A KYB refresh is the re-verification of an existing business customer's file: its legal status, ownership, control, business activity and risk rating. The goal is that what the institution has on record still describes the business as it is today, not as it was at onboarding.
Why it matters in KYB review
Businesses change after onboarding. Owners sell stakes, CEOs leave, companies fall out of good standing, and a software company can drift into payment processing. A file that was accurate on day one can become wrong without anyone noticing. US bank AML programs must include ongoing monitoring to, "on a risk basis, maintain and update customer information," and the rule says customer information includes beneficial ownership of legal entity customers (31 CFR 1020.210).
In February 2026 FinCEN changed when beneficial owners must be re-identified. Its exceptive relief order (FIN-2026-R001) lets covered institutions identify and verify beneficial owners (1) when a legal entity customer first opens an account, (2) when the institution "has knowledge of facts that would reasonably call into question the reliability" of the information it already holds, and (3) as needed under its risk-based ongoing due diligence procedures. The order explicitly keeps all other AML/CFT obligations in place. The practical effect is to move refresh work away from each new account and toward events and risk.
What an analyst checks
- Status. Is the entity still active and in good standing? See certificate of good standing.
- Ownership and control. Any change in beneficial owners or the control person since the last review, and the evidence for it.
- Activity versus profile. Are volumes, counterparties, countries and products in line with the declared business? A large gap is a refresh trigger in itself.
- Screening. Fresh sanctions, PEP and adverse media checks on the entity and every related person.
- Documents on file. Anything past your freshness policy, such as old status certificates or expired IDs.
- Risk rating. Recalculate it, and record why it moved or did not.
Typical triggers: a scheduled date set by risk tier, a screening hit, a transaction monitoring alert, a registry change (officers, name, status), a customer-reported change, or a request for a new product with higher risk.
Common pitfalls
- Refreshing by calendar only. Waiting three years to notice a change of ownership the registry showed last month.
- Re-collecting everything. Ask the customer only for what changed or is missing. Re-requesting a full onboarding pack frustrates good customers.
- Closing the refresh without updating the risk rating. The point is a current profile, not a new date stamp.
Related terms
Periodic review (perpetual KYB), request for information (RFI), evidence packet, 25% ownership threshold.
How Sweat AI fits
Refresh backlogs build up quietly behind onboarding. Sweat AI is an AI-native BPO for banks and fintechs, and its analysts can work refresh cases alongside new applications and return each with the changes found, the evidence and a recommendation. See KYB review or neobanks and BaaS.
Questions
Does opening a second account trigger a KYB refresh?
Not automatically for US covered institutions since February 2026. FinCEN's exceptive relief order FIN-2026-R001 lets them identify and verify beneficial owners when the customer first opens an account, and again only when facts call the earlier information into question or their risk-based procedures require it.
Is a KYB refresh the same as periodic review?
They overlap. Periodic review is the scheduled program; a refresh is the act of re-verifying a customer's file, whether it comes from the schedule or from an event.