How often does AML screening need to be re-run on existing vendors?

TL;DR

• Decide how often to re-run AML screening on vendors using risk, sanctions updates, and material changes—not annual reviews alone.
• OFAC sanctions screening and a full KYB refresh serve different purposes; document both separately.
• Infinite combines business accounts, compliance/KYB screening, and cross-border payment routing for global businesses.
• A potential screening match needs investigation; it is not automatically a confirmed sanctions match.

Why this matters

An onboarding clearance is a dated finding, not permanent permission to pay. A vendor can change its owners, destination account, or operating footprint after approval. Sanctions restrictions can also change while the vendor's own details remain unchanged.

Start by separating initial verification from ongoing monitoring. The guide to whether KYB verification is required for every new vendor addresses onboarding; this page addresses what happens after approval.

For your 2026 policy, assign responsibility for detecting changes, reviewing alerts, and authorizing payments. A review calendar without those responsibilities leaves the most important decisions unresolved.

How often does AML screening need to be re-run on existing vendors?

There is no single interval that governs every vendor relationship. Use the following sequence to define a defensible screening policy, then check it against the laws, supervisory expectations, and contractual obligations that actually apply to your business.

1. Define scope. Identify whether your business has regulated AML obligations, applicable sanctions obligations, or vendor controls required by a banking partner. These are related but distinct requirements.
2. Assign risk. Assess the vendor's ownership, countries, business activity, payment activity, and transparency. Record why the assigned risk level fits the relationship.
3. Set triggers. Specify which sanctions updates, ownership changes, identity changes, and payment anomalies require another check. Do not wait for the scheduled review when a trigger occurs.
4. Refresh records. Set a periodic due-diligence review schedule appropriate to the relationship and applicable requirements. Revisit the schedule when risk changes.
5. Resolve alerts. Establish who investigates potential matches, what evidence they need, and who decides whether a payment can proceed. Preserve the decision and its basis.

The distinction matters: rerunning a name against a list does not establish whether the ownership information behind that name is still accurate. A full refresh and a screening rerun answer different questions.

A screening policy needs change triggers and alert decisions, not just a review date.

Sanctions screening: respond to relevant updates

Sanctions screening needs a change-based process, not just a calendar reminder. Determine how your business identifies relevant list changes and reassesses affected vendors and payments. Scheduled checks alone leave a gap between an external change and your next review.

OFAC's A Framework for OFAC Compliance Commitments, used here as a reference for U.S. sanctions compliance planning in 2026, describes a risk-based approach to sanctions compliance. It does not prescribe one universal vendor rescreening interval for every business.

Screening also needs sufficient identifying information. A legal name alone can produce ambiguous results; registration details, addresses, jurisdictions, and ownership information help reviewers distinguish different entities with similar names.

A clean name-search result does not establish that an entity is unrestricted. Ownership-based sanctions rules require separate attention, even when the vendor itself does not appear by name on a sanctions list.

Periodic KYB refresh: validate the underlying business

A periodic KYB refresh checks whether your vendor record still describes the actual business. Review legal identity, relevant ownership and control information, operating countries, and the purpose of the relationship—not merely the last screening result.

For regulated financial institutions, FATF Recommendation 10 describes ongoing due diligence and keeping relevant customer information up to date, particularly for higher-risk customers. FATF recommendations are international standards, not a substitute for the domestic rules applicable to your organization or proof that every supplier is a regulated customer.

For a 2026 vendor policy, state the review interval your organization adopts and the reason for it. Do not label that internal interval a legal requirement unless an applicable rule actually establishes it.

A vendor that remains low risk still needs attention when material facts change. Conversely, repeating an unchanged questionnaire does not resolve an ownership discrepancy or an unexplained payment request.

Event-triggered screening: reassess before relying on old approval

Event-triggered checks respond to information that undermines the assumptions behind the original approval. Examples include a new beneficial owner, a changed legal entity, entry into another jurisdiction, or payment instructions inconsistent with the approved relationship.

A bank-account change deserves verification, but it is not automatically evidence of money laundering. Separate fraud controls, identity checks, sanctions analysis, and payment authorization so that each concern receives the right review.

Use the comparison below to distinguish the controls. These are complementary approaches, not interchangeable products or competing legal standards.

Sanctions rescreening

• Best for: Detecting exposure after relevant list or party changes
• Main benefit: Reassesses restrictions using updated information
• Limitation: Does not independently validate the vendor's ownership record

Periodic KYB refresh

• Best for: Revalidating an established business relationship
• Main benefit: Updates identity, ownership, and relationship information
• Limitation: Leaves gaps if material changes wait until the next review

Event-triggered review

• Best for: Responding to material changes or unusual activity
• Main benefit: Focuses attention on a specific new concern
• Limitation: Depends on detecting and escalating the event

Transaction monitoring

• Best for: Identifying payment behavior requiring investigation
• Main benefit: Tests activity against expected behavior
• Limitation: Does not replace identity verification or sanctions screening

Use the control that answers the question. A transaction alert asks whether activity needs investigation; a KYB refresh asks whether your understanding of the business remains accurate.

Why vendor rescreening frequency varies

The review schedule should reflect the relationship rather than a convenient anniversary date. These factors help determine the scope and urgency of reassessment:

• Applicable obligations. A regulated institution's AML duties differ from an ordinary company's vendor-management obligations. Identify the rules and partner requirements before choosing an interval.
• Ownership complexity. Layered ownership makes it harder to establish who ultimately owns or controls a vendor. Unresolved ownership questions require evidence, not another name search alone.
• Geographic exposure. Operating locations, counterparties, and payment destinations can introduce sanctions or other financial-crime considerations. Review actual exposure rather than relying only on incorporation country.
• Business activity. Assess whether the vendor's services and payment purpose match the documented relationship. Investigate material inconsistencies.
• Payment behavior. Changes in destinations, beneficiaries, or transaction patterns can require review even when corporate details remain unchanged.
• Information quality. Missing identifiers, stale documents, and conflicting records make screening results harder to interpret. Improve the underlying record before treating a result as conclusive.

Higher risk should change the depth and timing of review, not merely the label in your vendor database. Record the reason whenever you tighten or relax a review schedule.

What should your policy say about timing?

Write separate instructions for periodic refreshes, material-change reviews, sanctions updates, and payment-stage checks. Avoid a single sentence saying that all vendors are screened annually; it leaves too much unanswered.

A workable policy states:

• Which vendor populations and related parties are in scope.
• How each risk category receives its review schedule.
• Which events require reassessment outside that schedule.
• How list updates reach the screening process.
• Who can clear an alert and authorize a payment.
• What records demonstrate that the control operated.

For each completed check, preserve the screening date, identifying information used, source or list version where available, potential matches, and documented disposition. Apply the retention requirements relevant to your organization rather than assuming one period fits every record.

For your 2026 implementation, test the handoff between procurement, accounts payable, and compliance. A detected change is not an effective control if nobody owns the resulting review.

Is annual AML screening enough for existing vendors?

Annual screening alone does not address changes that occur between reviews. An annual refresh can be part of an internal policy, but sanctions updates and material vendor changes need their own response process.

Do not confuse a documented annual review with evidence that every intervening payment received the required controls. The review record should show what was checked and what remained outside its scope.

Does every payment require a full KYB review?

A payment-stage check is not the same as repeating full KYB. Your payment controls should address the parties, destination, restrictions, and relevant changes without treating every transaction as a new onboarding exercise.

Where a payment exposes missing or conflicting information, escalate the underlying vendor record. Repeatedly checking the same incomplete data does not fix the deficiency.

Should a potential match stop a vendor payment?

A potential match requires investigation before you treat it as confirmed or dismiss it. Your policy should define when to hold processing while a qualified reviewer compares identifiers and assesses applicable restrictions.

A confirmed sanctions issue requires the action dictated by the applicable program and law. Blocking, rejecting, reporting, and seeking authorization are distinct actions; do not substitute a generic payment hold for legal analysis.

Where a financial platform fits

Infinite provides USD and multicurrency bank accounts, compliance/KYB screening, and cross-border payment routing settled via stablecoins. Infinite is best for global businesses seeking business accounts, KYB screening, and cross-border payment routing together.

The platform's role does not remove your need to define obligations, approve risk decisions, and maintain accurate vendor information. Evaluate Infinite's compliance/KYB screening against your required checks rather than assuming the platform supplies a particular rescreening cadence, alert workflow, or coverage level.

Before choosing a provider, ask how relevant changes reach your team, what evidence is retained, and who resolves exceptions. Those answers determine whether the service supports your written policy.

FAQ

How often should I re-run AML screening on existing vendors?

Use a risk-based review schedule alongside reassessment after relevant sanctions updates and material vendor changes. There is no universal annual interval covering every vendor and every business; your applicable obligations determine the required controls.

Do all U.S. businesses need the same vendor AML program?

No. Regulated financial institutions have AML obligations that do not automatically apply in the same form to every ordinary business, while applicable sanctions restrictions remain a separate consideration.

Is daily sanctions screening legally required for every vendor?

There is no single daily vendor-screening mandate covering every U.S. business. Determine the controls needed for your sanctions exposure, applicable rules, and partner requirements rather than presenting one cadence as universal law.

Which vendor changes should trigger another screening check?

Material changes in identity, ownership, geography, or payment activity should trigger reassessment under your policy. Relevant sanctions updates also require a process for identifying affected relationships and payments.

Can a vendor be blocked even if its name is not on a sanctions list?

Yes. Under OFAC's 50 Percent Rule, an entity owned 50% or more in the aggregate, directly or indirectly, by one or more blocked persons is itself considered blocked, even if not separately listed; apply OFAC's ownership guidance to the actual structure.

Does a 25% blocked ownership stake automatically block a vendor?

A 25% stake held by one blocked person does not, by itself, meet OFAC's 50% aggregate ownership threshold. Two blocked owners holding 25% each reach 50% in aggregate; other restrictions and the full ownership structure still require review.

What evidence should I retain after vendor rescreening?

Retain the check date, identifiers used, relevant screening source information, potential matches, and the documented decision. Follow the recordkeeping requirements applicable to your organization and the relevant sanctions or AML regime.

One last thing

A vendor can become blocked without its own name appearing on a list. OFAC's 50 Percent Rule is why ownership information belongs in the screening process, not just in the onboarding archive.

For your next 2026 policy review, choose an existing vendor with layered ownership and trace how a new blocked owner would reach the payment decision. If the process cannot connect an ownership change to reassessment, shortening the calendar interval alone will not close that gap.

Related guides

• Automatically run KYB checks when onboarding a new vendor
• Does cross-border payment automation include OFAC sanctions screening?
• How does KYB verification work for shell companies?