KYB Doesn’t Stop at Onboarding: What Regulators Expect After a Merchant Is Approved

Merchant information changes after approval. Here is what four regulatory frameworks across the EU, UK and Singapore expect, and how continuous monitoring helps payment and e-commerce teams keep merchant and seller information accurate between reviews.

Key takeaways

• Onboarding is a snapshot. Merchant and seller information can change within days of approval.
• Regulators expect information to stay current. EU and UK AML frameworks call for ongoing monitoring and up-to-date due diligence, while the DSA more requires marketplaces to act when trader information appears inaccurate, incomplete or out of date.
• Checking more often isn’t enough. Shorter review cycles add cost and noise, and still leave gaps.
• Change-driven monitoring closes the gap. Continuous monitoring flags registry changes between reviews, so teams act when it matters.

A merchant passes KYB. The registry record checks out, the directors are verified, the beneficial owners are identified and the risk is assessed. The account goes live. 

A few weeks later: Officers resign. Ownership structures shift. Registered details are updated. Or legal status can change entirely. The merchant you approved is no longer the merchant you are dealing with. For marketplaces, the same is true of the business sellers trading on the platform. 

Onboarding Is a Snapshot. The Relationship Is Not.

Most KYB programmes were designed to verify at a point in time: this company exists, these are its directors and shareholders, this is the ultimate beneficial owner, this is the assessed risk. Periodic KYB then refreshes that position on a fixed calendar.  

Early findings from AsiaVerify’s 2026 APAC company monitoring research suggest corporate change is more frequent than many compliance programmes assume. The research covers 620 companies across Australia, China, Hong Kong, Japan, New Zealand, Taiwan and Thailand. 

Within roughly two months, 92 of the 620 companies (14.8%, or nearly one in seven) recorded at least one corporate change. Changes were found in all seven jurisdictions. The first appeared within two days in New Zealand, Thailand and Hong Kong. The average time to first detected change was about six days. 

This is the thinking behind perpetual monitoring: treating verification not as a one-off event at onboarding, but as something that needs to remain valid for as long as the relationship lasts.

Regulatory Expectations on Maintaining Up-to-Date KYB Data

Across these four frameworks, the obligations differ.

• EU Anti-Money Laundering Regulation (AMLR). The new single rulebook, applying from July 2027, requires obliged entities, including payment institutions, to conduct ongoing monitoring of business relationships, keep customer information up to date, and review it when a customer’s relevant circumstances change.
• UK Money Laundering Regulations 2017. The UK regulations require ongoing monitoring of business relationships, including keeping the documents and information obtained for customer due diligence up to date. Due diligence must also be applied to existing customers when their relevant circumstances change.
• Singapore Payment Services Act and MAS AML/CFT requirements. Payment service providers licensed under the Payment Services Act are subject to MAS notices covering customer due diligence, the identification of beneficial owners, regular account reviews and ongoing monitoring throughout the business relationship.
• EU Digital Services Act (DSA). For online marketplaces, the DSA’s “Know Your Business Customer” provisions require platforms to obtain, and make best efforts to assess, certain information about traders (the business sellers on the platform) selling to EU consumers. Where that information appears inaccurate, incomplete or out of date, the platform must ask the trader to correct it.

Different regimes, supervisors and obligations, however, lead to a shared operational question: can you show that the business information you rely on is still accurate, and act when a relevant change comes to light? For a closer look at expectations across Asian markets, see Risk-Based KYB Monitoring: Meeting Regulatory Expectations in Asia. 

Why “Checking More Often” Isn’t the Whole Answer 

The natural response is to shorten the review cycle. That helps, but it does not close the gap.

• Cost scales with the portfolio. Every recheck costs analyst time and effort, whether or not anything has changed.
• Rechecks might find nothing. Repeating unchanged checks creates noise and pulls attention from the merchants and sellers that need a second look.
• A gap still remains. However short the cycle, a change can occur the day after a review and sit undetected until the next one.
• Cross-border adds complexity. Asian company registries differ in language, format and update cadence, which makes manual merchant monitoring across markets harder still.

What Continuous Monitoring Looks Like in Practice

Effective continuous monitoring does not replace onboarding or periodic re-KYB. It sits alongside them and fills the space between reviews. This is the gap Perpetual KYB is built to close.

• Monitor the source. Track official registry data, rather than relying on a record from the day the merchant or seller was approved.
• Know what changed, not just that something changed. Category-level signals across identity, address, business activity, officers, ownership, capital, status, annual return and other changes tell your team what kind of review is needed.
• Re-verify where it matters. Run a fresh report when a change is material, instead of re-verifying every account on a fixed cycle.
• Fit existing workflows. Receive monitoring results through API-led workflows that already support your KYB compliance processes.

Every organisation should be deliberate about which changes matter, how they will be identified and what happens when they occur. From Static to Smart looks at how cross-border verification is moving in this direction.

Three Questions Worth Asking

1. If a merchant’s or seller’s beneficial owner changed tomorrow, how long would it take us to find out? 
2. Can we evidence when our merchant and seller information was last confirmed against the official source? 
3. Is our analysts’ time going on genuine change events, or on rechecking merchants where nothing has changed? 

Close the Gap Between Verification and Review

AML regimes require ongoing monitoring and current customer information, while the DSA’s trader-traceability obligation requires action when information appears inaccurate, incomplete or out of date. AMLR Article 26 also requires customer information to be reviewed when relevant circumstances change – an obligation that depends on knowing the change occurred.  

For payment companies and marketplaces onboarding merchants and sellers across Asia, continuous monitoring of official registry data is one practical way to identify relevant changes without multiplying manual rechecks. 

Explore Perpetual KYB to see how change-driven monitoring helps payments and e-commerce teams keep business customer information current. See how it fits alongside your existing controls, or find out how AsiaVerify supports fintech and payments and e-commerce teams. If you’d like to talk about how this could work across your merchant or seller portfolio, please get in touch. 

This article is for general information only and does not constitute legal advice. Organisations should assess their specific obligations with their own legal and compliance advisers.

About the author 

Elizabeth Fitzell is Chief Operating Officer of AsiaVerify, based in Singapore, where she leads senior client relationships and regulatory oversight across Asia. She previously served as Managing Director, APAC at SterlingRISQ, leading a business of around 800 people. With more than 20 years’ experience in employee due diligence, she has led transformation and growth across industries and geographies, and follows regulatory change across Asia closely.