, and whether it produces the evidence of ongoing due diligence that FATF assessors expect. Institutions that address these gaps before a mutual evaluation or regulatory inspection are far better positioned to demonstrate compliance with the risk-based approach.
