Ongoing due diligence and exits

Customer due diligence does not end when the account opens. A customer onboarded as a low-risk retail trader can become a money mule, a scam victim or a front for someone else within months, and the file is only useful if it changes when the customer does. This lesson covers keeping data current, spotting behavioral change, adverse-media screening, restricting and exiting relationships, and doing all of it without tipping off the customer or pushing whole groups out of the regulated system.

What ongoing due diligence means

FATF Recommendation 10 requires ongoing due diligence on every business relationship. It has two parts:

• scrutiny of transactions throughout the relationship, to make sure they are consistent with what the firm knows about the customer, their business and risk profile and, where necessary, their source of funds;
• keeping documents, data and information up to date and relevant, by reviewing existing records, particularly for higher-risk customers.

The first part is the subject of transaction monitoring (see the lesson Transaction monitoring for crypto businesses). This lesson focuses on the customer file and the decisions that follow from it.

Keeping data current

Review cycles come from the customer risk score: periodic reviews by band, plus reviews triggered by events (see the lesson Customer risk scoring). In practice, data goes stale in predictable ways:

Many firms are moving from calendar reviews toward event-driven review (sometimes called perpetual KYC): data feeds and monitoring signals trigger targeted refreshes, so a low-risk customer is not asked for documents for no reason while a changed customer is reviewed promptly. The calendar remains as a backstop. Each field in the file should carry the date it was last verified, so stale data is visible.

Detecting behavioral change

The profile captured at onboarding is the baseline. Signals that a customer's risk has changed include:

• volumes well above the declared expected activity, or a sudden change in the size or rhythm of transactions;
• new asset types, such as a first use of privacy coins;
• new counterparties: mixers, high-risk exchanges, gambling services, many unrelated self-hosted wallets;
• logins from new countries, IP locations that do not fit the declared residence, or several customers sharing one device;
• a dormant account suddenly reactivated, especially after a credential change;
• inflows from many unrelated people followed by fast withdrawals, a classic mule pattern.

A simple rule can turn the first signal into a review trigger:

-- Customers whose 30-day inflows exceed three times their declared monthly volume
SELECT c.customer_id,
       c.expected_monthly_usd,
       SUM(t.amount_usd) AS inflow_30d,
       SUM(t.amount_usd) / NULLIF(c.expected_monthly_usd, 0) AS ratio
FROM customers c
JOIN transactions t ON t.customer_id = c.customer_id
WHERE t.direction = 'in'
  AND t.booked_at >= CURRENT_DATE - INTERVAL '30' DAY
GROUP BY c.customer_id, c.expected_monthly_usd
HAVING SUM(t.amount_usd) > 3 * c.expected_monthly_usd
   AND SUM(t.amount_usd) > 10000;

The query sums each customer's inbound transactions (fiat and crypto, converted to USD at booking time) over the last 30 days and compares them with the declared expected monthly volume. NULLIF avoids division by zero when no expectation was recorded, and the second HAVING condition ignores small accounts where a tripling is immaterial. Date arithmetic differs between engines (some use DATEADD or DATE_SUB instead of INTERVAL). The output should open a customer review, not an alert to close in minutes: the analyst asks whether the profile, the risk score or the relationship needs to change. The multiplier and floor are illustrative and should be tuned (see the lesson Tuning, metrics and model governance).

Adverse-media screening

Adverse media (negative news) is credible public information linking a customer or beneficial owner to financial crime or related harm. The Wolfsberg Group's Negative News Screening FAQs (2022) support a risk-based approach: define which topics are relevant, which sources are credible, and how deep to search for each risk level, rather than treating every mention as a hit. A workable procedure:

1. Scope: categories such as fraud, corruption, sanctions evasion, terrorism, organized crime, tax crime and cybercrime.
2. Match: confirm that the article concerns this customer, using date of birth, location, business and photos, not the name alone.
3. Weigh: distinguish allegations from charges and convictions, and established media from anonymous posts.
4. Decide and record: no impact, risk score change, EDD, or suspicious transaction report, with the reasoning.

Crypto adds its own sources: allegations of rug pulls on social media, investigator threads attributing an exploit, community warnings about a token's founders. They can be early and accurate, or wrong and malicious, so weigh them like any other source and look for on-chain corroboration.

Restricting accounts

Between "carry on" and "exit" lies a range of graduated measures:

• a request for information to the customer about specific activity;
• lower deposit or withdrawal limits;
• disabling specific products, such as withdrawals to self-hosted wallets or OTC trading;
• enhanced monitoring with a shorter review date;
• a hold on specific funds while questions are resolved, where the firm's terms and the law allow it.

A mandatory freeze is different: when funds belong to a designated person, sanctions law requires a freeze and a report, whatever the firm would prefer (see the lesson Wallet and transaction screening). Every restriction should record its reason, its approver and its review date, so it does not become a permanent, unexplained block.

De-risking versus managing risk

De-risking means ending or refusing relationships with whole categories of customers to avoid risk rather than manage it. The FATF stated in October 2014 that the risk-based approach calls for case-by-case decisions, not wholesale de-risking. In October 2021 it published a stocktake of the unintended consequences of its standards, covering de-risking, financial exclusion, undue targeting of non-profit organizations, and the curtailment of human rights. Its February 2025 amendments on proportionality now ask supervisors to check for over-compliance.

The reasoning is practical as well as social. Customers pushed out of regulated firms do not stop transacting; they move to unregulated platforms and peer-to-peer channels where nobody screens or reports. Exiting an individual customer whose risk exceeds the firm's appetite and cannot be mitigated is sound risk management. Closing every account from one country, or every customer who uses self-hosted wallets, is not.

Offboarding without tipping off

When the decision is to exit, the order of steps matters:

1. Decide and document: an authorized person approves the exit and records the reasons.
2. Consider reporting first: if the exit follows a suspicion, or the firm could not complete CDD, it considers a suspicious transaction report before acting; Recommendation 10 expressly requires this where CDD could not be completed. Where the law requires the authority's consent before funds move, obtain it.
3. Check for a freeze: a sanctions obligation overrides any return of funds.
4. Notify neutrally: rely on the contractual right to end the relationship, without mentioning suspicion or any report. Staff who speak to the customer should have an approved script.
5. Return balances safely: to a bank account in the customer's name or an address whose control the customer has proven, not to a new third-party address supplied at exit.
6. Prevent re-entry: flag the identity, devices and wallets so the customer cannot simply reopen, within data protection limits.
7. Retain records for at least five years after the relationship ends (see the lesson Record keeping, data protection and information sharing).

Tipping-off is disclosing that a suspicious transaction report or related information is being or has been filed, which Recommendation 21 prohibits (see the lesson Suspicious transaction reporting obligations). INR.10 adds that where a firm forms a suspicion and reasonably believes that continuing CDD would tip off the customer, it may stop the CDD process and file a report instead. An exit notice that says "our compliance team has concerns about your transactions" may already tip off; one that cites the terms of service does not.

Exam focus: the two parts of ongoing due diligence in R.10; periodic versus event-driven review and dating each data field; signals of behavioral change and a simple volume-versus-profile rule; a risk-based adverse-media procedure (scope, match, weigh, decide); graduated restrictions versus mandatory sanctions freezes; the FATF position on de-risking (2014 statement, 2021 stocktake, 2025 proportionality changes); the offboarding sequence, including reporting before exit, safe return of funds and record retention; tipping-off under R.21 and the INR.10 option to stop CDD and file a report.