What is ongoing monitoring under the AMLR? Article 26 explained for fund administrators and ManCos
Fredrik Gröndahl8 min readThought Leadership
Ongoing monitoring under the AMLR is the duty to keep a customer's file current for as long as the relationship lasts: update it when something relevant changes, and re-check it on a risk-based schedule that cannot stretch past five years, or one year for higher-risk customers. From 10 July 2027 it is a direct obligation under Article 26 of Regulation (EU) 2024/1624.
Ongoing monitoring (the AMLR's term), also called perpetual KYC, pKYC, continuous KYC or event-driven KYC, means the file changes when the client does, with the periodic review as the backstop rather than the method. This article is written for compliance teams at management companies, fund administrators and trust and company service providers, where the manual work of keeping files current is heaviest.
The consultation on AMLA's draft guidelines on ongoing monitoring closed on 3 September 2026. AMLA opened it on 3 June and held a public hearing on 2 July; final guidelines are expected in the fourth quarter of 2026. Until then the text remains a draft, and everything below that refers to the guidelines refers to the draft.
What Article 26 requires, for fund administrators and ManCos
The guidelines are developed under Article 26(5) of the Anti-Money Laundering Regulation. They cover two duties: keeping customer information up to date, and monitoring transactions and activity. This article focuses on the first, because it is where management companies, fund administrators and trust and company service providers carry the most manual work.
| Provision | What it requires | What it means for the file |
|---|---|---|
| Article 26(2) | Customer information is updated on a risk-based schedule. The interval cannot exceed five years, and cannot exceed one year for higher-risk customers. | Every client has a next review date, and the date follows the risk rating. |
| Article 26(3) | Customer information is updated when a relevant change in the customer's circumstances occurs. | A review can be triggered at any time by an event, not only by the calendar. |
| Article 26(5) | AMLA issues guidelines on how ongoing monitoring is carried out. | The draft (consulted 3 June to 3 September 2026) defines the triggers and the risk-based approach; final text expected Q4 2026. |
| Application | The AMLR applies from 10 July 2027. | Policies, review calendars and evidence records need to be in place before then. |
Two kinds of review, one customer file
The draft describes keeping information current through periodic reviews and event-driven reviews, both applied on a risk-based approach. It would be easy to read that as a choice. It is better read as two controls that cover different failures.
Consider a hypothetical fund structure reviewed every three years. Eight months after its last review, a new controlling shareholder appears in a registry filing. An event-driven review catches the change. The periodic review then catches what no single event reveals: a business activity that drifted slowly, or a source of wealth explanation that no longer matches the relationship.
The draft lists the kinds of change that should prompt a review, including changes in identity, ownership or legal status, unusual behaviour or transactions, adverse media or a change in politically exposed person status, and changes in financial situation or business activity. A firm that relies only on those signals depends on every one of them reaching the file. A firm that relies only on the calendar will learn about most of them late.
Write down what an event review does to the date
The practical question every team will face is simple: when an event-driven review is completed, does the next periodic review date move? Published summaries of the draft do not describe a rule for this, and firms should not wait for the final text to decide.
There are defensible answers either way. A full review triggered by an ownership change may cover everything a periodic review would, which could justify resetting the clock. A narrow review of one adverse media hit covers far less, and moving the date would leave the rest of the file older than the schedule suggests.
The policy should therefore tie any change to the scope of the review actually performed. Record which parts of the file were refreshed, who approved moving the date and why. A supervisor reading the file later should be able to see that the calendar moved because the evidence moved with it, not because a review was convenient to close.
Reuse what is still valid
The draft points towards a risk-based view of document refresh rather than automatic re-collection when a document expires. It asks firms to consider the customer's risk level, the risk of the issuing country and whether the updated document is relevant. It also recognises several ways to obtain current information, including official registers, commercial and open sources, confirmation from the customer and information from other obliged entities.
For a firm with hundreds of client entities, that matters. Asking every customer to resubmit a full pack at each review creates delay and fatigue without improving the file. A review that confirms which items remain accurate, refreshes only what changed and records the source used for each is both faster and easier to defend.
Reuse needs discipline. Each retained item should show when it was last confirmed and against what. Evidence that was never verified at the start does not become reliable because it has been carried forward three times.
Proportionate does not mean optional
The draft allows firms to adjust review intensity for low-risk customers where there is no new activity. That is a useful allowance for dormant or simple relationships. It is not permission to stop reviewing them. The lighter review still needs a date, an owner and a record of what was checked.
For transaction and activity monitoring, commentary on the draft notes that non-financial firms may use proportionate alternative measures, such as structured assessments of customer behaviour, and that monitoring frameworks should be explainable, tested and documented. The same expectations are a sensible standard for the review calendar itself.
What to do before the final text
The AMLR applies from 10 July 2027, and the final guidelines are expected well before then. That leaves time to prepare without guessing at wording that may still change. Four steps hold up under most plausible outcomes:
- List the events that trigger a review for each customer type, and the source expected to reveal each one.
- Set a written rule for when an event-driven review may move the periodic date, linked to its scope.
- Record, for every retained document or data point, when it was last confirmed and how.
- Define what a lighter review of a low-risk, inactive relationship must still contain.
Our earlier analysis of perpetual KYC readiness argued that continuous monitoring depends on structured customer data. AMLA's draft points the same way, while keeping the periodic review in place. Firms that treat the calendar and the triggers as one system will be ready for whichever final wording arrives.
Fidify's platform works with the screening data a firm already has and keeps the dated record of what was checked, when and against what, which is what every step above depends on. If you want to see how that looks for your client base, talk to our team.
Frequently asked questions
How often must a KYC file be updated under the AMLR?
On a risk-based schedule that cannot exceed five years, or one year for higher-risk customers (Article 26(2)), and additionally whenever a relevant change in the customer's circumstances occurs (Article 26(3)). The calendar is the floor, not the method.
What counts as a trigger for an event-driven review?
AMLA's draft guidelines list changes in identity, ownership or legal status, unusual behaviour or transactions, adverse media or a change in PEP status, and changes in financial situation or business activity. Each firm should map which source is expected to reveal each trigger for each customer type.
Does an event-driven review reset the periodic review date?
The published summaries of the draft do not set a rule, so the firm's own policy has to. Tie any change of date to the scope of the review actually performed, and record who approved it and why.
Do expired documents have to be re-collected automatically?
Not under the draft. It points to a risk-based decision that weighs the customer's risk level, the issuing country and whether the updated document would add anything, and it recognises registers and other reliable sources as ways to confirm current information.
Is ongoing monitoring the same as perpetual KYC?
Ongoing monitoring is the regulatory term in the AMLR; perpetual KYC (pKYC), continuous KYC and event-driven KYC are market terms for the same practice of updating the file when the client changes. The AMLR keeps the periodic review as a backstop alongside it.
Sources and further reading
Anti-Money Laundering Authority, AMLA consults on draft Guidelines for ongoing monitoring of business relationships, consultation open 3 June to 3 September 2026. The guidelines remain draft.
Regulation (EU) 2024/1624 (the AMLR), Article 26.
Article 26(2) and 26(3) update obligations, summary.
CMS, AMLA publishes draft guidelines on ongoing monitoring under Article 26(5) AMLR, 10 August 2026. Source for the expected Q4 2026 date of the final guidelines.
