Periodic KYB vs Perpetual KYB: Which Approach Actually Protects Your Business in 2026

A supplier you onboarded last March is now controlled by a sanctioned individual. The change happened in September. You don't know yet — your next review is scheduled for March. Six months of exposure, all of it sitting in a clean-looking compliance file.

This is the gap regulators have stopped tolerating. In 2025, the FCA fined Monzo £21.1m for failures across customer due diligence and ongoing monitoring. Nationwide was fined £44m in December for control failures that allowed £27.3m in COVID furlough fraud to slip through. Barclays was fined £42m. Revolut paid €3.5m to Lithuania's central bank for monitoring deficiencies. Coinbase paid €21m to the Central Bank of Ireland for failing its AML/CTF monitoring obligations between 2021 and 2025. Across the Atlantic, OKX paid more than $500m in February 2025. Block Inc. paid $40m in April.

None of these were onboarding failures. Every one of them was about what happened after onboarding — and how long it took the institution to notice.

That is the question this article answers: when periodic reviews stop being enough, and when continuous monitoring stops being a slogan and starts being a control.

What is Periodic KYB?

Periodic KYB is the traditional model. You verify a business at onboarding, then re-verify on a fixed schedule — typically annually for standard-risk customers, every six months or quarterly for higher-risk ones, and every two to five years for the lowest-risk segment.

The cycle is predictable:

1. Collect — registration documents, proof of address, corporate filings.
2. Verify — ownership, directors, beneficial owners.
3. Screen — sanctions, PEP databases, watchlists, adverse media.
4. Score — assign a risk rating.
5. Document — store everything for audit.
6. Wait — until the calendar says otherwise.

The model emerged from early AML regulations focused on the moment of onboarding. For decades, regulators accepted it. Auditors signed off. Whole compliance teams were structured around scheduled cycles.

It still has real advantages. The schedule is predictable, the costs are budgetable, the workload can be staffed, and batch processing works at scale. For a portfolio of low-risk, stable counterparties, periodic KYB is not broken.

The structural flaw is that it assumes nothing changes between reviews. A company you verified in January is not looked at again until the following January. In that window, beneficial owners can change, sanctions lists can update, directors can resign, adverse media can surface, and corporate status can shift. None of it triggers a review. The file sits untouched until the calendar moves it.

That gap is where most of the recent enforcement actions live.

What is Perpetual KYB?

Perpetual KYB — also called pKYB, continuous KYB monitoring, or event-driven KYB — replaces the calendar with the data. Reviews are not scheduled. They are triggered.

The logic:

• Connect — link customer records to live data sources: corporate registries, sanctions lists, adverse media feeds, ownership databases.
• Monitor — watch for material changes continuously.
• Detect — when a change happens (new UBO, director resignation, status change, sanctions hit), surface it.
• Alert — flag the change to the compliance team.
• Review — investigate and act.

There is no annual review date. The data tells you when to act.

The Core Difference, in One Question

Periodic KYB asks: "Is this company still compliant based on our last review?"

Perpetual KYB asks: "Has anything changed since we last looked?"

One is backward-looking. The other is forward-looking. The difference shows up in how fast you catch a problem.

Where Most Teams Get the Implementation Wrong

Here is where the conversation usually goes off the rails. Vendors call their products "perpetual" or "real-time." Compliance teams switch on continuous monitoring expecting cleaner risk signals. Within a quarter, analysts are buried in alerts.

The problem is not perpetual KYB. The problem is how the change is detected.

Polling-based monitoring

Most "real-time" KYB tools use polling. The system queries registries on a schedule — every day, sometimes more — pulls a fresh snapshot of every company in your portfolio, and compares it to yesterday's snapshot. Any difference triggers an alert.

The flaw: registry data does not change in the way these systems assume. Formatting shifts. A field gets reformatted. A timestamp updates. Capitalisation changes when a registry runs a maintenance script. The underlying facts are identical, but the polling system sees a difference and fires.

Five out of seven alerts are noise. Two are real risk signals. That ratio gets worse the bigger the portfolio.

Event-driven detection

Event-driven monitoring works the opposite way. Instead of polling registries on your behalf, the data provider collects registry data continuously into its own infrastructure. When a material change happens at the source — a new shareholder filed, a status updated to "dissolved," an officer resigned — the provider sees it as part of the underlying ingestion. Your portfolio gets an alert because something genuinely changed, not because a string got reformatted.

Strise — one of the more credible operators in the space — reports that most periodic reviews show no material change and that event-driven workflows can cut review workload by up to 90%. That number is consistent with what we see when clients move from polling-based vendors to a registry-collected feed: alert volume drops by an order of magnitude, and the alerts that remain are worth investigating.

Which model fits your portfolio?

"Periodic vs perpetual" is the wrong framing. The right framing is: which mix fits the portfolio you actually run? Two variables decide it — how much regulatory and counterparty risk sits in your book, and how often material attributes change across that book. Plot your portfolio on the matrix below and the answer is usually obvious.

The honest summary: periodic KYB tells you what a company looked like at your last review. Perpetual KYB tells you what changed since then. One is a snapshot. The other is a feed. But the feed is only useful if it surfaces signal — not noise.

The KYB Risk Window: What Actually Happens Between Reviews

Every compliance program has a risk window. It is the time between when something changes and when you find out. With annual reviews, the window can stretch to 12 months. Quarterly reviews shrink it to three. It never closes completely.

Here is what can happen inside that window:

None of these wait for your review calendar.

The standard scenario goes like this. You onboard a supplier in March. Clean verification. Low risk. Next scheduled review: the following March. In September, the majority shareholder sells to a foreign investor with indirect ties to a sanctioned entity. You don't know. Your records still show the original ownership. You keep transacting. Six months later, your annual review catches the change — or, more often, a regulator does.

That six-month gap is your exposure. Multiply it across a portfolio of thousands and the math gets uncomfortable.

What Regulators Actually Expect

The most common question we get from compliance leads is whether perpetual KYB is required by law. The honest answer is: not by name. But the language across major frameworks has shifted hard toward continuous oversight.

The pattern is consistent. Verification at onboarding is not enough. You are expected to maintain a current view throughout the relationship. Periodic reviews still satisfy the letter of the rule for low-risk relationships, but enforcement actions tell a different story.

What Recent Enforcement Actions Actually Say

Below are the enforcement cases worth understanding. Read past the headlines and look at the failure mode.

Look at what these cases share. They are not onboarding failures. They are not even necessarily intent failures. They are monitoring failures: institutions that verified at onboarding and then could not see — or did not act on — what changed afterward. The regulators in 2025 are no longer asking "Did you verify?" They are asking "When did you know?"

How Global Database approaches Perpetual KYB

Most of this article has talked about what perpetual KYB should do. This section is what we actually do — the data path from a registry filing in one country to a same-day update on every customer in your portfolio.

The whole pipeline is built around one principle: your team should never need to ask a registry "anything new?" If something moved, you should already know.

Step 1 — Pulled at source, every day

We connect directly to over 400 official government registries. Daily ingestion. No aggregators in the middle, no scrapers, no resold third-party feeds. Each data point is tagged with the registry it came from and the timestamp it was retrieved.

This is the difference between knowing a director changed and knowing the registry filing is dated 14 March, was published by Companies House, and was retrieved by us at 06:42 UTC the same day. Auditors care about the second version.

Step 2 — Stored on EU-jurisdiction infrastructure

The data sits on Hetzner servers in Germany. GDPR-aligned by default. When your DPO or your auditor asks where the underlying data lives — a question that comes up more often in 2026 than it used to — the answer is short: Frankfurt, with a German data-processing contract.

Step 3 — Mapped, normalised, enriched

A new filing on its own is just a new row. The work happens in the resolution layer: matching that filing to the company already in our graph, reconciling the names and identifiers across jurisdictions, updating the ownership chain, and merging it with the existing record. By the time the data reaches you, the change is already in context — not floating loose.

Step 4 — Filed accounts digitised with OCR + AI

A lot of registry-filed financial accounts arrive as PDFs or scanned documents. They get extracted into structured fields automatically — balance sheet, P&L, cash flow, ratios. In some jurisdictions you get up to 20 years of digitised history. Credit and risk teams use this to track financial trajectory; compliance teams use it to flag anomalies.

Step 5 — Same-day update, unlimited, across your portfolio

This is where the model diverges sharply from periodic KYB. Under a periodic program, you'd schedule lookups against every monitored company on a calendar, paying per call, hoping the timing aligns with reality. With Global Database, every company you monitor automatically receives the update the same day a filing changes any of the following:

The pricing model matters here. With periodic verification you pay per lookup — and most of those lookups return "nothing changed," which is the most expensive answer in compliance. With Global Database's perpetual model, you pay once for the relationship and get unlimited updates across the year. Your cost per actual material finding goes down. Your cost per "we checked, nothing happened" goes to zero.

The Hybrid Reality: Most Mature Programs Don't Pick One

Vendor marketing tends to frame periodic vs. perpetual as a binary. The teams actually getting this right run a hybrid. Different attributes change at different speeds and carry different materiality. Treat them differently.

The right design uses trigger-based monitoring for high-volatility, high-materiality attributes and reserves the periodic review for things that don't move fast — and for the human attestation that the relationship still makes sense at all.

Building a Perpetual KYB Program That Actually Works

Switching is not a software upgrade. The teams who try to bolt continuous monitoring onto a stale data foundation end up with the same problem in faster cycle times. The four pillars that matter:

1. Data quality at source

If the underlying data is stale, aggregated, or scraped, monitoring just amplifies the rot. What to look for: data sourced direct from government registries (not aggregators), updated as registries update, with full ownership chains and standardised formatting across jurisdictions. If your provider can't tell you which registry a specific data point came from and when it was last fetched, your audit trail has a hole in it.

2. Detection method, not just frequency

The honest test: ask your vendor whether they detect changes at the source or compare daily snapshots. If it's the latter, factor in the cost of analyst time spent on noise. A "real-time" tool that fires on formatting changes is not actually real-time — it is just fast and wrong.

3. Configurable materiality

Not every change needs a same-day alert. A robust program lets you set thresholds per change type (alert on UBO change >10%, ignore changes <5%), per jurisdiction (immediate escalation for sanctioned geographies, batch review for stable ones), and per entity type (stricter monitoring for PEP-linked entities). Without configuration, every change gets equal weight, which defeats the entire point.

4. Workflow integration

Detection without action is just timestamped noise. The alert needs to land in your case-management system, update the entity's risk score, generate the audit log entry, and route to the right analyst tier. If your team is copy-pasting alerts into a separate ticketing tool, you've automated detection and re-introduced manual work somewhere else.

Related Reading on Global Database

Frequently Asked Questions