Trigger-event reviews work when the trigger list is explicit and watched continuously. The agent detects the event, opens the review, refreshes what it can from records and screening, requests what is missing from the customer and drafts a recommendation. An analyst decides the outcome, and any change to risk rating or the relationship is approved by a person.
What is a trigger-event review, and who owns it?
Customer due diligence must stay current. Periodic reviews refresh files on a schedule set by risk; trigger-event reviews refresh a file because something has happened that may change the risk: a change of ownership or control, a new high-risk product, activity out of line with the profile, adverse media, a sanctions or PEP hit, a move to a higher-risk country, or a document expiring. FATF Recommendations expect due diligence to be ongoing and risk-based, and most regulators expect firms to define their triggers.
KYC operations usually run the reviews, under a policy owned by the MLRO. The problem in most firms is detection: triggers sit in different systems, and nobody connects a change of director at the company registry with the customer file. An agent watching every feed solves that.
What are the steps?
- Person, MLRO: approves the trigger list, each with its source, its threshold and the review depth it requires.
- Agent, depth 1: monitors the sources. Customer data changes, transaction monitoring outcomes, screening results, registry updates, document expiry dates, and customer contact that mentions a change.
- Agent, depth 3, within bounds: opens the review case when a trigger fires, with the trigger, its source and the required review scope.
- Agent, depth 1: refreshes the file. Re-runs screening, pulls registry data, checks ownership and control, and compares the profile with recent activity.
- Agent, depth 2: requests missing information from the customer using approved templates; the chase follows the approach in collecting missing KYC documents.
- Agent, depth 2: drafts the review. What triggered it, what changed, evidence gathered, gaps, and a proposed outcome: no change, update profile, re-rate risk, enhanced due diligence, or escalate.
- Person, KYC analyst: decides. Accepts or changes the outcome.
- Person, senior approver: approves re-ratings, EDD and exits. The re-rating itself follows customer risk rating reviews.
- Agent, depth 1: records the outcome and sets the next periodic review date accordingly.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Trigger list | Nothing | None | MLRO approves |
| Monitor | Watches all trigger sources | 1 | None |
| Open | Opens the review case | 3 | Defining scope rules |
| Refresh | Rescreens and pulls records | 1 | None |
| Request | Sends approved requests | 2 | Replies needing judgement |
| Draft | Proposes outcome with evidence | 2 | The analyst's decision |
| Approve | Nothing | None | Re-rating, EDD, exit |
| Record | Updates file and next date | 1 | Confirming |
Which controls apply, and what evidence does each leave?
Trigger list under change control. The agent opens reviews only for listed triggers. Evidence: each review names its trigger and the list version.
Detection time recorded. When the event happened, when the source recorded it, and when the review opened. Evidence: timing a supervisor can test.
Refreshed data marked by provenance. Registry data, screening results and customer statements carry different weight. Evidence: each fact in the review shows its source.
Decision and approval separated. The analyst decides the outcome; re-ratings and exits need a second approver. Evidence: two names on consequential outcomes.
Next review date recalculated. Evidence: the schedule reflects the new risk rating, so a re-rated customer is not left on the old cycle.
What should you measure?
- Time from event to review opened, by trigger type. This is the main reason for using an agent.
- Reviews opened that analysts closed as not needed, which shows whether triggers are too sensitive.
- Events found later that should have triggered a review, from audit or investigations.
- Reviews completed within your internal deadline.
- Outcomes by trigger: which triggers actually lead to re-ratings. Use this to refine the list.
Where does it usually go wrong?
Triggers defined vaguely. "Significant change in activity" cannot be monitored. Each trigger needs a measurable definition and a source.
Reviews that duplicate. One event fires several triggers and opens several reviews. The agent should merge them into one case with all triggers listed.
Periodic and trigger reviews out of step. A trigger review that refreshes the whole file should reset the periodic date; one that refreshes only part should not. The KYC refresh checklist for agent-assisted reviews sets out what counts as a full refresh.
Triggers from the customer conversation missed. Customers often mention changes in passing: a new job abroad, a sale of the business, a new partner on the account. These never reach a data field. The agent should read service conversations for statements that match a trigger, record them as declared, and open the review on that basis.
Backlogs hidden by automation. Detecting triggers faster creates more reviews. If analyst capacity does not change, reviews open quickly and then sit. Report open reviews by age alongside detection time, so that faster detection is not mistaken for faster reviews.
Customer contact that reveals the reason. A request for information after an adverse media hit must not tip off the customer about any suspicion. Use neutral, approved wording.
Certification triggers forgotten. Some events should also trigger a fresh look at what agents may do for that customer; see the re-certification trigger checklist.
The stance on compliance agents generally is in AI compliance agents.
Questions people ask
Can the agent update the customer's profile directly?
It can update factual fields from signed sources within approved rules, such as a registered address change from the registry. Anything that changes the risk view goes through the analyst.
Which triggers matter most?
Those your risk assessment says matter most for your business. Ownership and control changes, screening hits and activity outside the profile are common to most firms.
Does every trigger need a full review?
No. The trigger list should set the review depth for each trigger. A document expiry may need only a replacement; a change of control needs a full ownership review.