AML Trigger Events: What They Are and How to Respond

An AML trigger event is any change in a customer's circumstances, behaviour or risk profile that should make your firm revisit the due diligence it holds on that customer. When one occurs, you must decide whether to refresh CDD, apply enhanced due diligence (EDD), or escalate a suspicion to your nominated officer. This is often called an event-driven review.

What does the law say about trigger events?

The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR 2017) never use the phrase "trigger event". The obligation comes from several provisions read together:

• Regulation 27(8) requires CDD to be applied to existing customers at other appropriate times on a risk-sensitive basis, and when the firm becomes aware that circumstances relevant to the customer's risk assessment have changed.
• Regulation 27(9) lists factors to weigh when deciding whether to apply CDD to an existing customer, including indications that the identity of the customer or beneficial owner has changed, transactions that are not consistent with your knowledge of the customer, changes in the purpose or intended nature of the relationship, and any other matter that might affect your assessment of risk.
• Regulation 28(11) requires ongoing monitoring of every business relationship: scrutinising transactions to check they are consistent with your knowledge of the customer, their business and risk profile, and keeping CDD documents and information up to date.
• Regulation 33 requires EDD and enhanced ongoing monitoring where risk is high, including transactions that are unusually complex or large, show an unusual pattern, or have no apparent economic or legal purpose.
• Regulation 19(4) requires your policies to provide for identifying and scrutinising those unusual transactions, and for staff who know or suspect money laundering to follow the reporting provisions of the Proceeds of Crime Act 2002 (POCA).

The FCA's Financial Crime Guide reflects this. Under its money laundering theme (FCG 3.2), good practice includes a risk-based response after a monitoring event, with event-driven reviews, and reassessing risk where monitoring shows material changes to a customer's profile. Poor practice includes failing to consider changes in the nature of the relationship or expected activity.

The MLR do not prescribe a fixed review cycle. Your policy decides how often each risk band gets a periodic review. Trigger events are the second line of defence, catching changes between those scheduled reviews.

Periodic review, event-driven review and ongoing monitoring: when do you move between them?

A common question is when a financial institution should "move from periodic KYC reviews to ongoing monitoring". The honest answer is that you never move from one to the other. They run together:

• Ongoing monitoring under reg 28(11) applies to every relationship from day one. It is continuous.
• Periodic review is a scheduled refresh of CDD, set by your own risk-based policy. Higher-risk customers are normally reviewed more often.
• Event-driven review is an unscheduled refresh prompted by a trigger. It can bring a periodic review forward, widen it, or lead to EDD.

What changes over time is the mix. Firms with strong transaction monitoring and good data can lean more on event-driven reviews and lengthen the gaps between periodic ones. Firms with weaker data tend to need shorter periodic cycles. Either way, you must be able to show why your approach is proportionate to your own risk assessment.

What are typical AML trigger events?

Trigger events fall into three groups, which is a useful way to design your controls: what you learn internally, what you learn from outside, and what the client tells you. The table gives examples and a typical response. The examples are illustrations for your own risk assessment; the regulation reference shows where the legal hook sits.

Your list will differ with your sector. A payments firm, a wealth manager and a consumer credit lender see different patterns. The test is whether your list comes from your own business and customer risk assessment rather than a generic template.

What should happen when a trigger is detected?

1. Log the trigger with date, source and who noticed it. Triggers that are never recorded cannot be evidenced later.
2. Triage whether it is information that affects the risk rating, or something that might amount to suspicion. A clear route matters because the tests differ.
3. Refresh CDD proportionately. Identify and verify what has changed, and understand why. Do not re-run everything by default.
4. Reassess the risk rating and record the reason for the outcome, even if the rating stays the same. The FCA's guide flags firms that cannot evidence why customers are rated high, medium or low.
5. Decide on EDD where the new picture is high risk. Regulation 33 lists the circumstances, and reg 33(5) sets out optional measures such as additional independent sources, a better understanding of ownership and finances, and increased monitoring.
6. Escalate to the nominated officer where you know or suspect, or have reasonable grounds to know or suspect, money laundering. The nominated officer must consider the disclosure and decide whether it gives rise to knowledge or suspicion (MLR reg 21(5)).
7. Close the loop. Update the customer file, the monitoring parameters and, if a pattern is emerging, the firm-wide risk assessment.

Suspicious activity reports and tipping off

For firms in the regulated sector, POCA section 330 makes it an offence to fail to disclose where you know or suspect, or have reasonable grounds to know or suspect, that another person is engaged in money laundering, and the information came to you in the course of regulated-sector business. The disclosure must be made as soon as is practicable to the nominated officer or an authorised person.

At the same time, section 333A creates the tipping-off offences. In broad terms, it is an offence to disclose that a required report has been made, or that an investigation is being considered or carried out, where the disclosure is likely to prejudice an investigation. Staff therefore need to know how to continue the customer interaction naturally while the trigger is being assessed. Frontline scripts and clear escalation paths matter as much as the policy itself.

Training is part of your systems and controls. The FCA's guidance in SYSC 6.3.7G expects staff training on money laundering and an at-least-annual report from the MLRO to senior management on the effectiveness of controls.

How to make trigger events work in practice

• Define triggers by customer type. A corporate customer with a changing ownership chain needs different triggers from a retail customer with changing payment behaviour.
• Link triggers to your monitoring tools. If an alert fires but nothing prompts a CDD review, the control is not complete.
• Set service levels. State how quickly each trigger type must be triaged and who approves the outcome.
• Test the process. Sample closed alerts and check that the file shows what changed, what was done and why.
• Do not treat missing data as a pass. If a review cannot be completed because information is missing, record it as an open risk, not as a clear result.

How MEMA can help

MEMA helps MLROs and compliance teams design, test and evidence their transaction monitoring and CDD refresh processes. See our financial crime service, or try the financial crime assessment tool to see where your controls stand.