Periodic reviews that end in a risk decision, not just a completed checklist.
Customer information goes stale. Ownership changes, businesses expand, activity shifts. Verify schedules risk-based reviews and event-driven reviews, brings in the relationship manager, puts transaction context in front of the reviewer and records a documented risk decision on every file.
The question every review should answer
"What have we learned about this customer since the last review, what has changed, what risks does that change create, and what should we do about them?"
A scheduled check-in on an existing customer to confirm you still understand who they are and what they do.
A backlog of overdue reviews, especially higher-risk ones, is a control weakness examiners write up.
Reviews that come due on their own, land with an owner and end in a recorded decision.
Every review has an owner, a due date and a risk level.
The periodic review worklist sits beside onboarding in Verify. Reviews come due by risk level, events open early reviews, and overdue work escalates by your procedure so higher-risk files never sit at the bottom of a pile.
- Risk-based cycles you set. A different frequency for each risk rating, product or population.
- Event-driven reviews. Ownership changes, adverse media, unusual activity or an inquiry open a review now.
- Escalation built in. Overdue reviews are tracked, risk-ranked and escalated.
- Portfolio view. Backlog by risk, owner and age, for management and examiners.
| Customer | Risk | Due | Owner | Status |
|---|---|---|---|---|
| Bayline Marine Supply | High | Nov 08 | R. Patel | Overdue |
| Crescent Ag Partners | High | Nov 15 | L. Gomez | Event |
| Summit Ridge Paving | Medium | Nov 22 | J. Alvarez | RM input |
| Ironwood Medical Group | Medium | Nov 30 | M. Chen | In review |
| Northline Freight LLC | Low | Dec 12 | J. Alvarez | Scheduled |
Illustrative screen with sample data.
What an effective periodic review program looks like.
Periodic reviews are one part of ongoing customer due diligence, alongside transaction monitoring, screening, event-driven reviews and escalation. They're not a substitute for continuous risk-based monitoring. Here's how Verify supports each element of a strong program.
Define the purpose
Confirm information is current, reassess the nature and purpose of the relationship, identify new risks and decide whether the rating or controls should change.
Policy-driven checklistSet risk-based frequency
Higher-risk relationships get more frequent, deeper reviews. What matters is a methodology you can show is reasonably designed around your customers' risks.
Configurable cyclesResource it
Enough people, technology and oversight to finish reviews on time. Overdue reviews are tracked, risk-assessed and escalated.
Queues & escalationInvolve the relationship manager
Customer-facing staff know things no database does. Their documented assessment goes to compliance for review and challenge.
RM review task
Questions that prompt a real risk assessment.
A checklist creates consistency, but a review shouldn't be a mechanical exercise in updating fields. Verify's review templates ask the questions that reveal change.
Relationship manager questions
- Changes in business activities, products or services
- Changes in ownership, control or key individuals
- New geographic markets, customers or suppliers
- Expected transaction activity, source of funds or wealth
- Public or adverse information
Transaction context
- Volumes or values well above expected activity
- Significant shifts in inflows and outflows
- New counterparties or third-party payments
- Significant cash or new higher-risk jurisdictions
- Prior alerts or investigations for context
Complex structures & PEPs
- Changes in beneficial owners or nominee arrangements
- New jurisdictions or entities in the structure
- Purpose of the structure still consistent
- PEP status of owners, family and close associates
- Tax, sanctions or corruption risk indicators
Indicators prompt questions, not conclusions
A significant increase in activity may have a legitimate explanation, such as a new contract, an acquisition or seasonal business. An offshore relationship isn't, by itself, evidence of improper conduct. Verify flags patterns against thresholds your institution sets and calibrates. Illustrative thresholds like a 20% or 25% increase aren't universal regulatory requirements. The reviewer's job is to understand why activity changed and record the explanation.
Every review ends with a documented decision.
The reviewer records an assessment and recommendation, and management or compliance reviews and challenges it, especially where elevated risk is found. Verify offers the full range of outcomes, so the decision fits the facts.
- Maintain the current risk rating
- Increase the risk rating
- Apply enhanced due diligence
- Add monitoring or controls
- Request more information or documents
- Escalate to an AFC or risk committee
- Accept within risk appetite
- Restrict or exit the relationship
Quality assurance, measured
A mature program measures more than the percentage of reviews completed on time. Verify's QA view lets testers sample reviews and check whether:
- The review finished within the required timeframe
- Material changes were identified and risk ratings reassessed
- Transaction activity was considered where required
- Escalations happened when warranted
- Management challenged the relationship manager's assessment
The shift from completing a checklist to making a documented risk decision is what makes periodic reviews an effective part of an anti-financial crime program.From XDuce's guide, Effective Periodic Reviews
Questions compliance teams ask.
How often do periodic reviews have to happen?
There is no universal US requirement that every customer be reviewed on a fixed annual, biennial or triennial schedule. Under the CDD framework, institutions conduct ongoing monitoring and update customer information on a risk basis. Review frequency should come from your own policies, customer risk profiles, products and applicable requirements. Verify lets you set a different cycle for each risk level and change it as your policy changes.
What's the difference between a periodic review and an event-driven review?
A periodic review happens on your risk-based schedule. An event-driven review happens when something material changes before the next scheduled review, such as a change in ownership, business activity, geography or transaction behavior, adverse information or a law-enforcement inquiry. Verify runs both from their own queues on the same customer record.
Does every periodic review require refreshing all CDD information?
No. The need to obtain or update information depends on applicable requirements and your risk-based procedures. Verify's review checklist prompts a real risk assessment and records what was refreshed, what was confirmed and why.
How does Verify help with an overdue review backlog?
Every review has an owner and a due date. Overdue reviews are tracked, risk-ranked and escalated by your procedures, so higher-risk files surface first. Dashboards show the backlog by risk level, owner and age, which is exactly what an examiner will ask about.
Can relationship managers contribute without a full Verify license?
Relationship managers get a focused review task with the questions that matter, such as changes in business, ownership, markets and expected activity. Their assessment is recorded on the file and routed for compliance review and challenge.