Customer due diligence does not end at onboarding. A law firm must conduct ongoing monitoring of its business relationships so that the transactions and activity it sees remain consistent with what it knows about the client, the client’s business and risk profile, and, where relevant, the source of funds.
Ongoing monitoring means scrutinising transactions during the relationship, keeping customer due diligence records current, and updating identification and beneficial ownership information as circumstances change. The intensity should be risk-based, so higher-risk clients are reviewed more closely and more frequently than lower-risk ones. Monitoring should also pick up changes that alter the risk picture, such as a client becoming a politically exposed person, a shift in ownership, or transactions that no longer make commercial sense. Where monitoring reveals activity that cannot be explained, the firm should escalate to the compliance officer and consider whether a suspicious transaction report is required. Effective monitoring is what turns a static file into live risk management.
Ongoing monitoring has two limbs and a law firm owes both for the life of the retainer. The first is scrutinising transactions carried out throughout the business relationship to ensure they remain consistent with what the firm knows about the client, the nature of the client’s activities and the risks they present, including, where necessary, the source of funds. The second is keeping the documents, data and information obtained during customer due diligence up to date and relevant by reviewing records, with particular emphasis on categories of high-risk clients.
In practice that means a periodic file review whose frequency is set by the client’s risk rating rather than by the calendar alone, refreshing identification documents as they expire, re-running sanctions screening when the lists change rather than only at onboarding, and revisiting the risk rating when the retainer changes character. Where the client is a politically exposed person the monitoring must be enhanced. Monitoring that produces concerns feeds back into the reporting duty: if the picture no longer holds together, the file goes to the compliance officer.
Legal Reference (UAE):
· Cabinet Resolution No. 134 of 2025, Article 8, which requires transaction scrutiny throughout the business relationship and keeping customer due diligence information up to date, with emphasis on high-risk customers.