Keep your AML/CFT system alive with effective ongoing due diligence: customer monitoring, periodic KYC updates, transaction monitoring, alert detection and evidence documentation, so you comply with Law 10/2010 and are ready for SEPBLAC.
“We review and update customer information according to each customer’s risk level: documents, beneficial owner, PEPs, sanctions and source of funds. Always up to date, always backed by evidence.”
“We design risk-based monitoring rules: thresholds, unusual patterns, automatic alerts, investigation and a documented close-out for every case.”
“Continuous monitoring against international sanctions lists, PEP lists and adverse media. If a customer’s situation changes, we detect it and act.”
“Every review, every alert and every decision is documented with the date, the person responsible and the criteria applied. Evidence ready for audits, the external expert and SEPBLAC.”
Scheduled review of customer information based on risk level: identity documents, beneficial owner, business activity, source of funds and transaction profile.
Design of monitoring rules: thresholds, unusual patterns, frequency, amounts, countries of origin/destination and consistency with the customer’s declared profile.
Continuous monitoring against international sanctions lists, politically exposed persons and adverse media, with automatic alerts when anything changes.
Internal investigation protocol: alert intake, analysis, escalation, decision (close the alert, apply EDD or file a report) and documented close-out with evidence.
Enhanced measures when the risk requires them: extended investigation, source of funds and source of wealth, senior management approval and closer monitoring.
A record of every ongoing due diligence action: reviews, alerts, decisions, escalations and outcomes, with the date, the person responsible and the criteria applied.
Legal obligation: Law 10/2010 and Royal Decree 304/2014 require obliged entities to apply ongoing monitoring throughout the business relationship, not just at the start.
Changing risk profile: a low-risk customer can become high-risk if its business activity, beneficial owners, transaction patterns or exposure to sensitive jurisdictions change.
Common inspection finding: a lack of ongoing due diligence is one of the failings most often flagged by SEPBLAC in its inspections and in external expert reports.
Serious penalties: failure to meet ongoing monitoring obligations can lead to penalties for serious or very serious infringements under Law 10/2010 (Arts. 51–56).
Reputational and operational risk: failing to detect suspicious transactions because of poor monitoring exposes the company to criminal consequences, blocked bank accounts and loss of trust.
Ongoing due diligence (also called ongoing monitoring) is the obligation of obliged entities to keep their customer information up to date and to monitor customer transactions for the entire duration of the business relationship, not only at onboarding.
It rests on the principle that a customer’s risk profile is not static: it can change because of changes in the customer’s business activity, corporate structure, beneficial owners or transaction patterns, or in its exposure to jurisdictions, sanctions or adverse news.
Ongoing due diligence is not an extra: it is a core obligation under Law 10/2010 (Art. 6), and failure to comply is one of the most frequent findings in SEPBLAC inspections.
All obliged entities under Law 10/2010: financial institutions, payment institutions, investment firms, insurers, real estate businesses, legal and accounting professionals, casinos, jewelers, dealers in high-value goods, crypto-asset service providers (VASPs/CASPs) and other businesses within the scope of the law.
The obligation covers all existing business relationships, not just new customers. This includes legacy customers whose information may be out of date.
If your company is an obliged entity and has active customers, ongoing due diligence applies to all of them, with an intensity that matches each customer’s risk level.
Ongoing due diligence has three main components: updating customer information (periodic KYC), transaction monitoring (checking that the customer’s actual activity matches the declared profile) and ongoing screening (continuous checks against sanctions lists, PEP lists and adverse media).
It also includes alert management (investigation, escalation and documented close-out), the application of enhanced measures (EDD) when an increase in risk is detected, and the documentation of every action with the date, the person responsible, the criteria and the outcome.
What separates an effective ongoing due diligence system from a paper one is execution: reviews are actually carried out, alerts are investigated and everything is backed by evidence.
How often KYC is updated must be proportionate to the customer’s risk level, in line with the risk-based approach (RBA) required by AML/CFT rules.
The key is not just to set the review frequency but to carry out the reviews and document the results. A KYC calendar that is not executed is a breach.
Transaction monitoring means checking on an ongoing basis that the customer’s actual activity is consistent with its declared profile: type of transactions, amounts, frequency, counterparties, countries of origin/destination and payment methods.
An alert that is not investigated is worse than having no alerts: it shows that the system detected something and the company did nothing.
When ongoing due diligence detects an increase in a customer’s risk level (new alerts, a change of beneficial owners, links to PEPs, activity inconsistent with the profile), enhanced due diligence (EDD) measures are triggered.
EDD may include requesting additional information on source of funds and source of wealth, senior management approval of the relationship, closer transaction monitoring and, in extreme cases, a decision to end the business relationship.
EDD is not optional when risk signals are detected: it is a legal obligation, and failing to apply it is treated as a failure of due diligence.
Failure to meet ongoing monitoring obligations can lead to penalties for serious or very serious infringements under Law 10/2010 (Arts. 51–56): fines of up to 10% of turnover, public reprimand, suspension of activity or revocation of authorizations.
Beyond penalties, a lack of ongoing due diligence exposes the company to criminal liability for negligent money laundering (Article 301(3) of the Spanish Criminal Code), blocked bank accounts, loss of correspondent banking relationships and irreversible reputational damage.
Ongoing due diligence is not a cost: it is the safeguard that prevents consequences far more serious than the cost of putting it in place.
Ongoing due diligence is part of a complete AML/CFT system. Discover the services that complement the monitoring and follow-up of your customers.
A mandatory document that sets out ongoing due diligence procedures, roles, workflows and decision criteria.
Full catalog: risk assessment, manual, training, audits, external expert report and ongoing monitoring.
Analysis and documentation of the flow of funds and transactions to support ongoing due diligence investigations.
Proof of the lawful source of funds for significant transactions: verifiable documentation and traceability.
Ongoing due diligence for crypto service providers: KYC/KYB, KYT, Travel Rule and on-chain monitoring.
Review of the AML system of exchanges and platforms: effectiveness of monitoring, alerts, KYC and remediation plan.
Travel Rule compliance: required data in transfers, validations and traceability as part of ongoing monitoring.
Tax information return on cryptocurrencies held abroad: reporting obligations linked to AML/CFT monitoring.
Tick the statements that apply to your company. The more you leave unticked, the bigger the gap in your ongoing due diligence.
0 of 10 controls
Tick the controls you already have in place.
Everything you need to know about ongoing due diligence in AML/CFT: legal framework, components, frequency, link with the risk-based approach, specific sectors and mistakes to avoid.
Ongoing due diligence is the set of measures that obliged entities must apply to keep customer information up to date and to monitor customer transactions throughout the business relationship. It is governed by Article 6 of Law 10/2010 and developed in Articles 26 et seq. of Royal Decree 304/2014.
It is not a one-off check or a task you do once: it is a continuous process that combines periodic review of customer information (KYC), transaction monitoring, continuous screening against sanctions and PEP lists, and documented management of alerts and incidents. Its goal is to detect changes in the customer’s risk profile and act on them before a breach occurs.
Article 6 of Law 10/2010 requires obliged entities to apply ongoing monitoring to the business relationship, including scrutiny of the transactions carried out and updating of the documents, data and information obtained when applying due diligence measures.
Royal Decree 304/2014 (Arts. 26–28) develops these obligations: information must be updated at intervals proportionate to risk, transactions must be monitored to detect inconsistencies with the customer’s profile, and the obliged entity must be able to show that monitoring is actually carried out. SEPBLAC guidance and the FATF Recommendations reinforce that ongoing due diligence must be proportionate, risk-based and documented.
The first component is periodic KYC updates: reviewing and updating the customer’s identity documents, beneficial owner, business activity, source of funds and transaction profile at a frequency proportionate to the customer’s risk level.
The second component is transaction monitoring: setting rules, thresholds and patterns to detect transactions that are unusual or inconsistent with the customer’s declared profile. The third component is ongoing screening: continuous checks against sanctions lists, PEP lists and adverse media.
The fourth component is alert management: an internal investigation protocol (intake, analysis, decision, escalation, close-out) with each step documented. The fifth is the application of enhanced measures (EDD) when the risk requires them: source of funds and source of wealth, senior management approval, closer monitoring or ending the relationship.
Ongoing due diligence must be applied with intensity proportionate to risk. Not every customer needs the same review frequency or the same level of monitoring. The risk-based approach (RBA) lets you allocate resources efficiently: more intensity for higher-risk customers, less frequent reviews for lower-risk ones.
The factors that determine the risk level include the type of customer (individual, legal entity, complex structure), the product or service contracted, the distribution channel, the jurisdiction (of the customer and its counterparties), the business activity and the transaction history. These factors must be assessed together and documented in the customer’s risk rating.
An ongoing due diligence system that treats all customers the same does not meet the RBA: it either wastes resources on low-risk customers or, much worse, pays too little attention to high-risk ones.
In the financial sector, ongoing due diligence includes automated transaction monitoring, real-time screening and KYT (Know Your Transaction) alert management, with rules calibrated by product type and channel.
In the crypto sector, it adds on-chain monitoring (KYT/blockchain analytics), verification of counterparties in transfers (Travel Rule) and screening of addresses and wallets against risk databases. In the real estate sector, ongoing due diligence focuses on updating the profile of buyers and investors, verifying the source of funds in successive transactions and monitoring significant tenants.
In every sector, the key is the same: a system that is executed, that is documented and that lets the obliged entity show supervisors it has maintained due diligence throughout the business relationship.
The most common mistake is carrying out due diligence only at onboarding and never following up: many obliged entities invest in robust KYC at onboarding but do not review customer information for years. For SEPBLAC, this is the same as having no ongoing due diligence.
Another common mistake is using generic monitoring rules that are not tailored to the type of customer, product or channel. A system with identical thresholds and patterns for all customers does not meet the risk-based approach and produces too many false positives (which overwhelm the team) or false negatives (which let suspicious transactions through).
It is also critical to avoid leaving alert decisions undocumented: closing an alert without recording who analyzed it, what information they reviewed, what criteria they applied and why they decided to close it. In an inspection, missing documentation turns a reasonable decision into a compliance finding. Ongoing due diligence is not just monitoring: it is being able to prove that you monitored, analyzed and acted on sound criteria.
Key legislation, linked to the official text:
Legislation and links reviewed in .