Why providers refresh client files
A regulated payments provider has a continuing obligation to keep its knowledge of each client up to date. The information gathered at onboarding is a snapshot. Over time, directors resign, ownership changes, passports expire, businesses move into new markets and the volume of payments grows. If the file is not refreshed, the provider ends up monitoring transactions against a picture that no longer reflects reality.
Regulators expect providers to keep client information current, to reassess risk periodically and to make sure that ongoing transactions remain consistent with what they know about the client. Providers that fail to do so face regulatory criticism, and their banking partners ask about it too.
For the client, a review is a chance to correct the provider's understanding. If the business has grown into new markets, the review is the right time to update the expected activity, which reduces the chance of payments being held because they look unusual.
How review cycles typically work
Most providers set review frequency according to risk rating. A common pattern, though every provider sets its own, looks like this:
| Risk rating | Typical review frequency | Typical depth |
|---|---|---|
| Lower risk | Every two to three years | Confirmation of key details, refreshed certificates where needed |
| Medium risk | Every one to two years | Updated corporate documents, confirmation of ownership, review of activity |
| Higher risk | At least annually | Full refresh including source of funds for recent activity, adverse media, senior approval |
Risk ratings reflect factors such as the jurisdictions involved, the complexity of the structure, the industry, whether any politically exposed persons are connected, and the nature and volume of activity. A licensed iGaming operator or a defence supplier, for example, might be reviewed more often than a straightforward holding company, simply because of the sector.
Events that trigger an early review
Alongside scheduled reviews, providers carry out event-driven reviews when something changes. Common triggers include:
- Ownership changes. A new shareholder, a transfer between existing shareholders, a new trust in the chain or a change of trustee.
- Control changes. New directors, new authorised signatories, a new protector, or a power of attorney granted to someone new.
- Document expiry. A passport on file expiring, or a licence reaching its renewal date.
- Activity outside the expected profile. Volumes much higher than expected, payments to new countries, new types of counterparties, or currency pairs not mentioned at onboarding.
- Screening alerts. A new sanctions designation, PEP match or adverse media item linked to someone in the structure.
- Regulatory events. A licence suspended or revoked, or an investigation reported.
- Corporate events. Redomiciliation, merger, change of name, change of registered agent or change of business activity.
- Information from third parties, such as a bank asking questions about a payment.
Event-driven reviews are often narrower than scheduled ones. A change of director may only need the new director's KYC and an updated incumbency certificate. A new beneficial owner, on the other hand, can lead to a broader review including source of wealth.
What is usually requested
A typical scheduled review might ask for some combination of:
- A fresh certificate of good standing and certificate of incumbency. Our guide to incumbency versus good standing explains both.
- Confirmation that the ownership chart is unchanged, or an updated chart.
- Updated identity documents for anyone whose passport has expired or is about to.
- Recent proof of address for individuals, where the provider's policy requires it at review.
- Recent financial statements for the company.
- Confirmation of the business activity and expected volumes for the coming period.
- Updated licences, for regulated businesses.
- Explanations for any notable activity since the last review.
- Re-confirmation of PEP and tax residence declarations.
Lower-risk clients often receive a short questionnaire asking them to confirm that nothing has changed, with documents requested only where something has.
Tell the provider about changes as they happen
The single most effective way to make reviews painless is to tell the provider about material changes when they happen, instead of waiting for the scheduled review. Most account terms require clients to notify changes in ownership, control and business activity promptly, but beyond the contractual point, it is simply easier.
Consider the alternative. A Cayman holding company changes its shareholders and says nothing. Six months later, the provider's annual review requests a fresh incumbency certificate, which shows unfamiliar names. The provider now has to understand the change, verify the new owners, and work out whether any payments in the intervening months were connected. Some providers will restrict the account until this is done. A prompt notification at the time would have led to a short, routine update.
Changes worth notifying straight away include new beneficial owners, new directors or signatories, changes of trustee, new business lines, moves into new markets, new licences and loss of licences. If in doubt, notify.
What to send when ownership changes
Ownership changes are the most significant event-driven reviews, so it helps to know what a provider will typically need. For a transfer of shares to a new beneficial owner, expect a request along these lines:
- The share transfer instrument and the updated register of members.
- A fresh certificate of incumbency reflecting the change.
- An updated, signed and dated ownership chart.
- Full KYC on the new owner: identity, address, PEP declaration and source of wealth.
- An explanation of the transaction: why the shares changed hands, at what price, and how the purchase was funded.
- Where a new holding entity has been inserted, the corporate documents for that entity.
- Updated account mandate and authorised signatory list, if control has also changed.
Sending this as one pack, ideally before or at the time the change completes, typically turns a potentially lengthy review into a short one. If the new owner will use the account in a different way, for example adding new markets or significantly larger volumes, include an updated activity profile as well.
When a screening alert triggers a review
Providers screen their clients continuously against sanctions lists, PEP databases and adverse media. When a new alert appears against someone in the structure, the provider has to assess it. Most alerts turn out to be false positives, typically someone with a similar name, and are closed internally without the client ever knowing.
Where the provider cannot rule out a match from its own information, it will contact the client. The request is usually narrow: a date of birth, a second identity document, or an explanation of a news article. Answering factually and promptly is the best approach. If an article is inaccurate, say so and provide whatever evidence you have. If it is accurate, explain the context and what has happened since.
Genuine sanctions matches are different. A provider cannot continue to act for a designated person, and in that case it must follow the law rather than its usual review process.
How to make reviews painless
- Keep a compliance folder. Hold current versions of all the documents the provider has, with their issue and expiry dates.
- Diarise expiry dates. Passports, licences and certificates expire on known dates. Renewing them before the provider asks avoids last-minute rushes.
- Agree a standing arrangement with your registered agent to issue fresh certificates on request, so you are not waiting in their queue.
- Nominate one person who owns the relationship with the provider's compliance team and knows the structure.
- Keep your activity profile current. If you expect volumes to rise or new currencies to appear, say so before it happens.
- Respond fully the first time. Partial answers generate follow-up questions and extend the review.
- Keep invoices and contracts organised so you can explain any transaction the reviewer selects. See source of funds evidence for what that looks like.
Deadlines and what happens if a review stalls
Providers usually give a reasonable period to respond to a review request, and will often send reminders. If a review cannot be completed because information is not provided, the provider may have to take steps such as restricting new payments, declining new instructions above a certain size, or ultimately ending the relationship. These measures are a consequence of the provider's own regulatory obligations: it cannot keep processing payments for a client whose file it can no longer stand behind.
If you need more time, perhaps because a registry is slow or a beneficial owner is travelling, tell the provider. Most will agree a reasonable extension when they understand the reason and can see progress. Silence is what turns a routine review into a restriction.
An illustrative review
A BVI company owned by a family trust with a Nevis-based trustee has been a medium-risk client for two years. Its scheduled review falls due. In that period, one director has retired and been replaced, the beneficial owner's passport has been renewed, and the company has started paying suppliers in Poland in addition to its existing suppliers in Hong Kong.
Because the client notified the director change at the time, the provider already has the new director's KYC. The review request asks for fresh certificates from the registered agent, a copy of the renewed passport, the latest financial statements and confirmation of the expected activity. The client sends these within a week, with a short note explaining the Polish suppliers and attaching two sample contracts. The review closes with no further questions.
Getting help
This article is general information about how periodic reviews commonly work. It is not legal or regulatory advice, and each provider sets its own review cycle and requirements.
CCYFX reviews client files on a risk-based cycle as part of its obligations under Canadian law. Our compliance page explains our approach, and you can tell us about changes to your structure at any time through the contact page.
