How to Choose Periodic Review & Ongoing Monitoring Software: A 2026 Buyer's Guide

To choose periodic review and ongoing monitoring software in 2026, evaluate it against seven criteria — event-driven triggers, live data and registry refresh, risk-based cadence, continuous sanctions and adverse-media re-screening, pre-population and automation, auditability, and integration — and treat perpetual KYC (pKYC) as the target operating model rather than faster calendar-driven reviews. The best tools do not just help you complete periodic reviews on time; they progressively remove the need for scheduled reviews altogether by reviewing each file the moment it changes.

This is a vendor-neutral buyer's guide for Chief Compliance Officers and Heads of KYC. It explains why periodic reviews have become a growing operational burden, the difference between periodic and perpetual KYC, the selection criteria that separate a genuine ongoing-monitoring platform from a workflow tool with a calendar, and how to measure whether a purchase actually pays back.

1. Why periodic reviews are a growing burden

The periodic review — re-verifying a client file on a one, three, or five-year cycle set by risk rating — was designed for a world where client data changed slowly and books of business were small. Neither assumption holds in 2026, and the model has become one of the largest, least scalable line items in a compliance budget.

Backlogs are structural, not accidental

Every client onboarded today creates a future review obligation. As a book grows, those obligations cluster: an institution that onboarded heavily three years ago faces a wall of three-year reviews falling due in the same window, regardless of team capacity. Because reviews compete with onboarding for the same analysts, they slip first when onboarding volumes spike. A backlog is therefore not an execution failure — it is a built-in property of scheduling review work by calendar rather than by risk.

Data goes stale between cycles

A review is accurate on the day it is signed and begins decaying immediately. A new beneficial owner, a fresh sanctions designation, an adverse-media hit, or a change of director may not be captured for months or years. For a client on a three-year cycle, the file can be up to 1,095 days out of date before anyone looks at it again — and in that window the institution is, in effect, banking a risk profile it no longer understands.

The economics do not scale

Performed manually, a single periodic review consumes 2 to 4 hours of analyst time: pulling current registry data, re-screening against sanctions and PEP lists, reconciling changes, and documenting the decision. Across a portfolio of thousands of relationships, the review function alone can absorb the majority of a team's capacity — while a loaded Swiss KYC analyst costs CHF 80,000 to 110,000 per year. Software is the only realistic way to break the linear link between book growth and headcount.

Regulators no longer accept a tick-box review

Supervisors have shifted from asking "does a review process exist?" to "can you demonstrate that risk was identified and acted on in a timely, evidence-based way?" A review dated eleven months before a client was sanctioned is hard to defend under that standard. The purchasing question has therefore changed: you are no longer buying a tool to complete reviews faster, but a control that can evidence ongoing monitoring of the business relationship.

2. Periodic vs perpetual KYC: what you are actually buying

Before comparing vendors, decide which operating model you are buying into. This is the single most important decision in the process, because it determines whether the software caps your future workload or merely reschedules it.

Periodic KYC reviews every file on a fixed calendar, whether or not anything has changed. Perpetual KYC (pKYC) replaces the calendar with continuous, event-driven due diligence: each file is connected to monitored data sources, changes are detected and scored for materiality as they happen, immaterial changes are closed automatically, and only material changes generate a task for an analyst. Nothing is reviewed on a date — everything is reviewed the moment it changes.

The practical takeaway for a buyer: do not select a tool solely on how efficiently it clears a review queue. Select on whether it can shrink the queue itself. A deeper treatment of this shift is in our companion article on perpetual KYC and the end of periodic reviews. Even institutions that are not ready to abandon scheduled reviews should buy software capable of pKYC, so the migration is a configuration change rather than a re-procurement.

3. The selection criteria: a 2026 evaluation framework

Use the seven criteria below as an evaluation scorecard. Score each vendor on each row, and weight the rows that matter most to your risk profile. The framework is deliberately vendor-neutral; several platforms can satisfy it, and the point is to compare like with like rather than to react to demos.

Reading the scorecard

Three rows are non-negotiable in 2026. Event-driven triggers are what separate a monitoring platform from a workflow tool with a calendar; without them, you are buying a faster way to do the same stale-data reviews. Continuous sanctions and adverse-media re-screening is the single biggest risk reducer, and its value depends heavily on AI relevance filtering — raw screening that returns 90 to 99 percent false positives simply moves the burden rather than removing it, so ask each vendor for their post-filtering false-positive rate. Read our primer on adverse-media screening before you sit through demos. Auditability is what turns the whole system into a regulatory asset rather than an operational convenience.

Questions to put to every vendor

• Can a review be triggered by a registry or ownership change with no calendar date involved?
• What is your false-positive rate after AI filtering, and how is relevance scored?
• How much of a review pack is pre-populated automatically versus assembled by the analyst?
• Can immaterial changes be closed straight-through, and is that closure logged and auditable?
• Does the audit trail capture the data behind each decision and the moment it was made?
• Which registries and internal systems do you connect to out of the box, and via what APIs?

4. How to move from periodic to perpetual

The right software lets you migrate in stages rather than in a single disruptive switch. A phased path builds confidence, validates triggers, and demonstrates control to auditors at each step — and it should be possible within a single platform, without re-buying.

Phase 1 — Continuous screening overlay

Keep periodic reviews in place, but add continuous sanctions, PEP, and adverse-media screening across the whole portfolio. This delivers the biggest single risk reduction first, without changing the review process itself.

Phase 2 — Event-driven triggers on high-risk clients

Connect registry and transaction-anomaly triggers for the highest-risk segment. High-risk clients move to a fully event-driven model, while lower-risk tiers stay on a periodic schedule as a safety net.

Phase 3 — Portfolio-wide event-driven review

Extend triggers across all risk tiers. The periodic schedule becomes a long-stop backstop rather than the primary control: a file is reviewed when it changes, and only reviewed on a calendar if, exceptionally, no trigger has fired for a very long time.

Phase 4 — Perpetual by default

Retire periodic reviews as the primary mechanism. The portfolio is under continuous surveillance and analyst effort is fully redirected to triggered events and genuinely complex cases. The audit narrative shifts from "we reviewed on schedule" to "we detected, assessed, and acted on every material change."

A key buying signal: the vendor should be able to show you each of these phases as a configuration state, not as a separate product or a future roadmap item.

5. Measuring the impact

Build the business case on a small number of hard metrics, and require the vendor to commit to them during a proof of value. The ranges below are what mature ongoing-monitoring deployments deliver, and they are consistent with the figures we use across our ROI analysis.

The headline numbers to hold a vendor to are the first three rows. Per-review time should fall from 2 to 4 hours to 20 to 45 minutes, manual review effort across the portfolio should drop by 70 to 90 percent, and a single analyst's throughput should rise from 15 to 25 files a month to 80 to 120 trigger events — a four to five-fold capacity gain. Against a loaded analyst cost of CHF 80,000 to 110,000, that capacity shift is what produces a typical year-one net ROI of 200 to 260 percent with payback in three to four months. If a vendor cannot model these outcomes for your book during evaluation, treat that as a red flag.

6. Frequently asked questions

What is a periodic KYC review?

A periodic KYC review is a scheduled re-verification of an existing client's due-diligence file — confirming identity, beneficial ownership, source of wealth, risk rating, and screening status — carried out at a fixed interval determined by the client's risk classification rather than by any specific event.

How often are periodic reviews required?

Frequency is risk-based, not fixed by a single rule. Typical practice is annually for high-risk clients, every two to three years for medium-risk, and every four to five years for low-risk, with the exact cadence set by the institution's risk-based approach and supervisory expectations. The direction of travel in 2026 is away from fixed intervals and toward event-driven review.

What is the difference between periodic and perpetual KYC?

Periodic KYC reviews every file on a calendar regardless of whether anything changed; perpetual KYC (pKYC) reviews a file the moment a material change is detected and closes immaterial changes automatically. Periodic KYC produces stale data and structural backlogs; perpetual KYC keeps every file near real-time current and removes 70 to 90 percent of manual review work.

Can periodic reviews be automated?

Yes. Automation covers data refresh from registries, continuous sanctions and adverse-media re-screening, pre-population of review packs, straight-through closure of immaterial changes, and automatic re-tiering when risk scores change. Human analysts remain in the loop for material changes and complex judgment, but the routine confirmation of unchanged files is largely eliminated.

What triggers an event-driven review?

Common triggers include a change of beneficial owner or director, a new sanctions or PEP designation, an adverse-media hit, a change of registered address or legal status, exposure to a newly high-risk jurisdiction, and transaction anomalies such as a dormant account becoming active or transfers inconsistent with the client's stated profile.

Is ongoing monitoring a regulatory requirement?

Ongoing monitoring of the business relationship is a core expectation under Swiss AMLA (LBA / GwG / LRD) and the revised OBA-FINMA / GwV-FINMA, and under the EU AML package with the new Anti-Money Laundering Authority. Regulators increasingly expect demonstrable, evidence-based effectiveness rather than the mere presence of a review process — which is precisely what continuous, event-driven monitoring provides.

7. How Wecan fits

Measured against the seven criteria above, Wecan Copilot is built for continuous due diligence rather than calendar-driven reviews — but the framework matters more than any single vendor, and it should be applied evenly to every option on your shortlist. Where Wecan is designed to score well is on the three non-negotiable rows: configurable event-driven triggers connected to live registry, sanctions, PEP, adverse-media, and transaction-monitoring feeds; AI contextual scoring that cuts the false-positive rate from an industry-standard 90 to 99 percent to 20 to 25 percent; and a time-stamped, evidence-rich audit trail that records every trigger, the underlying data, the assessment, and the action taken.

Just as importantly, the four migration phases are configuration states within one platform: an institution can start with a continuous screening overlay on top of its existing periodic reviews and move toward perpetual-by-default at its own pace, treating each step as evidence of control for auditors. Whichever vendor you choose, the goal is the same — a monitoring function that acts on risk the moment it emerges, keeps every file current, and finally retires the backlog for good.