Ongoing monitoring
CDD is not complete at onboarding. PSN02 requires the firm to monitor the business relationship on an ongoing basis and to scrutinise transactions for consistency with the firm's knowledge of the customer, its business and risk profile and, where appropriate, the source of funds. CDD information must be kept current through periodic reviews whose frequency depends on risk.1 For DPT firms the monitoring system must cover both the fiat leg and the on-chain leg of each transaction. The typical architecture combines a transaction-monitoring engine with rules on velocity, value, structuring and geography, with a blockchain-analytics feed that scores the counterparty addresses of every inbound and outbound transfer. MAS expects the rules to be calibrated to the firm's risk assessment and tested. Alerts must be cleared within a documented timeframe by trained staff, with the rationale for closing each alert recorded.
The periodic review of customer information should be risk-based: annually for higher-risk customers, every two to three years for standard-risk. Trigger-based reviews fall in between when a material change occurs, such as a change of beneficial ownership, a sharp increase in activity or an adverse-media hit.2 A DPT firm must also treat a change in the customer's wallet behaviour as a trigger. A corporate customer that has withdrawn only to its own verified cold wallet for two years and suddenly begins withdrawing to fresh addresses in round amounts has changed its profile, whatever its paperwork says.
Notes
- MAS Notice PSN02, para. 6 (ongoing monitoring) and para. 8 (enhanced ongoing monitoring for higher-risk customers). ↩
- Guidelines to Notice PSN02, section on ongoing monitoring and periodic review. ↩
For general information only. This article does not constitute legal or tax advice, does not replace advice on an individual case and creates no lawyer-client relationship. It reflects the legal position as of October 2026.