Not a One-Time Exercise
CDD is not completed at onboarding and then forgotten. The MLR 2017 and FATF Recommendation 10 require ongoing monitoring throughout the entire business relationship. This is a continuous obligation — not a periodic box-ticking exercise.
Ongoing monitoring serves two purposes:
- Transaction monitoring: Ensuring that transactions are consistent with the firm's knowledge of the customer, their business profile, and risk profile.
- CDD refresh: Keeping customer information up to date and ensuring that the CDD held remains adequate and relevant.
Transaction Monitoring
Transaction monitoring systems look for patterns and anomalies that may indicate money laundering (ComplyCube):
What is Monitored
Alert Triggers
- Transactions significantly above or below the customer's profile baseline
- Transactions with sanctioned individuals, entities, or jurisdictions
- Multiple transactions just below reporting thresholds (structuring indicator)
- Sudden dormancy followed by high-volume activity
- Payments to or from shell companies or anonymous sources
Profile Updates
Customer profiles must be updated when (iDenfy):
- The customer's circumstances change (new directors, change of address, new business activities)
- The customer's risk rating changes
- Periodic review cycles are reached (low risk: every 3–5 years; medium: every 1–2 years; high: every 6–12 months)
- New products or services are requested
- Adverse media or regulatory alerts are received
Event-Driven Reviews
Certain events should trigger an immediate, out-of-cycle review rather than waiting for the next periodic review (Flagright analysis):
- Law enforcement information or enquiries about the customer
- Adverse media (negative press, criminal allegations)
- SAR filed by the firm or another institution about the customer
- Material change in transaction patterns
- Customer requesting unusual products or services
- Sanctions list updates affecting the customer or their associates
- Change of beneficial ownership or control
- Customer operating in a newly high-risk sector or jurisdiction
Case Study: The Stunt & Co Monitoring Failure
The FCA's Final Notice against Barclays in the Stunt & Co case provides a textbook example of ongoing monitoring failure.
Timeline of Failures
Barclays opened the Stunt & Co account without gathering sufficient information about the business, its expected transaction patterns, or its connections.
Stunt & Co received GBP 46.8 million from Fowler Oldfield — a gold dealer later convicted of money laundering — in just over one year. This volume from a single counterparty should have triggered immediate scrutiny.
Police provided information to Barclays about Fowler Oldfield. Police also raided Fowler Oldfield's premises. Despite these clear red flags, Barclays did not initiate a proper review.
It took Barclays five years from the initial red flags to conduct a proper review of the Stunt & Co relationship.
GBP 39.3 million fine for breaching FCA Principles 2 and 3 — failure to exercise due skill, care, and diligence, and failure to organise affairs with adequate risk management (FCA Press Release).
According to Flagright's analysis: Dynamic risk assessment — immediate reassessment when police made contact. Automated monitoring triggers for single-counterparty volume. Event-driven reviews on law enforcement contact. Clear escalation protocols to senior compliance. Swift action within defined timescales.
Spot the Error: Monitoring Failures
Read each scenario and identify the monitoring failure. You must correctly identify all 3 errors to complete this module.