Compliance3 min readUpdated October 15, 2026

What Is Ongoing Monitoring in AML Compliance?

What ongoing monitoring (ongoing due diligence) is: FATF, US and EU rules, review cycles, ongoing sanctions screening, and how acquirers monitor merchants.

Nick Bonnassies, CMO at Tagada · checked against 5 sources

Article summary

TL;DR

Ongoing monitoring is the part of customer due diligence that continues after onboarding. A bank or payment provider checks that each customer's transactions match what it knows about them, keeps their data up to date, and screens them again when sanctions lists change. FATF, US and EU anti-money laundering rules all require it.

FATF Recommendation 10 lists ongoing due diligence as the fourth customer due diligence measure, alongside identifying the customer, the owner and the purpose.
US banks must run risk-based ongoing monitoring to report suspicious transactions and keep customer information current (31 CFR 1020.210).
From July 10, 2027, the EU AML Regulation caps the gap between customer data updates at 1 year for higher-risk customers and 5 years for all others.
Sanctions screening is ongoing because lists change. EU banks and financial institutions must re-check customers upon any new designation.
Acquirers monitor merchants too. Visa requires daily monitoring of high-integrity risk merchants and payment facilitators against their normal daily activity.

Want to go further? Ask

On this page

Onboarding checks tell a bank or payment provider who a customer is on day one. Ongoing monitoring is what keeps that picture true afterward: people change jobs, companies change owners, and sanctions lists grow. Here is what the rules say, and how it applies to an online merchant.

What is ongoing monitoring?

The Financial Action Task Force (FATF) lists it as the fourth customer due diligence measure in Recommendation 10: "Conducting ongoing due diligence on the business relationship and scrutiny of transactions undertaken throughout the course of that relationship", to make sure transactions fit what the institution knows of the customer, their business and risk profile.1 The other three measures, identifying the customer, the owner and the purpose of the relationship, are on our know your customer page.

National law copies this duty:

United States. A bank's AML program must include risk-based procedures for "conducting ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information", including beneficial owner data (31 CFR 1020.210(a)(2)(v)(B)).2
European Union. Directive 2015/849 requires "ongoing monitoring of the business relationship" and keeping documents and data "up-to-date" (Article 13(1)(d)).3 From July 10, 2027, the AML Regulation sets a ceiling on how long data can go unchecked: 1 year for higher-risk customers, 5 years for all others. A change in the customer's circumstances triggers an earlier review (Articles 26 and 90).4

When monitoring turns up activity that cannot be explained, the next step is a suspicious activity report.

Ongoing monitoring vs onboarding checks

	Onboarding checks	Ongoing monitoring
When	Before the relationship starts	For as long as it lasts
Question asked	Who is this customer, and who owns them?	Does their activity still fit what we know?
Data	Identity, owners, purpose	Transactions, data changes, new list entries
Sanctions	Screened once at onboarding	Screened again when lists or customer data change

Sanctions screening is the clearest case. Lists change, so a customer who was clear at onboarding can be designated later. The EU AML Regulation requires banks and financial institutions to re-check customers "upon any new designation" (Article 26(4)).4 How lists are searched and matched is covered on name screening.

What it means for an online merchant

You are monitored too. Your acquirer keeps watching your account after underwriting. For high-integrity risk merchants and payment facilitators, Visa requires the acquirer to build each merchant's "normal daily activity" from at least one month of data (sales volume, average ticket, number of transactions, disputes), start daily monitoring on the 31st day after the first deposit, and review that baseline weekly (Visa Core Rules, April 2026, section 10.4.5.2). Any merchant on an exception report must be investigated within 7 calendar days (section 10.4.1.1).5

In practice, a review usually starts when your activity or your file moves away from what was approved: a sudden jump in volume or ticket size, a rise in disputes, a new product line, or a new owner. Dispute thresholds are explained in chargeback monitoring programs. For the wider picture, see our guide to payment risk management.

How Tagada helps

Every merchant reviewed before going live

Each file is still underwritten, with enhanced review on regulated verticals. Some businesses are refused, such as those using falsified documents, selling counterfeits, circumventing chargebacks, using deceptive trial or subscription marketing, or listed on MATCH. Tagada follows Visa and Mastercard rules and the laws that apply to payments.

Apply for processing

Updated on October 15, 2026

Nick Bonnassies

CMO at Tagada

CMO at Tagada. Before Tagada, Nick built direct-to-consumer brands that generated over $115M in sales, raised over $25M in crowdfunding and sold two of them. He also works as a fractional CMO on marketing operations and AI systems.

Frequently asked questions

What does ODD mean in ongoing monitoring?

ODD stands for ongoing due diligence. It is another name for ongoing monitoring: the checks a regulated business keeps running on a customer after onboarding. FATF uses the phrase in Recommendation 10, while EU and US texts mostly say ongoing monitoring. In fund management, ODD can also mean operational due diligence, which is a different topic.

When must sanctions screening be ongoing, not only at onboarding?

Always, for as long as the relationship lasts, because sanctions lists change and a customer who was clear at onboarding can be designated later. Under the EU AML Regulation, banks and financial institutions must re-check customers upon any new designation, and other obliged entities at a frequency matching their sanctions risk. A change in the customer's owners or data is another trigger to screen again.

What does ongoing monitoring software do?

It automates the routine part. It re-screens customer and owner names whenever watchlists update, compares transactions with each customer's expected profile, flags exceptions, and sends alerts to a reviewer with an audit trail of each decision. The software does not move the legal duty: the regulated business that uses it stays responsible for reviewing alerts and reporting suspicious activity.

Sources

Checked October 15, 2026

TagadaPay

Get underwritten once, process across several providers

Tell us what you sell and how you sell it. Each application is underwritten, and approval is not guaranteed.

Apply for processing See pricing

01Tell us what you sell and how
02Underwriting reviews your business
03Process through TagadaPay alongside your other processors