Share
Answers for law firms
What is ongoing monitoring (pKYC) for law firms?
Ongoing monitoring is the duty to keep watching a client after onboarding. Regulation 28(11) of the Money Laundering Regulations 2017 requires a firm to scrutinise transactions, including where necessary the source of funds, to make sure they fit what it knows about the client, and to keep its due diligence records up to date. Perpetual KYC, or pKYC, is an industry name for doing this continuously rather than on a fixed review cycle.
| Question | Answer |
|---|---|
| The law | Money Laundering Regulations 2017, regulations 27(8), 27(9) and 28(11) |
| What it covers | Scrutiny of transactions and keeping client due diligence up to date |
| When to review | On each new matter, after a long gap, and whenever the client’s circumstances change |
| Higher risk clients | Enhanced monitoring always follows when enhanced due diligence applies |
| pKYC | An industry term for continuous, event-driven monitoring. It is not a legal term |
| Records | Note what was reviewed, what was found and what was decided |
What does the law require?
Regulation 28(11) has two parts.
- Scrutiny of transactions throughout the relationship, including where necessary the source of funds, to check they are consistent with the firm’s knowledge of the client, its business and its risk profile.
- Reviewing existing records and keeping the documents and information gathered for client due diligence up to date.
Regulation 27(8) also requires due diligence to be applied again to existing clients at appropriate times on a risk-based approach, and when the firm learns that circumstances relevant to its risk assessment have changed. Regulation 27(9) lists what the firm must take into account, including any sign that the client’s or a beneficial owner’s identity has changed, transactions that do not fit what the firm knows, and any change in the purpose or nature of the relationship.
When should a firm refresh client due diligence?
The Legal Sector Affinity Group guidance suggests reviewing, though not necessarily redoing, due diligence on each new matter. Where there has been a significant gap between instructions, the firm should consider refreshing it. For higher risk clients, anything over a year may count as a significant gap. Due diligence must be updated when the firm learns of a change of name, address, beneficial owner or business.
Monitoring can also be needed within a single matter, particularly a long one where the parties or the source of the money may change before it ends.
What is pKYC?
Traditional reviews happen on a calendar, on a cycle set by each client’s risk rating. Perpetual KYC instead reacts to events as they happen. A client appears on a sanctions list, becomes a politically exposed person, is named in adverse media, or changes ownership, and the firm is told and reviews the file. The law does not use the term, but the approach fits the risk-based duty in regulation 27 well, because changes are caught when they occur.
What firms typically do
- Check at each new instruction whether the client’s due diligence is still current, and record the check.
- Refresh due diligence after long gaps, and sooner for higher risk clients.
- Re-screen clients against sanctions and politically exposed person lists, rather than relying only on the check made at onboarding. See What is a PEP check for law firms?
- Compare money received with what the file says. On a property matter, completion money that arrives from an unexpected account or person is exactly what monitoring should catch.
- For enhanced due diligence clients, ask for more explanation when activity departs from the risk assessment and check source of funds more often.
- Record each review, including what was considered, what was found and the decision.
Common mistakes
- Treating onboarding as the end of due diligence.
- Reusing an old file for a new matter without checking whether anything has changed.
- Ignoring a change of name, address or ownership because the client is well known to the firm.
- Monitoring only identity and not where the money comes from.
- Doing reviews but keeping no record of them.
Kord’s ongoing monitoring re-screens clients every day for updates on politically exposed persons, sanctions and adverse media, as part of AML checks for law firms. For the checks themselves, see What are AML checks for law firms?
Questions firms ask
What is ongoing monitoring in AML?
It is the legal duty to keep scrutinising a client’s transactions against what the firm knows about them, and to keep due diligence records up to date, for as long as the business relationship lasts.
What does pKYC mean?
Perpetual KYC. It is an industry term for monitoring clients continuously and reviewing them when something changes, rather than only on a fixed review date.
How often should a law firm review client due diligence?
On a risk basis. Review it on each new matter, consider refreshing it after a significant gap, which can be over a year for higher risk clients, and update it whenever the client’s details or circumstances change.
Does a firm have to redo all checks for a returning client?
Not always. Review the existing due diligence first. Redo the checks that are out of date or where the risk or the client’s circumstances have changed.
What is enhanced monitoring?
Closer monitoring that always applies with enhanced due diligence. It can mean asking for more explanation, checking transactions and source of funds more often, and refreshing due diligence more frequently.
Does ongoing monitoring apply within a single matter?
It can. Long matters, or matters where the parties or the source of the money change, may need monitoring before they finish.