Due Diligence Refresh: Events That Need a Review

Distinguish a trigger from a conclusion

An ownership change, revised business activity, new signer, expiring document or contradictory source can indicate that a record needs attention. The trigger says what to investigate; it does not necessarily establish misconduct or require the same action in every case. Record the event's source, date, affected relationship and immediate policy requirements.

FATF's ongoing-due-diligence standard calls for keeping relevant customer information current, with attention to risk. The applicable implementation and operator policy determine timing and actions. Do not invent a yearly rule for every customer or assume that a calendar review makes intervening changes irrelevant.

Create the smallest complete review task

Link the trigger to the existing record and ask what changed. A new authorized signer may require identity and mandate checks without rewriting an unchanged ownership chart. A new holding company can require tracing several relationships. A funding explanation inconsistent with actual activity may need a focused assessment rather than another copy of the same identity document.

For corporate customers, compare ownership and control evidence at its effective date. FATF's beneficial-ownership guidance emphasizes current, reliable information and multiple relevant sources. Preserve previous versions so the reviewer can distinguish a newly changed fact from a late correction to an older error.

Close the loop and update dependent controls

Assign a reviewer, due date based on policy, escalation route and operational status while review is pending. Where activity restrictions are required, record their authority and scope. Do not assume the reminder engine can decide which transactions may continue. Communicate through the approved process and protect confidential review material.

After the decision, update affected roles, screening inputs, risk assessment and future review triggers. Record whether the change was confirmed, disproved or remains unresolved. A task marked complete should point to the evidence and decision, not merely show that an email was sent. Track overdue work so unanswered requests do not disappear from the operational queue.

Example: an ownership event creates linked tasks

A fictional company reports that Holding H acquired 60% of its shares on 1 September. The operator learns of the event on 10 September. The review records both dates, obtains the appropriate ownership evidence, traces H's relevant natural persons and checks whether the existing signer mandate changed. The historical chart remains available. The task closes only after the required decision and dependent records are updated.