A fundamental principle of an effective Know Your Customer (KYC) program is the application of a risk-based approach (RBA). For ongoing Customer Due Diligence (CDD), this means the frequency and intensity of customer profile reviews must be proportionate to the level of risk they present. High-risk customers require more frequent and enhanced reviews (e.g., annually or more often), while low-risk customers can be reviewed less frequently (e.g., every three to five years). This approach allows financial institutions to allocate their compliance resources efficiently, focusing on areas with the greatest potential for money laundering or terrorist financing risk.

B. A fixed yearly review for all customers is inefficient and contradicts the risk-based approach, which mandates differentiated review cycles based on risk ratings.

C. A customer's risk profile and circumstances can change over time. Therefore, ongoing monitoring and periodic reviews are mandatory regulatory requirements, even after a thorough initial onboarding.

D. Reviewing the full customer profile before every single transaction is operationally infeasible and not a regulatory expectation for ongoing due diligence or monitoring.

1. ACAMS Certified Know Your Customer Associate (CKYCA) Study Guide. Chapter 3

"Elements of a KYC Program

" Section: "Ongoing Monitoring and Updating Customer Information." This section explicitly details that the frequency of periodic reviews should be determined by the customer's risk rating

with high-risk customers reviewed more frequently than medium- or low-risk customers.

2. Financial Action Task Force (FATF). (2023). International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation – The FATF Recommendations. Paris: FATF/OECD. Interpretive Note to Recommendation 10 (Customer Due Diligence)

Paragraph 22. The note specifies that financial institutions must keep CDD information current by "undertaking reviews of existing records

particularly for higher-risk categories of customers

" directly supporting a risk-based frequency.