When Should CDD Files Be Refreshed?

A CDD file that looked complete at onboarding can become unreliable far sooner than many firms expect. A change in ownership, a shift in transaction behaviour, an expired identification document, or a new sanctions exposure can all turn a once-defensible file into a control gap. That is why the question of when should CDD files be refreshed is not administrative housekeeping – it is central to AML control effectiveness, audit readiness, and sound client risk management.

For regulated firms, refreshing CDD is not about asking for the same documents on a fixed timetable for the sake of process. It is about making sure the client profile, risk rating, source of funds narrative, ownership information, and supporting evidence still reflect the current risk. Regulators expect firms to show that due diligence remains accurate and proportionate over time. If a file no longer matches the client as they operate today, the firm is making decisions on stale information.

When should CDD files be refreshed in practice?

The short answer is that CDD files should be refreshed both periodically and when a trigger event occurs. A risk-based framework needs both. Periodic reviews create discipline and governance. Trigger-based reviews deal with what fixed schedules miss.

A low-risk client may not require the same review frequency as a high-risk one, but no client should be left untouched indefinitely. The appropriate review cycle depends on the nature of the customer, the product or service, delivery channel, geography, ownership complexity, transaction profile, and adverse information exposure. The point is not to apply one rule to every relationship. The point is to ensure review timing is defensible, documented, and aligned to actual risk.

In practical terms, many firms set review cycles based on risk bands. Higher-risk relationships are reviewed more often, sometimes annually or even sooner where enhanced due diligence applies. Standard-risk clients may sit on a longer cycle, while genuinely low-risk relationships may justify less frequent refreshes. But those cycles only work if the firm also responds promptly to material changes as they happen.

The risk-based approach matters more than the calendar

A calendar-led process is easy to administer, but it can create false comfort. A file reviewed twelve months ago may already be outdated if the client has expanded into a sanctioned market, restructured shareholding, changed directors, or begun activity inconsistent with the original profile. Equally, a lower-risk client with stable ownership and predictable activity may not need intrusive re-documentation simply because a date has arrived.

This is where firms often fall into one of two errors. The first is over-refreshing low-value files and exhausting operations teams with repetitive collection work that adds little risk insight. The second is under-refreshing higher-risk files because the client was onboarded properly once and has not caused obvious concern since. Neither approach is efficient, and neither is persuasive under regulatory scrutiny.

A stronger model links refresh decisions to documented risk methodology. If your policy says higher-risk customers require more frequent review, your operations, monitoring, quality assurance, and management information should all support that. If a regulator or auditor asks why one file was refreshed and another was not, the answer should come from your framework, not from individual judgement alone.

Key trigger events that should prompt a CDD refresh

Periodic reviews are only part of the picture. A CDD refresh should also be initiated where there is a material change to the client or the risk associated with them.

Changes in beneficial ownership are one of the clearest triggers. If the natural persons controlling or benefiting from the entity have changed, the original ownership analysis may no longer be valid. The same applies to changes in directors, senior management, legal form, or group structure, particularly where ownership chains become more complex or cross-border.

A change in the nature or purpose of the relationship is another important signal. A client who initially required a straightforward service may later seek higher-value transactions, different products, or access to new jurisdictions. When business activity evolves, the firm needs to revisit whether the original due diligence and risk assessment still support the relationship.

Transaction behaviour should also inform refresh timing. Unusual volumes, altered payment routes, unexpected counterparties, or activity inconsistent with the known customer profile can indicate that the file needs updating. Ongoing monitoring should not sit apart from CDD maintenance. The two are meant to work together.

External developments matter as well. Adverse media, sanctions changes, law enforcement interest, or a revised country risk assessment can all justify a refresh. Even where no misconduct is established, the firm may need updated information to decide whether controls remain adequate or enhanced measures are now required.

Then there is simple document expiry. An expired passport alone may not always mean the entire file is weak, but where identity evidence, proof of address, corporate certificates, or authorisation documents have lapsed, the file should be reviewed in context. Expiry is often the visible sign of a wider issue – no one has looked at the relationship properly for too long.

What a refreshed CDD file should actually achieve

Refreshing a file is not a box-ticking request for newer copies of old documents. A proper refresh should test whether the customer profile remains coherent and whether the firm still understands who it is dealing with, why the relationship exists, and what level of risk it presents.

That may involve confirming identity data, reviewing beneficial ownership, reassessing source of funds and source of wealth where relevant, updating expected activity, and checking whether the client now falls into a different risk category. For corporate or institutional customers, it may also require scrutiny of control structures, operating footprint, licensing status, and material changes in governance.

The depth of refresh should be proportionate. A stable domestic customer with straightforward activity will not need the same level of challenge as a complex entity with layered ownership and high-risk touchpoints. But proportionality should not become an excuse for superficial review. If a file is refreshed, there should be clear evidence of what was reviewed, what changed, what did not, and why the resulting risk position remains acceptable.

Common weaknesses firms should avoid

One common weakness is treating refreshes as administrative chasers rather than risk reviews. Teams request a new utility bill or company extract, upload it, and mark the task complete without revisiting whether the customer still makes sense from an AML perspective. That creates the appearance of maintenance without the substance.

Another weakness is poor trigger governance. Firms may define review cycles in policy but fail to connect them to event-driven monitoring. As a result, account managers, operations teams, and compliance staff each hold fragments of information, but no one converts that information into a formal refresh decision.

There is also the issue of inconsistent escalation. Two clients with similar changes may be handled differently depending on who owns the relationship. That inconsistency becomes difficult to defend during internal audit, independent review, or regulatory inspection.

A final weakness is allowing backlogs to build. Once overdue refreshes accumulate, the exercise becomes a remediation project rather than a controlled BAU process. That raises the risk of weak files remaining active while the firm struggles to prioritise.

Building a defensible refresh framework

A defensible approach starts with clear policy rules, but it should not end there. Firms need documented review frequencies by risk category, defined trigger events, ownership for decision-making, and escalation paths where refreshed information changes the risk outcome.

Operationally, this means making sure onboarding, monitoring, screening, and periodic review processes inform one another. If adverse media alerts, ownership changes, or unusual transaction patterns do not feed into refresh workflows, the framework will miss material developments. Management information is also essential. Senior stakeholders should be able to see upcoming reviews, overdue cases, trigger-based refreshes, and quality trends.

Quality assurance has a role here too. Reviewing whether refreshes are substantive rather than mechanical helps prevent drift into form-over-function compliance. For many regulated businesses, this is where external support adds value – not because the principle is complicated, but because consistency, challenge, and implementation discipline are hard to maintain under operational pressure.

For firms asking when should CDD files be refreshed, the right answer is rarely a single timeframe. They should be refreshed at intervals justified by risk and whenever events indicate the existing file may no longer be reliable. That is the standard that protects decisions, supports audit defensibility, and reduces the chance that outdated information quietly becomes tomorrow’s regulatory issue.

The strongest CDD frameworks do not wait for a file to look old before acting. They treat refresh as part of active risk ownership, which is exactly where sound compliance should sit.