Earlier this year, the government’s Fraud Strategy 2026-2029 cited effective Know Your Customer (KYC) procedures as vital for cutting off fraud avenues enabled by new technologies.

Capgemini has some ideas. Its February report Reimagining KYC calls for a shift to a ‘perpetual KYC’ (pKYC) approach, highlighting flaws in the current model. For example, periodic review cycles that ignore real-world risk timing, fragmentary data undermining identity records’ authority and “excessive, repetitive outreach” to customers.

With those issues in mind, Capgemini urges corporates to embrace three benefits of pKYC:

• data modernisation to provide a single source of truth;
• constant, automated monitoring to pick up risk signals as soon as they emerge; and
• continuous risk analysis.

Importantly, pKYC advocates include firms such as PwC, KMPG and Moody’s, suggesting that it is the future of customer authentication. Is that the case?

Changing profiles

For Phil Cotter, CEO at anti-money laundering (AML) solutions provider SmartSearch, it is clear why traditional KYC’s viability is in the spotlight. “The UK has a serious, growing fraud problem that now costs households around £1.8bn a year,” he says. “Identity verification is central, here. Criminals are using increasingly sophisticated methods, including synthetic identities and artificial intelligence (AI) deepfakes, to bypass traditional checks.”

Traditional KYC, he notes, was designed for a slower-moving risk environment. For example, most accountancy firms would verify identity at the onboarding stage, conduct annual reviews and assume that, in between, clients’ risk profiles remained unchanged. Now, profiles are changing constantly.

“Someone who was considered low risk 12 or 18 months ago may now appear on sanctions lists, become politically exposed or have new ownership links that materially alter their risk profile,” Cotter says. “If you're only checking that profile annually, you’re blind to those changes for up to 364 days.”

Nick Henderson-Mayo, Head of Compliance at VinciWorks – a provider of compliance-related e-learning tools – agrees: “For regulated businesses, traditional KYC’s real weakness is often not the initial check. It’s what happens afterwards. Adverse media emerges; source-of-funds questions grow more complex. If those changes are managed via spreadsheets, inboxes and manual reminders, the risk is that important reviews are missed, or that the audit trail is incomplete.”

Exploiting complexity

In Henderson-Mayo’s view, KYC in 2026 is about harnessing a continuous, end-to-end AML workflow that covers client onboarding, customer due diligence (CDD), Know Your Business screening, source-of-funds and wealth analysis, risk scoring, scheduled reviews and audit evidence. “Firms will be able to show not just that checks were done – but why a decision was made, which risk factors were considered and when the file was last reviewed,” he says.

Cotter believes that pKYC is “absolutely the right direction.” He cites his firm’s 2026 Compliance Report, which surveyed 1,000 compliance decision-makers. More than half (54%) of those surveyed still conduct manual identity checks. At the same time, 24% identified AI deepfakes as their biggest fraud risk. “Meanwhile, 52% of firms struggled to verify beneficial ownership structures – precisely the type of complexity that criminals exploit.”

The report also found that 87% of businesses would sever ties with a partner following a single compliance breach. Cotter says: “Alongside Companies House changes, reforms from the Economic Crime and Corporate Transparency Act are increasing expectations around transparency. But if you can't verify who actually owns and controls the entities you're dealing with, you're building compliance on sand.”

Standard KYC may still be enough for accountancy firms

ICAEW Head of AML and Operations, Professional Standards, Michelle Giddings sounds a note of caution. In her view, while pKYC could be a suitable model for financial institutions, it may not make a good fit for the accounting sector.

She explains: “Periodic KYC isn’t broken for the accountancy sector and, particularly for those firms with a client base that they know well and correspond with regularly. Many accountancy firms do not perform services for their clients every single day, in the same way that banks process transactions. Each time an accountant works on a client, which could be monthly or annually, they can review the CDD they hold on file to check that there have been no changes and reviewing KYC simply becomes part of the conversation of doing business.”

However, Giddings goes on to say that for some firms, pKYC may have a role to play if the firm has a very large client base or where compliance functions are centralised. “It can help to minimise the risk that a change at the client is missed. Firms may choose to make this change to improve efficiency and make use of all the data available. But it is important to note that we rarely find that a firm has missed a key piece of information about a client, which leads to an increase in that client’s risk rating.”

Giddings is concerned that some could push for the inclusion of pKYC within UK AML regulations. Then, every sole practitioner would be expected to run a methodology that is completely disproportionate to the nature of their practice.

She warns that just because a firm has pKYC in place, doesn’t mean that you automatically know what they are up to. “In our AML training film All Too Familiar, many of the red flags related to the information the firm received during the course of the engagement, and featured within the payroll data and within the explanations that management had provided,” she says. “The details the firm had on who owned the business at issue, and its structure, were all legitimate. It is only adverse news articles that finally suggest the owner may be involved in criminality. But many of the red flags could not have been uncovered by KYC.”