TABLE OF CONTENTS


Summary


A CDD refresh is the periodic re-verification of a client you've already onboarded. First AML tracks when each client is next due, raises an alert ahead of that date, and records every change to the date in the profile's activity log.


You'll find each client's refresh status and due date on their profile and in the Profiles list. Alerts appear on the Alerts page under CDD refresh.


Before you start

  • CDD refresh is switched on for your account
  • Only Compliance Admins can configure CDD refresh settings, including who receives new alerts.
  • Only Compliance Admins and Compliance Office Admins can assign alerts.
  • CDD refresh is off by default for every risk level until a Compliance Admin turns it on.


Set up CDD refresh

Set review periods and reminders

  1. Go to Settings › Ongoing.
  2. In the CDD refresh section, open the Alert periods tab.
  3. Choose an office, or leave it on the default to apply the settings to all offices.
  4. For each risk level (Default alert period, Low risk, Medium risk, High risk):
    1. Turn on Re-verification alerts.
    2. Set Re-verification due every, for example 12 months.
    3. Set Trigger alert (before due date), for example 1 month.
  5. Click Save.


Default alert period applies to individuals and entities that haven't had a client risk assessment. Offices without their own settings use the account-level settings.


For example, you could set High risk clients in your Sydney office to be refreshed every 6 months, with an alert 1 month before.


Choose who receives new alerts


Set default recipients so new CDD refresh alerts arrive already assigned.

  1. Go to Settings › Ongoing.
  2. In the CDD refresh section, open the Assignment tab.
  3. Choose an Office, or Default to set recipients for every office without its own settings.
  4. Under Roles and case assignees, choose any of:
    • A role, such as Compliance Office Admin.
    • Latest case assignees: the people assigned to the client's most recent case.
    • Original case assignees: the people assigned to the case where the client was first verified.
  5. Under Platform users, add specific people if needed.
  6. Click Save.


If none of the recipients can action the alert, it's assigned to the office's Compliance Office Admins, or to Compliance Admins if there aren't any.


Who gets a CDD refresh alert


A client joins the CDD refresh schedule when they appear in a case as the root individual or root entity and are marked as Pass. The date they're passed becomes their last verified date, and their first due date is worked out from it. Until then, their status is Not scheduled.


Alerts are raised per profile, not per case.

  • An individual who requires CDD and isn't connected to an entity in the case is a root individual, so they get their own refresh date.
  • For entity profiles, only the root entity has a refresh date. Officers, shareholders and other related parties don't get their own alert.
  • Refresh dates belong to the profile, so a client verified across several cases still has one refresh date.


For example, if you verify a company with a trust as a shareholder, you'll see one alert for the company and none for the trust or its individuals. Three buyers verified in the same case each get their own date.


CDD refresh statuses


Every profile has a CDD refresh status:

  • Scheduled: a due date is set from the review period for the profile's risk level.
  • Not scheduled: CDD refresh is on for this risk level, but the client hasn't yet been passed as the root of a case. The schedule starts once they are.
  • Paused: the profile is inactive. The dates are kept, but no alert is raised.
  • Off: CDD refresh is turned off for this risk level.


If a due date has been set by hand or a review has been skipped, you'll also see an Overridden tag next to the date.


To find clients who aren't in the refresh cycle, filter the Profiles list by CDD refresh. Learn more in Navigating the profiles page.


How the due date is worked out


The due date is the profile's last verified date plus the review period for their risk level. The alert appears ahead of the due date, based on the reminder you've set.

Due dates are calendar dates. Alerts are raised against today's date in your account's country.


What moves the due date


Once the schedule has started, only a real re-verification moves a client's due date. Normal case activity no longer changes it.



If the client's risk level changes, in any case, the due date is recalculated using the review period for the new risk level. A due date that was set by hand stays as it is.


Inactive and merged profiles

  • Setting a profile to Inactive pauses its refresh. Any open alert is closed, and the dates are kept. Setting the profile back to Active resumes the schedule. If the reminder date has already passed, a new alert is raised within a few minutes.
  • When you merge two profiles, the merged profile keeps the refresh dates of the higher-risk profile.


Working with CDD refresh alerts


From the Alerts page you can:


CDD refresh alerts can't be dismissed. If a client doesn't need a refresh this cycle, use Skip this review instead.



Assign CDD refresh alerts


Assigning an alert makes it clear who owns the refresh. You can assign alerts one at a time or in bulk. To have new alerts arrive already assigned, see Choose who receives new alerts below.


You can assign an alert to any user who can action CDD refresh and has access to the profile's office.


Assign one alert

  1. Go to Alerts › CDD refresh.
  2. In the Assigned to column, select one or more users.



Assign alerts in bulk

  1. Select the alerts you want to assign.
  2. Click Assign.
  3. Search for and select the Assignees.
  4. Click Assign.


Current assignees stay assigned. The list only shows people with access to every selected office. If an alert can't be assigned, it's skipped, and you'll see a message with the reason after you click Assign.



Alert assignees and case assignees


An alert's assignees are separate from the assignees of the CDD refresh case. You can still change the alert's assignees after the case is created, and changing one doesn't change the other.


Notifications


When you're assigned a CDD refresh alert, you'll get a CDD refresh alert assigned to you notification in the platform. Selecting it opens the Alerts page filtered to alerts assigned to you.


A Compliance Admin can also turn on email for this notification under Settings › Notifications. See Setting up notifications.



Find alerts by assignee


On the Alerts page, use the Assigned user filter to show alerts Assigned to me, Unassigned, or assigned to a specific person.


Assignment changes are recorded in the profile's activity log.


Use compliance rules to guide the refresh


Apply outcomes to Compliance Rules

You can use compliance rules to help your users know exactly what is needed to complete a CDD refresh on a client or individual. When a CDD refresh alert has been triggered and a user creates a CDD refresh case, these rules provide a guide as to what is required, based on conditions that align with your compliance program, e.g. a high risk or public company. 


You can then choose from a selection of outcomes to specify the actions you expect your users to follow. Examples of outcomes include adding or re-completing requirements, or completing a new verification to a desired VIC level (the specific verification configuration used to run identity, screening, and biometric checks, for example "KYC + ID anti-tampering + biometrics").


Some examples of these actions are:

  • Re-running identity verifications.
  • Triggering new screenings.
  • Re-sending forms or requirements to the client.



Check what’s needed for CDD refresh


If an individual or entity is pulled into a new case as part of a KYC refresh, and compliance rules have been configured, then previous completed requirements will be set back to in progress. If a requirement has never been completed for this individual or entity, a new requirement will be added to the CDD refresh case. 


This ensures users can easily check exactly what is needed to complete the CDD refresh case based on your compliance programme. 


You’ll also be able to see why the requirement is visible in this case. This helps users and reviewers understand whether the action was needed as part of a compliance rule, or if it was just retrieved from the individual or entities profile.