Continuous AML Monitoring vs Batch Screening: Why Periodic Checks Are No Longer Enough

Most compliance teams understand the concept of ongoing monitoring. The AML Directives require it. FATF Recommendation 10 requires it. Supervisors inspect for it. And yet the majority of regulated businesses still run what amounts to a batch process — screening clients at onboarding, then re-running a bulk export once a quarter, once a year, or when someone remembers.

This creates a window. A customer who was sanctioned last week is still showing as "cleared" in your system. A PEP relationship that emerged three months ago hasn't been flagged. An adverse media story that broke in February still hasn't triggered a review. Your compliance programme has a blind spot — and it's measured in months, not seconds.

What does "ongoing monitoring" actually require?

Article 13 of the Fourth AML Directive — carried into the Fifth, Sixth, and national implementations — requires obliged entities to conduct "ongoing monitoring of the business relationship" with their customers. This includes:

• Scrutiny of transactions during the course of the relationship
• Keeping documents and data up to date
• Identifying transactions that are inconsistent with the customer's known business or risk profile

The phrase "ongoing" is doing a lot of work. Supervisors have consistently interpreted it to mean a continuous process, not a scheduled batch job. The FCA's 2022 review of financial crime controls in smaller payment firms found that 68% of firms assessed had inadequate ongoing monitoring — the most common failure was running checks only at customer onboarding.

Batch screening: what it is, and what it misses

Batch screening means taking your customer list, exporting it to a file, uploading it to a screening provider (or running it through an API in bulk), and reviewing the results. It's the approach most compliance tools were built around — because until recently, it was the only economically practical option.

The problem is the gap between batches. Consider what can change in 90 days:

• A customer is designated on the OFAC SDN list following a sanctions escalation
• A director of a corporate client is appointed to a government role, making them a PEP
• A media investigation breaks, linking a client to financial crime
• A previously unknown UBO is identified through registry data
• A customer's transaction patterns shift dramatically from their onboarding profile

In each case, batch screening means you learn about it at the end of the quarter — if you remember to run the batch. In the meantime, your business relationship continues, transactions are processed, and the regulatory clock is ticking.

Continuous monitoring: how it actually works

Continuous monitoring replaces the batch-and-review cycle with an always-on process. Rather than screening your customer list on a schedule, the system maintains a live watch on each subject — re-checking against updated sanctions lists as they change, monitoring for new adverse media, and alerting your team the moment a hit appears.

In practice, a well-implemented continuous monitoring system does the following:

1. List-change-triggered rescreening

When a sanctions authority publishes an update — OFAC, EU, UN, or national lists — the system automatically runs a check of all monitored subjects against the change. If there's a match, an alert is generated immediately. The gap between a list update and your awareness shrinks from months to minutes.

2. Scheduled periodic rescreening

For slower-moving risk factors — PEP status, adverse media, UBO changes — subjects are rescreened on a configurable schedule. High-risk customers might be rescreened weekly. Standard-risk customers monthly. The cadence is set by policy, not by when someone last ran an export.

3. Alert-based review workflow

Continuous monitoring generates alerts, not just reports. When a new hit appears, it goes directly into a review queue — assigned to the right analyst, with SLA tracking and a full evidence pack. The compliance team's job shifts from running searches to reviewing alerts. The volume of work doesn't increase; the responsiveness does.

4. Transaction behaviour monitoring

Beyond screening, continuous monitoring should include watching for anomalies in transaction patterns — amounts, frequencies, counterparties, and geographies that deviate from a customer's established risk profile. This is the layer that catches activity that doesn't match any list, but still warrants investigation.

Batch vs continuous: a side-by-side comparison

The operational case: it's not just about regulation

Continuous monitoring is often framed as a compliance obligation — something you do because you must. But there's a practical operational case too.

When a high-profile sanctions designation breaks in the news, the last thing you want to be doing is running an emergency batch screen, calling your compliance officer at 6pm, and trying to piece together whether any of your active clients are affected. With continuous monitoring in place, you already know. The alert was generated, reviewed, and documented before the journalist's story ran.

That's the real value: converting a reactive, manual, high-stress process into a quiet, systematic one. Your team spends less time firefighting and more time on the judgement calls that actually require human expertise.

Implementation: what good looks like

If you're upgrading from batch screening to continuous monitoring, here is what a well-implemented system looks like in practice:

• Subject register — a maintained list of all active monitored subjects (customers, counterparties, UBOs, directors) with their risk tier and monitoring cadence
• Alert queue — a dedicated workflow for reviewing new hits, with assignment, SLA tracking, and a clear approve/escalate/dismiss decision path
• Evidence packaging — each alert should carry the screening result, the source data, the subject's history, and any prior decisions
• Audit trail — every monitoring run, every alert, every decision must be logged immutably for regulatory examination
• Dashboard KPIs — your compliance manager should be able to see at a glance: how many subjects are monitored, when each was last checked, and how many active alerts are open

HubSecure Sentinel includes continuous monitoring as a core capability — not as an optional add-on. Every subject added to Sentinel is automatically re-screened on schedule. New hits surface as alerts in a prioritised review queue. Your team stops running batch jobs and starts reviewing outcomes.