Up until recently, when you wanted to open a bank account, you’d walk into a brick-and-mortar branch, wait your turn, present your ID documents, sign papers, and leave with a temporary check book. That’s a lot of friction for the ability to deposit your hard-earned cash into an account.
Things aren’t all that different today. If there’s one point in a financial relationship in which people put up with almost anything, it’s at onboarding. They’ll scan a passport, hold still for a selfie, retake it because the lighting was bad, wait for review and approval. Money is involved, so friction is accepted.
Banks and financial institutions have built their entire identity verification strategy around that window of goodwill. Place a strong bouncer at the door, then get out of the way. That logic held when the account was the only thing requiring protection. But it’s hardly the target anymore. The session is. The payment is. The device, the credential, the recovery flow. All of it happens after onboarding, long after the verification was filed.
If you think about it, a verified identity is a snapshot with a timestamp on it. It tells you who opened the account. It tells you very little about who is using that account eighteen months later. A lot can happen during this time. Accounts get sold outright. Credentials get phished and resold. Legitimate customers get recruited into mule networks, sometimes without understanding what they’ve agreed to. In each case the identity file is still clean, still evidenced, still perfectly compliant. The document was real. The person was real. The risk changed anyway.
Most institutions conduct periodic review exactly because of that. But periodic review is just onboarding again, on a calendar that has no relationship to risk. It tries the customer’s patience at the exact moment they have none of it to spare, it produces a fresh snapshot that starts decaying immediately, and it leaves months of open ground on either side, or interruption of the business.
Periodic review isn’t negligence, though. It’s what the rules reward. Financial crime compliance is fragmented by design. Every market has its own definitions, thresholds, acceptable documents, and evidentiary standards. For an institution operating across several of them, KYC stops being a risk discipline and becomes an administrative one. Clear the checkpoint, document that you cleared it, move on.
That’s a rational response to the rules as written, and it’s also how identity became something you complete rather than something you maintain. The compliance file is the deliverable, so the file is what gets optimized.
Continuous KYC changes what’s being maintained. Instead of a record you refresh on an ongoing basis, you hold a live view of risk that moves with the customer’s behavior. The compliance artifact still gets produced. It just stops being the point. This is where the case splits in two modes:
Financial organizations are tasked with signal continuity, not additional documents from customers, rather, signals from interactions that are already taking place: device, session, behavioral, transactional. That data exists internally within the organizations. The question is whether that data reaches a system that can read for risk.
This is where things often go awry. Continuous KYC doesn’t mean continuously asking customers for things. It’s an integration decision, not a customer-facing one. The customer experience of continuous monitoring should be frictionless and based on mutual trust.
Join our LinkedIn group Information Security Community!
