The periodic customer review plays a central role in anti-money laundering measures. Through it, the institution performs a comprehensive retrospective assessment of the development of its relationship with the customer and evaluates whether the existing risk assessment continues to reflect the actual situation. For this reason, the periodic review is more than an administrative procedure – it is a strategic AML control.

The Place of the Periodic Review within the AML Framework

A clear distinction must be made between initial customer due diligence, ongoing monitoring, and the periodic review.

• Initial Customer Due Diligence (CDD) aims to establish the customer’s identity, ownership and control structure, the purpose of the business relationship, and the source of funds at the time the relationship is established.
• Ongoing monitoring, in turn, is a continuous process in which transactions and customer behaviour are analysed in order to assess whether they are consistent with the customer’s profile.
• The periodic review is a key structured assessment based on the results of ongoing monitoring and serves to support a reasoned decision regarding the customer’s current risk profile. It is at this stage that it becomes clear whether the risk remains unchanged or requires mitigation measures, which explains why periodic reviews are a key focus of supervisory inspections.

Regulatory Framework

The regulatory framework governing ongoing monitoring and periodic customer reviews is built on the interaction between the Bulgarian Anti-Money Laundering Act (ZMIП) and the European AML Regulation (AMLR).

ZMIП introduces a risk-based approach and provides obliged entities with flexibility to design their own implementation models, tailored to the nature of their activities. This flexibility, however, is accompanied by a high level of responsibility and the need to justify each decision.

The AML Regulation, as a directly applicable legal act, introduces minimum mandatory standards that limit excessive differences in practices between Member States. The two regimes do not contradict each other but complement one another: ZMIП defines the philosophy and logic of the risk-based approach, while the European Regulation sets measurable compliance frameworks and thresholds.

Ongoing Monitoring as the Basis for the Periodic Review

Ongoing monitoring (pursuant to Article 10(5) of ZMIП) forms the foundation of the periodic review. Ongoing monitoring entails the systematic analysis of transactions, tracking customer behaviour, and continuous verification of consistency between the declared activity, the transactions actually carried out, and their economic rationale.

Without effective ongoing monitoring, the periodic review becomes a mere formality, as it lacks real insight into customer behaviour. Information collected through monitoring also serves as a basis for triggering an ad hoc review when certain indicators are identified. The periodic review consolidates accumulated observations, analyses them, and leads to a reasoned conclusion.

Risk-Based Approach

Pursuant to Article 16(2) of ZMIП, update intervals are determined according to the identified risk and are regulated in the internal rules.

The customer’s risk profile determines the frequency, scope, and depth of the review. This means that customers are not reviewed in the same way or at identical intervals. Higher-risk customers require a more in-depth examination of the source of funds, the economic rationale of transactions, relationships with counterparties, and potential geographic risks. For lower-risk customers, the review may be more limited in scope, but must still provide sufficient assurance that the profile remains up to date.

What the Periodic Review Includes

This obligation arises directly from Article 16 of ZMIП, which requires customer information to be kept up to date through periodic review and risk-based updating. The review should include updating identification data, analysing the activity and purpose of the relationship, reviewing transactions for the relevant period, assessing potential changes in the risk profile, and producing a clear documented conclusion. This conclusion is the key outcome of the review – the institution’s reasoned position regarding the customer’s current risk.

Stage 1: File Preparation

The periodic review begins with the preparation of the customer file, during which the officer analyses all relevant information about the customer. This includes the current risk profile, conclusions from the previous review, data from ongoing monitoring systems, existing alerts or warnings, as well as external information from registers, public sources, and potential adverse media. The objective of this stage is to ensure a complete and up-to-date information base for the analysis.

Stage 2: Comparative Analysis

At this stage, information from the establishment of the business relationship is compared with the current situation. The following aspects are assessed:

• the customer’s activity and whether there is an economic rationale between the activity and observed cash flows;
• the volumes and characteristics of transactions – transaction frequency, typicality, counterparty relationships, and the emergence of complex or unusual schemes or high transaction volumes;
• geographic scope and counterparty profiles, including exposure to high-risk countries or sectors;
• structural changes, such as sudden changes in ownership or control;
• whether the purpose and nature of the business relationship remain consistent with what was initially declared, including whether new products, services, tools, or channels are being used;
• the existence of new external information, such as adverse media, sanctions, or other restrictive regimes, as well as internal alerts or prior escalations.

The aim is to determine whether the customer’s behaviour continues to align with the originally expected model or whether deviations are present. It is necessary to assess whether new risk factors, behavioural deviations, structural changes in ownership or management, or unusual transactions without clear economic rationale have emerged. The collected information should be assessed holistically, seeking interconnections rather than isolated evaluation of individual events.

Stage 3: Conclusion

Based on the analysis, a clear conclusion is formulated, representing the core outcome of the periodic review. It is stated whether the risk remains unchanged, increases, or decreases, with the decision supported by specific factors and arguments. This section demonstrates the institution’s reasoning and serves as a basis for subsequent actions.

Stage 4: Escalation

Where the review results require it, the process proceeds to escalation. This may include requesting additional documents and information from the customer, applying enhanced monitoring, involving senior management for review and approval, and assessing whether to submit a suspicious transaction report. In this way, the periodic review becomes a mechanism for real risk management rather than a purely analytical exercise.

Where, as a result of the review, the requirements for customer due diligence cannot be met or the customer fails to provide the necessary information, Article 17 of ZMIП applies, providing for refusal or termination of the business relationship.

Example

During a periodic review of a commercial entity classified as standard risk, it is identified that transaction volumes have increased significantly compared to what was initially declared, counterparties from higher-risk jurisdictions have appeared, and part of the payments lack a clear economic justification. In addition, updated information on the beneficial owner is missing. As a result, the customer profile no longer corresponds to the initial assessment, the risk is reclassified as higher, and enhanced measures are applied.

Practical Application of Automation in the Periodic Review

In practice, automation supports the periodic review through specific mechanisms that reduce subjectivity and manual effort and direct analysis toward customers with genuine risk.

1. Automated Identification of Customers for Review

Instead of reviewing all customers on a purely calendar basis, systems can automatically flag customers for periodic or ad hoc review upon the occurrence of predefined events.

Examples:
– a standard-risk customer whose transaction volumes have increased above a predefined threshold over the last six months;
– a customer who begins transacting with new countries or counterparties not included in the original profile;
– a customer with accumulated behavioural deviations without a submitted suspicious transaction report.

2. Pre-Aggregation of Review Information

Automated systems can generate a consolidated client overview that brings together key elements for analysis.

Examples:
– initial risk profile and most recent assessment;
– main products and services used by the customer;
– aggregated data on volumes, frequency, and transaction types for the review period;
– a list of generated alerts, warnings, or internal escalations.

This allows the reviewer to begin with a holistic picture rather than fragmented information across multiple systems.

3. Support for Comparative Analysis

Automation facilitates comparison between the initially declared profile and current customer behaviour.

Examples:
– initially declared activity: local trading; current behaviour: regular cross-border payments with counterparties from various jurisdictions;
– initially low volumes versus a current significant increase without a clear business explanation;
– initially limited product use versus current use of additional channels or services not included in the original assessment.

The system visualises these differences, while the assessment of whether they are justified remains the responsibility of the officer.

4. Decision-Making and Escalation Support

Based on predefined rules, automation can assist in determining whether escalation is required.

Examples:
– where increased volumes, new geographic risks, and missing updated beneficial ownership information are present simultaneously, the system may require enhanced measures or senior management approval;
– where repeated deviations without economic rationale occur, additional source-of-funds information may be requested or the case may be directed for potential reporting.

5. Improved Documentation and Defensibility

Automation ensures traceability throughout the process – from the trigger for initiating the review, through the data analysed, to the final conclusion and follow-up actions.

Examples:
– clear documentation of why an ad hoc review was initiated;
– which indicators were triggered;
– what data were analysed and what decision was taken.

This enables the institution, during a supervisory inspection, to demonstrate the logic behind its decisions rather than only the final outcome.

In this sense, automation does not replace expert judgment but creates a framework in which the periodic review is performed systematically, consistently, and with a focus on real risks.

When a More In-Depth Review and Analysis Is Required

When risk increases or suspicions arise, Article 17 of ZMIП outlines the context in which a standard review may prove insufficient and enhanced measures may be required. Changes in profile, unusual behaviour, adverse external information, or indications of money laundering or terrorist financing signal the need for deeper analysis.

At this stage, it is particularly important to apply critical thinking – not assessing individual facts in isolation, but seeking the overall picture and meaningful connections between customer behaviour, transactions, and available information.

A more in-depth periodic review is characterised by requests for additional data and evidence, more careful assessment, frequent involvement of senior management, and particularly precise documentation of the decision taken. For higher-risk customers or where there is a significant change in profile, the outcome of the periodic review should also be subject to review and approval at management level, ensuring control over high-risk decisions.

Timeframes for Periodic Review

With regard to timeframes, ZMIП does not introduce fixed intervals, but requires information to be kept up to date and reviewed at appropriate intervals defined in the organisation’s internal rules in line with risk.

In practice and in the expected regulatory technical standards, the following indicative maximum intervals for a full periodic review are applied, based on risk level:
– up to five years for low-risk customers;
– up to three years for standard-risk customers;
– up to one year for high-risk customers.

These timeframes act as upper limits; internal rules may require more frequent reviews. Regardless of these intervals, an ad hoc review remains possible and necessary whenever suspicions arise. Predefined timeframes do not remove the obligation for continuous monitoring and immediate response to changes in risk.

Ad Hoc Periodic Review

An ad hoc periodic review is triggered by a significant change in circumstances, identified inconsistencies, or signals from monitoring systems. It is conducted independently of the scheduled review cycle and documented as a separate process. In this way, the organisation, through its staff and established processes, demonstrates the ability to respond to risk changes in a timely manner rather than relying solely on predefined review cycles.

Documentation of the Periodic Review

The quality of documentation is of critical importance, as supervisory authorities assess whether decisions are logical, consistent, and traceable.

The key question the institution must be able to answer at any time is why, at a given moment, a particular customer continues to be classified within a specific risk profile. If this question cannot be answered clearly, with reasoned and documented support, the periodic review has not fulfilled its function in practice.

The quality of documentation is of critical importance, as supervisory authorities assess whether decisions are logical, consistent, and traceable.

The key question the institution must be able to answer at any time is why, at a given moment, a particular customer continues to be classified within a specific risk profile. If this question cannot be answered clearly, with reasoned and documented support, the periodic review has not fulfilled its function in practice.

Common Weaknesses in Practice

Common weaknesses observed in practice include:

• formal reviews without substantive analysis, where the review exists “on paper” but does not lead to real actions or reassessment;
• review intervals defined without reference to risk;
• lack of integration between monitoring and review processes;
• maintaining an outdated risk profile without reassessing whether changes in activity, volumes, or behaviour require reclassification;
• assessing individual signals, transactions, or external data in isolation rather than connecting them into a coherent overall picture – a key mistake is treating the periodic review as an isolated event rather than part of a continuous cycle linked to the institution’s risk assessment, monitoring rules, and suspicious transaction reporting process;
• lack of clear reasoning in the review conclusion – in many cases only the final risk decision is recorded, without describing the underlying analysis and factors, making it difficult to defend before a supervisory authority.

Conclusion

In conclusion, the periodic review is not an isolated administrative step, but a dynamic process that connects initial customer due diligence, ongoing monitoring, and escalation decisions, including the submission of suspicious transaction reports.

Data accumulated through ongoing monitoring are consolidated into a holistic picture and reach a level of significance that enables a reasoned decision on whether to submit a suspicious transaction report.

With the introduction of the AML Regulation, requirements become clearer, timeframes more measurable, and decisions more easily verifiable. This makes the periodic review an even more visible and strategically important element of the overall AML architecture.

At Compliance Navi, we view the periodic review not as a formal regulatory obligation, but as a key instrument for effective risk management. Our approach combines regulatory compliance, practical applicability, and an in-depth understanding of each organisation’s specific business model. We support obliged entities in building effective processes for ongoing monitoring and periodic review that are defensible before supervisory authorities, integrated into daily operations, and focused on timely identification and management of risks rather than formal “box-ticking.”