Periodic review drift: when risk ratings stop matching the file
Why AML periodic reviews look complete while customer risk stories quietly age out of date.
Many programmes tick periodic reviews as done when identity documents are refreshed. The money-laundering story — occupation, transaction purpose, expected corridors — sits untouched for years.
What auditors test
We compare the narrative on the latest review form with the original onboarding rationale and with recent transaction patterns. Drift appears when a customer’s remittance corridors changed after a business expansion the file never recorded.
Operational cause
Review checklists often prioritise document expiry dates because those are easy to systemise. Narrative fields stay free text and get copied forward. Training that only covers ID expiry will reproduce the pattern.
A modest fix
Require one fresh sentence on expected activity at every high-risk review, even when documents have not expired. It is a small writing burden and a large improvement in auditability.