Table of Contents
Overview
A customer can be low risk at onboarding and high risk six months later. The real question is whether your compliance program can detect the change.
KYC onboarding is often treated as the moment when a financial institution decides whether to accept a customer. But in a modern financial crime environment, that decision is only the first snapshot of risk.
A customer’s ownership can change. Their transaction behavior can shift. They can become connected to a higher-risk jurisdiction, appear in adverse media, trigger fraud indicators, or develop relationships with entities already under investigation.
The customer’s identity has not necessarily changed. The risk around that identity has.
That is why effective financial crime compliance needs to operate as a lifecycle rather than a collection of independent checks.
A complete FRAML lifecycle connects KYC, customer due diligence (CDD), risk assessment, screening, fraud detection, transaction monitoring, ongoing monitoring, investigation, and offboarding so that information gathered at one stage can influence decisions at the next.
The result is a more useful question than “Did this customer pass KYC?”
It becomes: “Does what we know about this customer today still justify the level of risk we assigned them?”
The FRAML Lifecycle at a Glance
Lifecycle stage | What the institution needs to know | Key risk signals | Typical response |
|---|---|---|---|
KYC onboarding | Who is the customer? | Identity, ownership, geography, business activity | Verify and establish baseline risk |
Initial risk assessment | How risky is the relationship? | Customer, product, geography and behavioral factors | Assign risk profile |
Screening | Has external risk changed? | Sanctions, PEPs, adverse media, watchlists | Review or escalate |
Transaction monitoring | Is activity consistent with the profile? | Transaction patterns, velocity, counterparties | Generate and investigate alerts |
Ongoing monitoring | Has the customer's risk changed? | New behavior, new intelligence, profile changes | Reassess risk |
Investigation | What does the combined evidence indicate? | Fraud + AML + entity relationships | Escalate, remediate or clear |
Offboarding | Can the relationship continue? | Unacceptable or unresolved risk | Restrict, exit or report where required |
This is the central idea behind FRAML: risk should move through the lifecycle with the customer. |
KYC Onboarding Should Create a Risk Baseline, Not a Permanent Risk Rating
KYC onboarding establishes the information needed to understand who the customer is and what the institution should reasonably expect from the relationship.
Depending on the customer and jurisdiction, this can include:
Identity verification
Beneficial ownership information
Nature and purpose of the relationship
Expected transaction activity
Source of funds or wealth where appropriate
Business activity and industry
Geographic exposure
Relevant sanctions, PEP and adverse media checks supported by specialized prescreening tools for AML compliance
But there is a subtle distinction between knowing the customer and knowing the customer’s risk. The first is largely about identity and context. The second requires an assessment of how that customer could expose the institution to financial crime risk.
A useful onboarding profile therefore answers questions such as:
Who is this customer?
What do they do?
Where do they operate?
Who owns or controls them?
What activity should we expect?
What factors make this relationship higher or lower risk?
The FATF’s risk-based approach similarly emphasizes understanding the customer’s identity, beneficial ownership, circumstances, and expected nature and level of transactions, with the extent of due diligence and monitoring adjusted according to risk.
The problem with treating onboarding as the finish line. Imagine a business is onboarded after declaring a domestic operating model and relatively modest transaction volumes.
Six months later:
transaction values increase sharply,
funds begin moving across several jurisdictions,
a new beneficial owner appears,
the customer becomes associated with another high-risk entity, and
adverse media emerges around a related individual.
The original KYC file may still be accurate in parts. But the risk profile is no longer the same. That gap between what was known at onboarding and what is known now is where lifecycle-based compliance becomes critical.
Dynamic Risk Profiling: The Customer's Risk Should Be Able to Change
A static risk score creates a false sense of certainty. A customer classified as low risk at onboarding does not remain low risk simply because the original score has not expired. A stronger model treats customer risk as a living profile.
Initial risk
At onboarding, the institution establishes a baseline using factors such as:
Customer type
Geography
Industry
Ownership structure
Products and services
Expected transaction activity
Source of funds
Screening results
Emerging risk
After onboarding, new information can modify that baseline.
For example:
Initial profile: Low-risk domestic business → expected monthly transactions of $100,000.
Observed profile six months later: $1.2 million in monthly flows → multiple overseas counterparties → rapid movement of funds → new adverse media.
The question is no longer whether the customer was low risk. The question is: What explains the change, and does the customer’s risk rating need to change with it?
This is why KYC monitoring and ongoing customer risk assessment need to extend beyond periodic document refreshes.
Screening Is Not a One-Time Check
Screening is often associated with onboarding, but external risk information can change at any point during a customer relationship.
A customer who produces no relevant match on day one can later become:
a PEP,
associated with a sanctioned party,
linked to adverse media,
connected to a higher-risk entity, or
affected by a change in beneficial ownership.
This makes AML screening and monitoring a continuing control rather than simply an onboarding checkbox, especially when designed to reduce false positives in AML screening.
The distinction matters:
Onboarding screening asks:
“Is there a known risk before we establish the relationship?”
Ongoing screening asks:
“Has new information changed the risk of an existing relationship?”
That second question is particularly important for large customer populations, where manually reviewing every customer at the same frequency can create enormous operational overhead.
A risk-based model instead allows institutions to determine which customers need deeper scrutiny and when.
Transaction Monitoring Adds the Behavioural Layer
Identity tells you who the customer is. Transaction activity tells you how the relationship is actually being used.
This is where what is transaction monitoring gets answered: aml transaction monitoring is the process of reviewing activity to detect signals of money laundering or other financial crime across the customer lifecycle.
Monitoring can identify patterns such as:
Unusual transaction volumes
Rapid movement of funds
Structuring or unusual transaction frequency
Unexpected geographic exposure
Unusual counterparties
Activity inconsistent with the customer’s stated profile
Relationships between accounts or entities that warrant investigation
Traditional rule based transaction monitoring systems rely on monitoring rules and transaction monitoring rules built around thresholds, geographies, and known scenarios. Typical red flags include transactions just below reporting thresholds or activity linked to high risk jurisdictions.
But the strongest insight often comes from comparing the activity with the customer’s existing risk context.
Consider two customers making the same $500,000 international transfer. For Customer A, the transaction is consistent with its established business model. For Customer B, it is completely inconsistent with its stated activity and previous behavior. The transaction amount is identical.
The risk is not.
This is why effective transaction monitoring should not operate as an isolated alert factory. It becomes more valuable in AML when financial institutions and similar platforms combine rules with AI and machine learning, or machine learning and contextual analysis, to improve accuracy.
Used well, AI can review millions of transactions in real time, while machine learning helps cut false positives; that approach is increasingly accepted by regulators.
FATF guidance likewise describes monitoring as a risk-based activity, with the degree and nature of monitoring dependent on the institution’s risks, the activity being reviewed, and the customer’s perceived risk; that matters because the UN estimates that 2% to 5% of global GDP is laundered each year, and 44% of AML fines are tied to inadequate monitoring.
From Transaction Monitoring to Ongoing Monitoring
Transaction monitoring answers a specific question: “Does this activity look unusual or suspicious?”
In practice, the transaction monitoring process works best when it relies on consistent data and not just isolated alerts, because trend analysis is fundamental to effective monitoring.
Ongoing monitoring asks a broader question: “Has anything about this customer relationship changed enough to require a different risk decision?”
That distinction is critical.
A transaction alert may be cleared because the activity has a legitimate explanation.
But the event could still contain information relevant to the customer’s risk profile.
For example: Alert generated → analyst investigates → activity explained → alert closed
The traditional workflow stops there, even though the transaction monitoring process can reveal broader risk signals over time.
A lifecycle-based FRAML workflow asks one more question:
“Did this event tell us anything new about the customer?”
If yes, that information can feed back into the customer’s risk profile. Automating data collection improves the efficiency of continuous monitoring.
This creates a continuous loop:
Monitor → Detect → Investigate → Reassess → Update Risk → Monitor Again
That is the difference between simply processing alerts and maintaining ongoing monitoring AML across the relationship.
Periodic Reassessment Should Be Triggered by Risk, Not Just the Calendar
Periodic reviews remain important, but a calendar alone is a weak proxy for risk. A customer should not necessarily receive the same review treatment simply because twelve months have passed.
Instead, reassessment can be triggered by meaningful changes such as:
Customer changes
Ownership or control changes
New business activities
New jurisdictions
Changes in products or services
Behavioural changes
Significant changes in transaction volumes
New transaction patterns
Unexpected counterparties
Changes in account usage
External intelligence
New sanctions or PEP exposure
Adverse media
Regulatory or law-enforcement information
Links to previously identified risky entities
Internal intelligence
Repeated monitoring alerts
Fraud indicators
Previous investigations
Connections to other suspicious accounts or entities
This creates a more responsive model of ongoing monitoring KYC.
Instead of asking customers to repeatedly prove the same information without context, institutions can focus review effort where the risk signal actually changed.
Where FRAML Becomes More Than "AML + Fraud"
This is where the lifecycle becomes genuinely interesting. Fraud and AML teams can observe the same customer from different angles, which is why integrated fraud monitoring for detection, prevention and compliance is so important.
A fraud team might see:
Device changes
Account takeover indicators
Payment anomalies
Mule-like behavior
Multiple linked accounts
An AML team might see:
Unusual transaction patterns
High-risk counterparties
Geographic exposure
Adverse media
Suspicious fund movement
Separately, these signals may look incomplete. Together, they can tell a much stronger story. Example: A customer account suddenly receives funds from several unrelated accounts. The transaction monitoring system generates an alert. The fraud team discovers that several originating accounts share behavioral or device indicators.
The screening layer identifies an association with a previously flagged entity.
The customer’s risk profile changes.
Now the institution is not investigating three separate alerts.
It is investigating one connected financial crime event.
That is the practical value of FRAML, unifying fraud and AML: connecting fraud and AML intelligence around the entity and relationship, rather than forcing analysts to reconstruct the story manually.
Investigation Should Change the Customer's Risk Profile
Investigation should not be the dead end of the workflow.
The outcome of an investigation can itself become risk intelligence.
For example: Alert → Investigation → Cleared
The customer’s risk may remain unchanged.
But: Alert → Investigation → Confirmed suspicious pattern
may indicate the need to escalate the case, use investigation data to identify linked behavior, and consider filing a suspicious activity report.
could trigger:
Risk increase → Enhanced due diligence → Increased monitoring → Restrictions or escalation, including suspicious activity reports (SARs) where required
The same principle applies to fraud investigations.
If a customer is repeatedly connected to fraudulent activity, that information should not remain trapped inside a separate fraud case-management workflow.
It should be available to the broader customer-risk process where appropriate.
This is where FRAML integration creates a feedback loop between detection and risk management.
When Monitoring Becomes Offboarding
Not every high-risk customer should automatically be exited. Risk-based compliance is about determining what response is proportionate to the circumstances. Depending on the evidence and applicable requirements, the outcome could include:
No change
Additional information
Enhanced due diligence
Increased monitoring
Transaction restrictions
Investigation
Regulatory reporting where required
Relationship termination
Offboarding therefore represents the decision point at the end of the lifecycle, not simply an operational account-closure process.
A defensible decision requires a clear trail of how the institution moved from:
Customer information → Risk signals → Investigation → Risk assessment → Decision
That auditability matters because the institution should be able to explain not only what decision it made, but why it made it. Nationwide Building Society was fined £44 million for deficiencies in aml compliance. Metro Bank failed to monitor 60.5 million transactions between 2016 and 2020, showing how weak controls and poor decisions create serious consequences for aml compliance and transaction monitoring for AML.
The Customer Experience Is Part of the Risk Strategy
Compliance friction is often treated as unavoidable. It does not have to be. A mature lifecycle applies scrutiny according to risk rather than applying the same process to every customer.
Consider three customers:
Customer | Risk profile | Appropriate experience |
|---|---|---|
Low risk | Stable profile, expected behavior | Streamlined checks |
Elevated risk | New risk indicators | Additional verification |
High risk | Multiple connected signals | Enhanced due diligence and investigation |
This is where technology can support both compliance and customer experience. |
The objective is not to eliminate checks. It is to make sure the right customer receives the right level of scrutiny at the right time. That is a more sustainable approach than repeatedly applying the same manual process to the entire customer base.
What a Mature FRAML Lifecycle Looks Like
A mature lifecycle should behave less like a series of disconnected checkpoints and more like a closed feedback loop.
The lifecycle therefore does not really have an “end.”
Offboarding ends the relationship. Reassessment keeps the risk model alive while the relationship exists.
How ZIGRAM Supports the FRAML Lifecycle
The technology challenge is making this lifecycle work without forcing compliance teams to stitch together disconnected systems.
ZIGRAM approaches the problem through an integrated AML, fraud and financial crime compliance software stack covering screening, transaction monitoring, customer risk management and financial crime workflows.
For example:
PreScreening.io supports name screening for AML and financial crime risks across sanctions, PEP, adverse media and other risk data, including real-time monitoring workflows.
Entity Hero supports customer risk assessment, onboarding, ongoing monitoring and continuous updates to customer profiles. It can also integrate with transaction monitoring workflows.
Transact Comply provides SaaS-based transaction monitoring and payment screening, with real-time alerts, configurable rules and risk detection across customer activity.
Fraud Fighter adds the fraud detection layer to the lifecycle, helping identify suspicious and fraudulent activity that may otherwise remain separate from AML workflows. Connecting fraud signals with customer and AML intelligence helps create a more complete view of financial crime risk.
Together, these capabilities support the idea at the heart of a FRAML lifecycle: The signal generated at one stage should be capable of informing the risk decision at the next.
And, this connected approach is at the core of ZIGRAM’s Complete FRAML System, designed to bring fraud and AML capabilities together so financial institutions can move from isolated detection workflows toward a unified financial crime risk management framework.
The objective is not simply to add more monitoring.
It is to ensure that a risk signal identified at one stage can inform decisions across the rest of the customer lifecycle.
Conclusion
KYC onboarding answers an essential question: who is this customer and what risk do they present when the relationship begins? But financial crime risk does not remain frozen at that moment.
The customer’s behavior changes. New intelligence appears. Transactions reveal patterns. Fraud signals emerge. Ownership can change. Risk can increase or decrease.
A modern FRAML lifecycle responds to those changes by continuously connecting the information generated throughout the relationship.
The strongest model is therefore not: KYC → Approved → Done
It is: KYC → Risk Profile → Screen → Monitor → Detect → Investigate → Reassess → Act → Monitor Again
That shift, from static onboarding to continuous risk intelligence — is what turns compliance from a collection of checks into a living financial crime risk management process.
Frequently Asked Questions
What is a FRAML lifecycle?
A FRAML lifecycle connects fraud and AML controls across onboarding, monitoring, investigation, risk reassessment and offboarding.
What is KYC onboarding?
KYC onboarding verifies a customer’s identity, ownership, business context and relevant risk factors before or when establishing a relationship.
Why is ongoing monitoring important?
It helps identify changes in customer behavior, risk exposure and external intelligence after onboarding.
How does transaction monitoring support FRAML?
It provides behavioral and transactional signals that can inform fraud detection, AML investigations and customer risk reassessment.
Should customer risk change after onboarding?
Yes. Customer risk should be reassessed when new information or behavior materially changes the original risk profile.
What triggers customer risk reassessment?
Changes in ownership, behavior, geography, transaction activity, screening results, adverse media or other material risk indicators can trigger reassessment.
What happens after a high-risk alert?
Depending on the circumstances, the institution may investigate, apply enhanced due diligence, increase monitoring, restrict activity, report suspicious activity or exit the relationship.
How does FRAML improve customer experience?
A risk-based FRAML model can focus deeper checks on higher-risk customers while reducing unnecessary friction for lower-risk relationships.
