Perpetual KYB: what it is, how it differs from progressive KYB, and what triggers a review

Onboarding is the moment everyone writes about. The other 99% of a merchant's life is where the risk actually shows up. Perpetual KYB is the discipline of watching that 99%. Here is what it is, what the rules require, the triggers that fire in practice, and how it sits next to the instant-account model.

Definition

Perpetual KYB (Know Your Business), also called continuous or ongoing KYB, means a payment provider keeps verifying a business customer for as long as the relationship lasts, driven by events rather than by a calendar. The traditional model was onboarding plus a periodic refresh every one to three years depending on risk. The perpetual model keeps the refresh but adds continuous signals: sanctions and politically exposed person lists re-screened as they update, company registries watched for changes in directors and owners, transaction behaviour compared against the profile the business declared, bank accounts checked when they change, and adverse media monitored.

It is the business-customer counterpart of perpetual KYC for individuals, and in payments the two overlap, because every business has people behind it who must also be screened.

Perpetual versus progressive

The two terms get confused because both replace a single big onboarding check with something continuous. They solve different problems.

Modern onboarding uses both on one risk engine: the same model that decides a new seller can start with a £1,500 cap also decides, six months later, that a sudden spike in refunds needs a human. We defined the first half in What is progressive KYB; this page is the second half.

What the rules actually require

• United Kingdom. The Money Laundering Regulations 2017 require ongoing monitoring of a business relationship: scrutinising transactions to make sure they match what the firm knows about the customer, and keeping documents and information up to date. The FCA expects payment institutions to show it, not just state it.
• European Union. The anti-money-laundering directives require ongoing monitoring; the new single AML Regulation, applying from 2027, standardises how often and how deeply, with an EU-level supervisor for the largest firms.
• United States. FinCEN's customer due diligence rule requires ongoing monitoring to identify and report suspicious transactions and, on a risk basis, to maintain and update customer information, including beneficial ownership.

None of these say "perpetual". They say "ongoing" and "risk-based", and leave the firm to decide what that means. Perpetual KYB is the industry's answer to the question of how to do ongoing monitoring at scale without a compliance analyst per merchant.

The triggers that fire in practice

We run onboarding and monitoring for software platforms and the small businesses on them. These are the events that actually open reviews, roughly in order of frequency.

1. Cap and volume breaches. A capped account that approaches its limit is both the most common trigger and the healthiest: it means the business is growing. The review is to lift the cap, and it needs the verification that was deferred at signup.
2. Refund and dispute ratios. A jump in refunds, or disputes approaching the card schemes' thresholds (around 0.9% to 1.5% of transactions), is the strongest signal that the business is not what it declared. See what chargebacks really cost.
3. Bank account changes, especially name mismatches. A seller who links a bank account held in a different name, or in a company's name when they onboarded as an individual, triggers a manual check every time. Sometimes it is innocent: a sole trader whose only business account is in their LLC's name. Sometimes it is an account takeover. The review asks for proof of ownership or an account in the seller's own name, and payouts wait until it is answered.
4. Profile drift. Average ticket, country mix of customers, or business category moving away from what was declared. A "consulting" account that starts taking hundreds of €9.99 payments from thirty countries is a different business than the one that was onboarded.
5. List hits. Sanctions and PEP lists change daily. A name that was clean at onboarding can match a month later. Re-screening is automatic; the review is to rule out a false positive, which most are.
6. Registry changes. A new director, a change of registered address, a company striking off. For UK companies this comes from Companies House; for individuals there is no registry, which is one reason individual sellers get a tighter cap.
7. The periodic refresh. Even with no trigger, documents expire and risk ratings age. Low-risk accounts get refreshed on a long cycle, high-risk on a short one.

What happens when a review opens

The design question is what the review does to the merchant while it is open. The crude answer, still common, is to freeze everything. The better answer is to separate the two directions of money. Taking payments is low risk to the provider while funds are held; paying out is where losses happen. So a review should keep pay-ins open and hold payouts until it is resolved, and the merchant should be told exactly what is needed. On paas.build this is literal: a review turns off payouts, never checkouts, and the portal shows the seller the missing item rather than a generic "under review".

What this looks like at paas.build

A new seller is live at the first API call with a £1,500 cap. Automated review approves the large majority of accounts within a minute; humans look at the exceptions. From there the account is monitored continuously: the cap, the ratios, the bank account, the lists, the profile. When something fires, the seller sees what to fix in the portal and payouts pause until they do. Identity is verified from a government document and bank ownership from a direct bank connection (Plaid) with holder-name matching, and both are checked again whenever they change.