The hidden risks sitting quietly in your customer base.

Most firms spend their time looking for new financial crime risks. Fewer stop to ask whether yesterday's customers still represent today's risks. That question matters even more as the EU framework puts renewed attention on ongoing monitoring, keeping customer information current and understanding activity across the life of the relationship.

Beneficial owners change. Business models pivot. Jurisdictions shift risk profile. New typologies emerge. Any established customer book accumulates that history: customers onboarded years ago, files built under older methodologies, relationships inherited through a portfolio purchase, dormant accounts nobody has had a reason to look at.

Age is not the risk. Staleness is. A customer onboarded ten years ago may be perfectly well understood today if the relationship has been monitored and refreshed properly. A customer onboarded two years ago may already be stale if the business, ownership or activity has changed and nobody noticed.

So the question is not how old the file is. It is whether the firm's current understanding of the customer is still reliable. The control problem starts when firms treat onboarding as permanent and ongoing monitoring as administration.

This is where many organisations become uncomfortable. Looking backwards rarely feels urgent, until it becomes unavoidable.

Low activity does not automatically remove a relationship from the firm's financial-crime risk universe. If the relationship remains open, its treatment should still be explainable within the firm's risk-based framework. That is not the same as treating every dormant account as high risk. It rarely is.

The consequences of weak ongoing monitoring are visible repeatedly in European enforcement and supervisory work. Two cases are worth reading for what they say about existing customer populations rather than about onboarding.

In practical work, hidden exposure tends to cluster in a small number of recognisable places. These are not rules, and none of them automatically requires the same response. The response stays risk-based. But reading an existing book against these categories is usually more informative than a general review of file quality.

In mature books, I have repeatedly seen the population requiring substantive review increase once the scope and data are properly tested. That does not necessarily mean the first line was optimistic. Often the firm was being asked to estimate something it had never measured properly. The impact then combines the cost of the review work itself, any supervisory response, any restrictions on new customer acceptance while the book is cleared, and the disruption to relationships with customers who have been on the books for years and are suddenly being re-documented.

A remediation programme is easy to misread as an administrative exercise to refresh documents. A good one should do more than that. It should tell management what the historic population says about today's control environment.

That does not mean judging every historic decision as though today's standard existed at the time. There are two different questions: was the original decision defensible when it was made, and is the relationship still sufficiently understood and controlled today?

Both questions are worth asking, and they do not always have the same answer. Sometimes historic decisions hold up well. Sometimes they do not.

What the patterns show matters more than any single file. Inconsistent application of methodology, unexplained differences in judgement, risk assessments that moved without explanation, gaps in ongoing governance. Those are not merely file-quality issues. They can point to wider operational and governance weaknesses that the Board should understand.

The review should be designed against both the population and the risk. Higher-risk and older cohorts may deserve greater weight, but the sample should also be capable of showing whether the issue extends beyond the obvious high-risk segment. If you only look where you already expect to find problems, you learn very little about the rest of the book.

A proportionate, risk-based review of older customer populations can give management a clearer view of whether the older book still sits comfortably within the firm's current risk framework. The objective is not to revisit every decision ever made. It is to establish where the greatest exposures sit today, and whether the firm can explain them.

The new EU framework does not make the legacy book a separate category of risk. Ongoing monitoring is about maintaining a current understanding of the relationship over time. Under Regulation (EU) 2024/1624 that includes keeping customer information current, monitoring activity during the relationship, and reassessing where relevant risk factors or circumstances change. AMLA's current work on ongoing monitoring of business relationships is developing the technical detail. That detail is not binding yet, and it would be wrong to treat it as though it were, but the direction is clear enough to act on.

That makes the question straightforward: how much of the existing book can the firm still explain with confidence?

I prefer to start with the data before opening files. Compare what the firm understood about the customer with what the relationship looks like now, across the population where the data allows it or through a deliberate stratified analysis where it does not. That tells you where the file work should go.

From there, the programme can be risk-tiered, the QA approach built around the real failure modes, and the Board reporting reduced to what governance actually needs to understand. Where QA is finding material defects, the programme may be producing volume without producing reliable remediation, and that is worth knowing early rather than at the end.

The age of a customer file is not the issue. The issue is whether the firm's understanding of that customer is still current. A mature book needs more than periodic refresh. It needs a risk-based way of noticing when the customer, ownership, activity or exposure has moved far enough that the original CDD judgement needs to be made again.

If you cannot explain which parts of the existing book you trust, which parts you have tested and which parts still worry you, that population is already a governance question.