How often should the ongoing due diligence on business relationship (in terms of customer risk profile) be carried out?

The regulated person’s policy and procedures should specify how often ongoing monitoring is to be conducted. A clear cycle should be indicated for each risk category or type of customer, for example at least once a year for high risk cases, at least once every two years for medium risk cases and every three years for low risk cases, or where a review is triggered by a defined event.