When deciding on the frequency of periodic customer due diligence (CDD) refresh, firms should foremost...

AML/CFT frameworks worldwide require firms to apply a risk-based approach (RBA) to customer due diligence. Under FATF standards, the risk profile of the customer is the primary factor that determines how frequently CDD information should be refreshed.

Higher-risk customers—such as politically exposed persons (PEPs), customers operating in high-risk jurisdictions, or those with complex ownership structures—require more frequent reviews and updates to ensure information remains accurate and risks are appropriately mitigated. Lower-risk customers may be subject to less frequent refresh cycles.

Operational burden, cost, or automation capabilities are not valid drivers for determining CDD refresh frequency. Regulators expect firms to design processes that align with risk, even if this requires additional resources or system enhancements.

Therefore, customer risk profile is the foremost and decisive consideration when setting periodic CDD refresh timelines.