Enhanced Due Diligence & Perpetual KYC Explained

Every regulated firm runs two related but distinct jobs. The first is building a risk picture of a customer deep enough to onboard them safely. That is enhanced due diligence. The second is keeping that picture current for as long as the relationship lasts, the ambition now branded as perpetual KYC. Both are widely discussed and frequently oversold.

What follows is what enhanced due diligence actually is and what belongs in the file, then how perpetual KYC turns a periodic chore into an event-driven one and where the events that drive it come from. The last section maps the components, so you can see which vendor category owns which job and where an open-web signal layer like cloro fits. cloro is one slice of that stack.

What enhanced due diligence actually is

Enhanced due diligence is the intensified branch of customer due diligence reserved for higher-risk relationships. Thomson Reuters describes it as “a more thorough and rigorous level of background investigation conducted on higher-risk business relationships or transactions.” The key word is higher-risk: enhanced due diligence is not applied to every customer, only to the ones a firm’s risk model flags.

The trigger is risk, not customer type in isolation. According to Sumsub, EDD is “a set of measures applied in situations that indicate a higher risk of money laundering and terrorist financing.” A retail customer in a low-risk band gets standard checks; a politically exposed person routing funds through three jurisdictions gets the enhanced treatment. The depth of the file scales with the risk it is meant to contain.

That distinction matters because it sets the workload. Standard customer due diligence is the floor every regulated firm applies to everyone. It verifies identity, establishes the purpose of the relationship, and monitors on a risk basis. Enhanced due diligence adds evidence and scrutiny on top: more documentation, deeper verification, and closer monitoring. Teams that treat the two as interchangeable end up over-investing on low-risk clients, under-investigating the accounts that carry real exposure, or both.

What triggers enhanced due diligence

A firm escalates to enhanced due diligence when a customer or transaction crosses a risk threshold it has defined in policy. The recurring triggers are consistent across the industry. Politically exposed persons (PEPs) and their close associates carry elevated bribery and corruption risk. So do customers, funds, or counterparties connected to high-risk or sanctioned jurisdictions, meaning countries with weak controls. Opaque ownership counts too: complex or layered structures that obscure the ultimate beneficial owner. Then there is irregular activity, where transaction patterns do not fit the customer’s stated profile, and adverse media, meaning negative news that links the customer to financial crime, fraud, or sanctions evasion.

Most frameworks also add a procedural trigger: higher-risk onboarding often needs senior-management sign-off before the relationship goes live. That approval is only as sound as the evidence in the file beneath it.

None of that is exotic, and identifying the categories is not the hard part of enhanced due diligence. Keeping the evidence behind them current is, which is exactly where perpetual KYC enters.

What an enhanced due diligence file contains

An enhanced due diligence file is a structured dossier, not a single check. Five components recur in every serious framework, and each answers a different question about the customer. Identity verifies that the customer is who they claim, to a higher evidentiary standard than a basic check. Beneficial ownership unwinds the structure to identify the real people who own or control the entity. Source of funds and source of wealth establish where the money in this transaction came from and how the customer built their wealth overall. Adverse media screens news and open-web sources for negative information. And ongoing monitoring is the commitment to watch the relationship rather than clear it once.

The last two are where enhanced due diligence stops being a point-in-time exercise. LSEG Risk Intelligence notes that EDD “requires dynamic monitoring of accounts and transactions to catch emerging risks,” paired with automated adverse-media scans that stay “updated on news related to high-risk customers and entities.” Source of funds establishes the baseline; adverse media and monitoring keep it honest.

Adverse media is worth isolating because it is the component most exposed to the open web. Registry data tells you a structure and sanctions lists tell you a designation, but the first public signal that a customer is under investigation usually surfaces as news. That is why adverse-media screening sits at the seam between the enhanced due diligence file and the continuous-monitoring layer: it is both an onboarding check and a live trigger. For the mechanics of that screening, see cloro’s adverse media screening use case.

Perpetual KYC: from periodic refresh to event-driven monitoring

For decades, keeping the enhanced due diligence file current meant periodic review: re-examine every customer on a fixed cycle (high-risk annually, low-risk every few years) regardless of whether anything had actually changed. The cost of that model is the problem perpetual KYC exists to solve.

A Fenergo study found that more than half of financial institutions spend between 61 and 150 days on a single client KYC review, at an average of $2,200 per review. Much of that effort re-collects information that has not changed since the last cycle. A PwC analysis puts the recurring bill in perspective: KYC costs “can now constitute approximately 3% of a bank’s total operational cost base.”

Perpetual KYC reframes the job. ComplyAdvantage defines it as “the ongoing process of updating and verifying customer information instead of conducting periodical KYC checks,” also known as “event-driven KYC or continuous KYC.” Instead of a calendar deciding when to look, an event does: a change in ownership, a new sanctions listing, an adverse-media hit.

The same PwC analysis estimates that shifting to perpetual KYC can save a medium-sized bank 60–80%, which is roughly USD 14.4 million a year on a corporate customer book and USD 13.2 million on retail.

There is also a regulatory tailwind. The fourth pillar of the FinCEN CDD Rule already requires firms to “conduct ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information.” Perpetual KYC is, in large part, the operational answer to that standing obligation: a way to keep files current continuously rather than in scheduled bursts.

Where the triggers actually come from

Vendor decks tend to skip this part. Perpetual KYC is event-driven, so it is only as good as its ability to detect events. Without detection there is no trigger, and without triggers continuous monitoring quietly degrades into the same periodic review under a faster brand name.

So where do the events come from? Some are internal and structured: a change in beneficial ownership shows up in registry data, a new designation in a sanctions or PEP feed, a suspicious transaction in your own monitoring system. Structured data providers serve those well, and they should be wired in first.

A large share of relevant events never touches a structured feed, at least not first. An executive is named in an investigation, a company is accused of fraud, a counterparty turns out to be linked to a sanctioned network. For all of it the earliest public signal is almost always news and open-web content, days or weeks before it becomes a formal listing. Periodic-review vendors and registry feeds do not cover that layer, and it is the specific slice cloro is built to supply.

The component map: which layer does what

The way to buy for enhanced due diligence and perpetual KYC is to stop looking for one platform that does everything, and instead route each component to the category that actually owns it. KYC screening is a stack rather than a single product, and the layers divide like this.

Component	What it answers	Data source category	Example
Business identity / KYB	Is this a real, registered entity?	Corporate registry and KYB providers	Middesk
Sanctions & PEP screening	Is this party designated or politically exposed?	Watchlist and screening vendors	ComplyAdvantage
Transaction monitoring	Is the money behaving suspiciously?	In-house / transaction-monitoring platforms	(off-scope for cloro)
Adverse media & open-web	Is there emerging negative signal in the news?	Open-web, news, and AI-answer search	cloro

Two things follow from reading the map honestly. First, cloro does not do KYB. It does not maintain sanctions lists, and it does not monitor transactions. Those are different jobs owned by different vendors, and pretending otherwise would be the overclaim this guide is arguing against.

Middesk, which describes itself as “the business infrastructure platform to accelerate formation, onboarding, and growth,” owns the registry layer. Dedicated watchlist vendors own screening. Transaction monitoring is off-scope entirely.

Second, the open-web layer is real, under-served, and where continuous monitoring’s triggers disproportionately originate. That is cloro’s slice. It turns news, SERP, and AI-answer signals into the events that a perpetual KYC system needs to stay current. We would rather own one component of that stack than claim all four and cover the open web thinnest of all.

Building the continuous-monitoring trigger with cloro

The open-web trigger is straightforward to wire yourself. The pattern is a loop: hold a list of the entities you are monitoring, query the open web for new signal on each on a schedule, classify what comes back, and route material hits into the same case-management queue your analysts already work.

# Perpetual KYC open-web trigger — pseudocode
for entity in monitored_entities:                 # your EDD watchlist
    hits = cloro.news.search(                      # cloro News / SERP / AI engines
        query=f'"{entity.name}" (fraud OR sanctions OR investigation OR laundering)',
        since=entity.last_checked,
        market=entity.jurisdiction,
    )
    for hit in hits:
        event = classify(hit)                      # relevance + risk-category tagging
        if event.material:
            open_case(                             # webhook into case management
                entity_id=entity.id,
                trigger="adverse_media",
                source=hit.url,
                risk=event.risk_level,
            )
    entity.last_checked = now()

A few design notes separate this from a demo. Scope the query to real risk language, not the bare entity name, or analysts drown in irrelevant mentions. Diff each run against the last so a case only opens on genuinely new signal. And classify before you escalate: a relevance and risk-category pass is what keeps continuous compliance monitoring from becoming continuous alert fatigue.

Cadence is a design choice too. Run high-risk entities daily and lower-risk ones weekly, and the same loop delivers ongoing monitoring AML teams can defend to an auditor. The output is a dated, sourced trail of every event you reviewed and why. That is the evidence a perpetual KYC programme is expected to keep.

The signal comes from cloro’s news and SERP APIs, which give you scheduled open-web and Google News coverage across markets. The full onboarding-plus-monitoring recipe, including how this feeds an analyst workflow, lives in the adverse media screening use case. If your remit stretches past customers to your own brand and infrastructure, the same open-web loop underpins cloro’s threat intelligence surface.

Enhanced due diligence tells you who you are dealing with, and perpetual KYC promises to notice when that answer changes. That promise only holds if something is watching the open web for the events that periodic reviews and registry feeds miss, which is the one job cloro is built to do.

Wire it in as the trigger layer and let the vendors that own registries, watchlists, and transactions own their slices. Buy by component, hold each vendor to its slice, and the map above becomes a buying checklist rather than a wishlist.