Ongoing monitoring: periodic client reviews based on risk level

Every client is screened when the business relationship begins. That check is only a snapshot, however: it shows that on that date the client was not on a sanctions list, was not a politically exposed person (PEP) and did not appear in negative media. None of these findings holds for long. Sanctions lists change constantly, a client may take up public office years after onboarding, and new press coverage can appear at any time.

That is why anti-money laundering and counter-terrorist financing (AML/CTF) rules require ongoing monitoring of the business relationship, not a single check at onboarding. In the European Union, Article 13 of Directive (EU) 2015/849 lists it among the customer due diligence measures, to be applied on a risk-sensitive basis. Whether you work in Luxembourg, Switzerland or another EU country, your compliance officer must be able to show that clients are reviewed regularly, at a frequency proportionate to their risk.

Carrying out these reviews by hand, client by client, quickly becomes unmanageable. In Smart Oversight, ongoing monitoring is a matter of configuration: you decide once how often each category of client is reviewed, and the platform then runs the screenings itself, every night.

A frequency set by source and by risk level

The configuration is done in the Smart Oversight app, on the Screening settings page, under Monitoring settings. Automation is switched on for the whole workspace, and every change is saved as soon as it is made. The right frequency is the one your own risk assessment justifies, and your compliance officer sets it.

The configuration has two parts, one for natural persons and one for legal persons. For each of them, you set either a single row that applies to every risk level, or a separate row for each level: high, medium, low and undefined. Each row gives its own frequency to the three sources Smart Oversight screens against, namely sanctions lists, PEP lists and web screening, which searches the internet for negative media. The frequency ranges from daily to yearly, weekly at most for web screening, and any source can be switched off.

A scope that follows each client’s status

Automation covers every active client whose status calls for monitoring. Rejected and archived clients are left out, as are clients under the Self-Monitored status and records filed as a contract or an insurance policy, although manual screening remains available for all of them. The Automation coverage section of the same page shows which statuses are covered, so the scope is never a matter of guesswork.

Clients whose risk level rules out any business relationship are not screened automatically either, since there is nothing left to monitor. The scope is reassessed on every run: when a client changes status or risk level, the matching frequency applies from the following night.

Screenings started automatically every night

Every night, Smart Oversight goes through the workspaces where automation is on and starts the screenings that have fallen due. A source is due once its period has elapsed since the client’s last screening against it, whether that screening was automatic or started by hand. A client screened manually last week is therefore not screened again before the next due date.

The sources due for a client are grouped into a single screening, which runs exactly like a manual one, against the same sanctions lists and PEP lists. A match that has already given rise to an alert does not open a new one, so the same match is never reviewed twice.

Your IT team has nothing to schedule. Integrators who prefer to drive the schedule from their CRM can still start screenings themselves with POST /v2/screenings, at the intervals of their choice.

Alerts sent straight to your CRM

When a screening finds a match, an alert opens in the app and your team reviews it in the usual way. If your CRM is connected to the Smart Oversight API, it is informed at the same moment, even though nobody on your side started the screening.

Alert and screening events cover the whole workspace, automatic screenings included. To receive them, your server registers an endpoint, the HTTPS address the notifications are sent to, and subscribes it to the events it needs:

POST /v2/webhook_endpoints
Authorization: Bearer <your API key>
Content-Type: application/json

{
  "url": "https://crm.example.com/webhooks/smart-oversight",
  "enabled_events": ["alert.created", "alert.resolved", "screening.failed"]
}

The alert.created event is sent for every new alert. Its data field holds the alert as GET /v2/alerts/{id} returns it: the client concerned in client, by its Smart Oversight identifier (cli_…), the source in media (SANCTIONS_LIST, PEP_LIST or INTERNET_SCREENING) and, for a sanctions or PEP match, the details of the matched entity in match. Your CRM can open a task on the file without any further call.

The screening.failed event means that an automatic screening could not finish and the file needs attention. Once the alert is closed, in the app or with POST /v2/alerts/{id}/review, the alert.resolved event informs every connected system.

Clients created through the API follow the same rules. Their kind, their risk level (risk) and their status (management_mode), sent at creation, decide which frequency applies, and a client created with risk set to FORBIDDEN is never screened automatically.

Signatures, retries and the event history are covered in Webhooks for screenings and alerts, and decisions made through the API in Decisions made through the API carry a name.

An audit trail ready to show

During an inspection, the auditor will focus on two questions: were clients actually reviewed again, and what was done with the results?

The Screening history page answers the first. It shows each client’s last screening and lists every screening carried out over the period you select. The answer to the second lies in each alert’s status history, which records the decision, the comment and the name of the team member who made it, whether in the app or through the API.

Going further

If you already use Smart Oversight, open Screening settings and switch on automation together with your compliance officer. To connect your CRM, read Connect your KYC & AML screening to your CRM. The integrations page lists what the Smart Oversight API covers today.