ENAnti-money laundering · Ongoing monitoring
Customer due diligence does not end with the signature. It starts there.
Of the four measures in article 17 of D.Lgs. 231/2007, ongoing monitoring is the one that lasts as long as the relationship. The risk profile fixed at opening goes out of date: the shareholders, the beneficial owner, the registered office, the status in the Register change, a name appears on a list or a protesto. Below is what the law requires to be done over time, the three stages of money laundering that monitoring tries to intercept, the recurring patterns, linked transactions under the new European rules, the anomaly signals that can be read in the data on the subject, the suspicious transaction report and record keeping.
What the law requires, over time
Four obligations that do not end at opening.
Article 17, paragraph 1, letter d · Article 19, paragraph 1, letter c
Ongoing monitoring of the continuing relationship or professional service.
How it applies. Analysis of the operations carried out during the relationship, to check that they are consistent with knowledge of the customer, its activity and its risk profile, including as regards the origin of funds; verification and updating of the data and information acquired, at a frequency proportionate to the risk. Checks are stepped up when the profile rises.
Where Complify does it. The analysis of transactions stays in the bank's systems. Complify watches the subject: every day the changes on monitored customers arrive, and ComplifyADV reopens the case when a change matters. On the platform, monitoring re-reads the information at the frequency you choose.
Article 35 · Article 39
The suspicious transaction report to the UIF, without delay, and the prohibition on disclosing it.
How it applies. A report is made when it is known, suspected or there are reasonable grounds to suspect that money laundering or terrorist financing transactions are under way or have been carried out or attempted, or that the funds come from criminal activity. Suspicion is inferred from the characteristics, size and nature of the transaction and from any other known circumstance, also thanks to the UIF indicators of anomaly. Where possible, before carrying out the transaction. Nothing is said to the customer or to third parties (article 39).
Where Complify does it. The report is yours, and stays yours. Complify delivers what justifies it: the subject's file at the date, the chain of control, the adverse findings and the matches on the lists with their source, and the ComplifyADV case with every step recorded, to attach to the report file.
Article 31
Keep documents, data and information for ten years.
How it applies. From the end of the continuing relationship, the professional service or the carrying out of the occasional transaction, so that the transaction, the customer, the beneficial owner and the checks made can be reconstructed, and requests from the authorities answered without delay. The Bank of Italy's 2020 Provisions say how.
Where Complify does it. Every document is fixed to the date of the data and states it; the archive belongs to the organisation and what has been bought can be read again as it was, at no further charge. The ComplifyADV case keeps the history, including what was done outside the platform, and inspectors retrace it step by step.
Article 42
Refrain, when customer due diligence cannot be completed.
How it applies. If the customer or the beneficial owner cannot be identified, or the purpose and nature of the relationship understood, the relationship is not entered into, the transaction is not carried out, the existing relationship is ended, and whether to report is assessed. This also holds over time: a chain that closes after opening leads back to article 42.
Where Complify does it. When the beneficial owner cannot be found, the document says so and writes why, at the level where the chain broke; it does not replace the owner with a convenient name. The decision stays with you, with the reasoning already written.
What is looked for
The three stages of money laundering, and where they show in the subject's data.
Money laundering has a recurring shape: illicit money enters the financial system, is moved away from its origin through several steps, and re-enters the economy as clean wealth. Each stage leaves different signs, and not all of them are in account movements: many are in the company's registry data, its shareholding structure and its chain of control, which is what Complify reads.
- Placement. Young companies with minimum capital and inconsistent volumes, cash-intensive activities, shareholders who change right after incorporation.
- Layering. Chains that lengthen and cross countries at risk, nominee and trust companies (fiduciarie) that appear in the shareholding structure, transfers of registered office, rotating positions, companies with no employees or structure.
- Integration. Acquisitions of real estate and shareholdings out of scale with the financial statements, sudden changes in assets, entry into regulated sectors.
The types
Eight recurring patterns, and the sign they leave before the movements.
The authorities and the anti-money laundering literature always describe the same patterns. Some are visible only in transactions, and that is where the bank's monitoring looks for them; many also leave a trace in the subject's data, which can be read even before the relationship is opened.
01
Structuring
An amount split into many transactions below the threshold, on nearby days. It shows in the movements, not in the registry data: it is the territory of transaction monitoring.
02
Layering
The money passes through several accounts and companies to lose its trail. In the subject's data: long chains of control, countries at risk, trust companies (fiduciarie) in the shareholding structure.
03
Pass-through accounts
A person lends their account to pass other people's funds through. In the data: a profile that does not justify the volumes, no activity that explains them.
04
Funnel accounts
Deposits from many places into a single account, then withdrawn or transferred. In the data: the same person recurring as shareholder or director in several customers of the portfolio.
05
Circular transactions
The funds return to the starting point after a few steps. In the data: companies holding shares in each other, the same names on both sides.
06
Shell companies
Companies with no structure, used only to pass funds through. In the data: no employees, missing or empty financial statements, registered office at a domiciliation agent, several companies on the same street, recent incorporation, minimum capital.
07
Trade-based money laundering
Invoices inflated or deflated to move value across borders. In the data: a declared activity that does not explain the flows, counterparties and subsidiaries in countries at risk.
08
Crypto-assets
Funds moved between several wallets and platforms before returning to currency. It shows in the movements; in the subject's data, what remains is the declared activity and the countries.
09
Origin of funds and of wealth
They are two different questions: where the money in this transaction comes from, and where the customer's wealth comes from. Financial statements, shareholdings and real estate help to answer the second.
A pattern is a hypothesis, not proof. It is read together with the customer's profile, the origin of funds and the economic rationale of the transaction; several signals together lead to enhanced verification and, if the suspicion remains, to a report.
From Regulation (EU) 2024/1624 · article 19
Linked transactions: the fixed seven-day window will no longer be enough.
Today a split transaction is reconstructed over seven days and the threshold for occasional transactions is 15,000 euros (D.Lgs. 231/2007, articles 1 and 17). Under the European regulation the general threshold falls to 10,000 euros, and the AMLA technical standards on article 19, paragraph 9 say how to recognise linked transactions: through an overall assessment, in which no single criterion decides alone.
The criteria
People, links, common features, time.
- The same people, who carry out or receive transactions also through counters, agents or different channels.
- People linked to each other: family members, shareholders, those acting in concert, companies in the same group or with the same beneficial owner.
- Common features: the same purchase, the same digital infrastructure, common intermediaries, transactions that depend on one another.
- A short period of time, measured by the nature of the activity; one month for currency exchange, money transfer and certain crypto-asset services.
Relationship or occasional transaction
Repetition, duration, continuous access.
Business relationship and occasional transaction are mutually exclusive, and the difference lies in duration, repetition and continuous access to services. For currency exchange, money transfer and certain crypto-asset services, three or more transactions in twelve months indicate a business relationship. Before counting, however, one must recognise that it is the same person.
With the data you already have
No new data gathering just to link.
The technical standards do not ask for new information to be gathered just to find connections: the information already available is used. The criterion produces a candidate, the decision remains an assessment, and who decides, with what reasoning, is kept in writing.
Where Complify helps
Who is linked to whom, in your archive.
Monitoring of transactions stays in your own systems. Complify brings the other ingredient: from the files already bought it shows the links between the companies and people in your archive, including indirect ones, through shareholders, directors, beneficial owners and companies in the same group, and makes them explorable on a map. In this way two customers that seem unrelated are recognised as part of the same group, or as having the same people behind them.
Sources. Regulation (EU) 2024/1624, article 19; D.Lgs. 231/2007, articles 1 and 17; AMLA, final report on the regulatory technical standards under article 19, paragraph 9, of Regulation (EU) 2024/1624, 30 September 2026, and press release of 1 October 2026. Checked on 20 October 2026. The technical standards are awaiting adoption by the Commission, may change and apply six months after entry into force.
Indicators of anomaly
The signals that reopen a case.
The UIF indicators of anomaly (measure of 12 May 2023, in force from 1 January 2024) are the tool with which the law helps to recognise suspicion. One part concerns transactions, and the bank reads it in its own systems; one part concerns the subject and its behaviour, and is read in the data that Complify watches. These are the signals that, when they arrive, reopen the case in ComplifyADV.
01
Beneficial owner changed
A new person crosses the threshold, or one drops out; the chain of control lengthens or changes country. The verification of the owner is redone under the criteria of article 20, and from 2027 of the AMLR.
02
Politically exposed person
A shareholder, an officer or a beneficial owner takes up a position, or left one less than a year ago: the enhanced verification of article 24, paragraph 5 is triggered, with the authorisation it requires.
03
Lists and adverse media
A new match on sanctions lists, where freezing allows no assessment, or in adverse media, which on the other hand is weighed. The match comes with its source and date.
04
Adverse records
Protesti, pregiudizievoli and insolvency proceedings on the company, its shareholders or its officers. They weigh on the profile according to who suffered them: the company more than the officers, the officers more than the shareholders.
05
Status, office, activity
Dissolution, liquidation, striking off, transfer of the registered office, change of activity or legal form. These are the facts that annex 2 of the decree names among the high-risk factors.
06
Shareholders, positions, assets
Shareholding structure and management body that change, especially several times in a short time; changes in assets and real estate out of scale with the filed financial statements.
How often a customer is reviewed is set by the risk profile, and from 2027 Regulation (EU) 2024/1624 sets the ceilings: at least annually for high risk, at least every five years for the others (article 26). A signal does not wait for the deadline.
Suspicious transaction report
The SOS: what it requires, and what it is called elsewhere.
The suspicious transaction report of article 35 is the outcome of ongoing monitoring. Anyone working with foreign groups meets it under other names: in the United Kingdom and in most FATF countries it is the STR, Suspicious Transaction Report, tied to a transaction; in the United States it is the SAR, Suspicious Activity Report, which also covers behaviour without a specific transaction. The Italian SOS includes both: transactions carried out, attempted and in progress are reported, and suspicion is also inferred from the customer's behaviour.
When
Without delay.
As soon as the suspicion forms and, where possible, before carrying out the transaction. Delay is itself a breach; failure to report is penalised under article 58.
What
The suspicion, reasoned.
The characteristics, size and nature of the transaction, the customer's economic capacity and activity, the known circumstances, with the recurring indicators of anomaly. Proof of the offence is not needed: a reasonable, documented ground is.
Who must not be told
To the customer and to third parties.
Article 39 prohibits disclosing that a report has been made; breach is a criminal offence (article 55). The confidentiality of the reporting person is protected by law, and the file that justifies the report must be kept with the same care.
Where the law provides for it, alongside the suspicious transaction report (STR) there is the objective communication of article 47, which does not require a suspicion: it is transmitted by thresholds and types set by the UIF.
Where Complify does it
Monitoring of the subject, in two forms.
In the case: ComplifyADV
- Every day the changes on monitored customers arrive: beneficial owner, politically exposed persons, activity, chamber of commerce status, registered office, shareholders, lists, sanctions, adverse media, adverse records, chain of control, changes in assets.
- A change that matters reopens the case, at the risk level that applies to it, and surveillance follows the level.
- The history stays in the case, including what is done outside the platform; inspectors retrace it.
On the file: customer monitoring
- On the platform, monitoring re-reads the subject's information at the frequency you choose, and produces a new, dated document alongside the previous one.
- The risk assessment is not updated by itself in the old document: it is fixed to the date of the data, and for a more recent assessment there are repurchase and monitoring. This is how the document on which you based your decision stays the same.
- Portfolio analysis ranks customers by risk and shows where a subject carries findings in several files and which subjects in the archive share the same street in the same municipality: domiciliation arrangements, shell companies, networks of businesses in the same building.
For the report and for the inspection
- The file at the date, the chain of control with the calculation, the matches with their source: what justifies a report and what an inspector asks for first.
- The consulting supports the anti-money laundering function in investigating the report, in second-line controls and in the review.
Sources. Legislative Decree no. 231 of 21 November 2007, articles 17, 19, 24, 31, 35, 39, 42, 47, 55 and 58 (Normattiva); UIF, indicators of anomaly, measure of 12 May 2023; Bank of Italy, Provisions on the retention and making available of documents, data and information, 2020; Regulation (EU) 2024/1624, article 26 (Official Journal of the European Union). Checked on 9 October 2026. This page offers orientation; it does not replace the official texts or an opinion on your case.
Frequently asked questions
The questions we are asked on this topic.
What is ongoing monitoring and where does the law require it?
It is the fourth measure of customer due diligence: article 17, paragraph 1, letter d, of D.Lgs. 231/2007 requires ongoing monitoring of the relationship throughout its duration, and article 19, paragraph 1, letter c, describes it: analysis of transactions, consistency with the customer's profile and with the origin of funds, verification and updating of the data and information acquired. The frequency follows the risk: the higher the profile, the closer the review.
When is a customer due diligence case reopened?
When something that matters changes: the beneficial owner, the status of politically exposed person, the status in the Register, the registered office, the shareholders, the positions, a new finding on the lists or among the adverse records, a change in assets. And when the periodic review set by the risk profile falls due. Regulation (EU) 2024/1624 sets the ceilings: at least annually for relationships at high risk, at least every five years for the others (article 26). ComplifyADV receives the changes on monitored customers every day and reopens the case when one of them occurs.
What are the three stages of money laundering and why do they matter in monitoring?
Placement, when illicit money enters the financial system; layering, when it is passed through several transactions, companies and countries to distance it from its origin; integration, when it re-enters the economy as an investment or as assets. The UIF indicators of anomaly (measure of 12 May 2023, in force from 1 January 2024) describe the signals of each stage, and monitoring looks for them in the customer's data: structures that change often, chains that lengthen, companies with no structure, countries at risk.
What does the law require of a suspicious transaction report?
Article 35 of D.Lgs. 231/2007 requires reporting to the UIF without delay, where possible before carrying out the transaction, any transaction where it is known, suspected or there are reasonable grounds to suspect that the funds come from criminal activity. Article 39 prohibits letting the customer or third parties know. Article 31 requires documents, data and information to be kept for ten years. The Italian SOS corresponds to what other jurisdictions call an STR or SAR: the substance is the same, a reasoned and documented suspicion.
Complify Yourself!
Want to see a case that reopens by itself when the beneficial owner changes? Ask for a ComplifyADV demo.