...

Ongoing AML monitoring of customers

A customer passed checks at onboarding, but the Rosfinmonitoring lists, sanctions lists and the PEP database change over time. NeuroVision returns the results of checks against these lists: repeat them with an API request on your system’s schedule, compare with the previous result and learn about a new match before the inspector does. The response deadline is set by 115‑FZ; the decision is made by your compliance team.

24 hours to freeze funds after a customer is added to the Rosfinmonitoring list
Once months — a check of the whole customer base against the lists and a report
7 working days to update details if doubts arise
Once a year — the minimum for updating details on a medium- or high-risk customer
5 ₽ screening against the list and other Russian databases
36 ₽ international screening: sanctions and PEP
Repeat check — by an API request The decision rests with your compliance team Russian software registry no. 19972

The customer passed the checks, but the lists have changed: why you need AML monitoring

Every new match has a deadline

115‑FZ counts the time from the publication of the list. Learning of a match at the next scheduled check means being late.

  • 01

    Lists are updated more often than customers come in

    Rosfinmonitoring regularly adds to the list of terrorists and extremists, the Interagency Commission (IAC) takes freezing decisions, and sanctions lists and the database of politically exposed persons change too. A customer who was clean on the day of onboarding can appear on a list a week later.

  • 02

    The deadline runs from publication, not from your check

    The 24 hours to freeze funds under the national list start from the moment the information appears on the Rosfinmonitoring website. If you check your base once a quarter, this deadline is easy to miss.

  • 03

    Manual re-checking of the base does not scale

    Exporting tens of thousands of customers, running them through the new version of the list and reviewing the matches by hand can be done once a quarter, but no more often. Repeat API requests can be sent from your system on a schedule, so that you review only the changes.

  • 04

    The decision stays with compliance

    NeuroVision does not freeze funds and does not send reports to Rosfinmonitoring. It returns the result of the check, and from there your process runs under your internal control rules.

  • 24 hours freezing under the Rosfinmonitoring list and IAC decisions
  • 20 hours freezing under the UN Security Council lists
  • 1 working day to report the measures taken to Rosfinmonitoring

What to track for customers you already serve

Screening at onboarding and repeat checks use the same checks. The difference is that repeat checks run again when a source changes and are compared with the previous result: you only need to review the changes.

  • The list of terrorists and extremists

    A new version of the Rosfinmonitoring list is checked against the customer base by full name and date of birth. Removed entries are returned separately: if a customer has been taken off the list, the measures must be lifted no later than the next working day. More in  the watchlist check.

  • IAC decisions and UN lists

    Decisions of the Interagency Commission on freezing and the UN Security Council lists on terrorism and the proliferation of weapons of mass destruction. Each has its own deadlines, so the source must be recorded in the match record. The check against IAC decisions is available on request.

  • Sanctions lists

    OFAC, the EU, the UK and the UN as part of international screening. Important for customers with foreign documents, international transfers and crypto services. More in  sanctions screening.

  • Politically exposed person status

    The customer was appointed to a post, became a relative of a PEP or left office. The new status changes the measures under art. 7.3 of 115‑FZ: a written decision by a manager, the source of funds, heightened attention to transactions. More in  PEP screening.

  • Wanted status and proceedings

    Ministry of Internal Affairs and Federal Bailiff Service wanted lists, enforcement proceedings, courts of general jurisdiction: information that appears after a customer has been taken on and matters for assessing business reputation (subpara. 1.1, para. 1, art. 7 of 115‑FZ).

  • Document and customer status

    The passport has become invalid, the customer has been declared bankrupt or has appeared in the register of controlled foreign persons. This is grounds to doubt the accuracy of the details and to update the application form within seven working days. All checks are in the individual check catalogue.

How often to repeat customer checks: lists, statuses and documents

Running all checks on the whole base for no reason is expensive and pointless. Tie the repeat check to an event: a new version of the list has come out — check all customers against that list only. Everything else follows the schedule you set in your internal control rules.

  • The list of terrorists and extremists at least once every 3 monthsStop
  • IAC freezing decision on requestStop
  • UN Security Council lists at least once every 3 monthsStop
  • Customer removed from the list on a repeat checkLift measures

  • OFAC, EU, UK and UN sanctions lists on a scheduleStop
  • New politically exposed person status on a scheduleReview
  • PEP-related person: spouse, relative on a scheduleReview
  • Former PEP on a scheduleFor information

  • Wanted lists of the Ministry of Internal Affairs and the Federal Bailiff Service on a scheduleReview
  • Enforcement proceedings on a scheduleFor information
  • Courts of general jurisdiction on a scheduleFor information

  • Passport validity on a scheduleReview
  • Personal bankruptcy on a scheduleReview
  • Register of controlled foreign persons on a scheduleReview
  • The tags are a guide: how often to repeat a check and what urgency to assign to the response. You set the frequency and urgency in your own system; at NeuroVision a repeat check is an API request.

How AML monitoring works: from the customer list to a compliance decision

Five steps. People are needed in two: to decide whom to check and how often, and to review a match. The rest is done by your system and API requests.

Step 1

Draw up a customer list

Customers you already serve are in your system: full name, date of birth, citizenship, and for legal entities — name and taxpayer ID (INN). Split them into groups by risk level: each has its own set of checks and repeat interval.

Customer list split into risk groups
Step 2

Save the baseline result

The first check gives a starting point: lists, sanctions and PEP status for the customer as of the onboarding date. Keep the API response on your side — every later check is compared with it.

Baseline result of the customer’s checks saved
Step 3

Repeat the check on a schedule

A new version of a list or sanctions list has come out — run a check across the base. Documents and statuses follow your schedule. The request returns a run number (runId); you get the result by polling every 5–10 seconds.

Repeat check of the base after a list update
Step 4

Compare with the baseline

Your system matches the new response against the previous one: what it was, what it is now, and when. A new match gets an urgency and a response deadline, for example “freeze — within 24 hours of publication”.

Comparison of the result with the baseline: no matches before, a match now
Step 5

Review and log

The responsible officer confirms the match or marks a namesake and records the measures. Decisions are kept in your system’s log: it is the source for the quarterly screening report.

The responsible officer’s decision saved in the organisation’s log

A new match, a status change or a namesake: how to review the result

Full name and date of birth match

New match

The customer appeared on a list, in an IAC decision or on a sanctions list after onboarding. The match record shows the source and the time the entry was published: the 24 or 20 hours to freeze run from it. In your system such a match can be assigned the “Stop” urgency.

same customer, different status

Status change

The customer became a PEP or stopped being one, was removed from a list, or their passport became invalid. What is needed is not a block but an update of the application form, a review of the risk level or lifting of measures.

name matches, data does not

Namesake

A different date of birth, citizenship or city. The namesake mark is set by your responsible officer: if the list entry has not changed, this pair does not need to be reviewed again, and if it has changed, check it again. On handling false positives, see  blog article.

Possible namesake: the customer’s date of birth does not match the list entry, pair closed New list match: full name and date of birth match, freeze within 24 hours

What a change looks like for a customer: before and after

A repeat check returns a new result for the customer, and your system compares it with the baseline: a queue of changes, a “before → after” card and the officer’s decision. The screens are an example of such a card built from two API responses. A match with a list is a reason to take measures under the internal control rules on time: a full namesake is not the same person.

Customer card in your system: no list matches before, a match now, freeze within 24 hours
Review queue after a repeat check: one match and one namesake The responsible officer’s decision recorded in the organisation’s log

AML monitoring of customers, KYT and fraud monitoring: who watches what

  • Customer monitoring — who the customer is now

    This page. Lists, IAC decisions, sanctions, PEP, wanted status and documents of a customer you already serve. A new match is a reason to review the  customer’s risk level.

  • KYT — what the customer does

    Transactions and transfers: amounts, counterparties, countries, signs of unusual transactions. More on the KYT page.

  • Fraud monitoring — has the customer’s money been stolen

    Transfers made without the customer’s consent, Bank of Russia indicators, suspension of transactions under 161‑FZ. More on the fraud monitoring page.

  • Counterparty monitoring — what is happening with the company

    A change of director or shareholders, court cases and bankruptcy, sanctions against the legal entity’s executives. More on the counterparty monitoring page.

A legal-entity customer can be under two checks at once: against lists — here, and for changes at the director and founders — in KYB.

Who needs AML monitoring of customers

All organisations under art. 5 of 115‑FZ whose customer stays with them for longer than a single transaction: an account, a loan agreement, a brokerage account, a wallet.

  • Banks

    • The whole customer base — a scheduled repeat check against the lists
    • Risk monitoring at the intervals set by Regulation No. 860‑P
    • Solutions for banks
  • Microfinance and microcredit companies

  • Brokers and investment platforms

  • Payment services and fintech

  • Pawnshops and insurers

    • Regular customers and policyholders under savings contracts
    • Base screening and a report once a quarter
    • Solutions for pawnshops
  • Crypto exchanges, exchange offices and digital financial assets (DFA)

Lists, updating of details and internal control rules: 115‑FZ deadlines for customers you already serve

The words “continuous monitoring” do not appear in 115‑FZ — it is a FATF standards formula. But the law sets deadlines that start running without your involvement: from the publication of a list, from the appearance of doubts, from the start of a quarter. Regular checks help you not to miss them.

  • Lists: freezing and quarterly screening

    All organisations under art. 5 of 115‑FZ

    Article on 115‑FZ

    What the law requires

    • Freeze the funds of a customer on the Rosfinmonitoring list or in an IAC decision — no later than 24 hours from publication; under the UN lists — no later than 20 hours from notification
    • Report the measures to Rosfinmonitoring no later than the next working day; lift the measures after removal from the list within the same deadline
    • At least once every three months, check all customers and report the results (subparas. 6, 6.1, 7, para. 1, art. 7, arts. 7.4 and 7.5)

    What regular checking gives

    • A new match is visible on the next run — with the time the entry was published in the check response
    • Quarterly screening results with run dates are kept in your system — for the report
  • Customer details and business reputation

    Customers you already serve, their representatives and beneficial owners

    Get test access

    What the law requires

    • Take measures on a regular basis to determine the customer’s financial position and business reputation (subpara. 1.1, para. 1, art. 7)
    • Update details at least once a year, for low risk — once every three years, in case of doubt — within seven working days (subpara. 3, para. 1, art. 7)
    • Assess risk not only on taking a customer on but also while serving them (subpara. 3.1); update details on foreign PEPs regularly (subpara. 4, para. 1, art. 7.3)

    What regular checking gives

    • A new PEP status or an invalid passport is visible on the next check — the seven-day countdown is not missed
  • A bank’s internal control rules

    Credit institutions and branches of foreign banks

    Calculate the cost

    What the law requires

    • In the ML/TF risk management programme, set out the procedure for monitoring a customer’s risk level and its frequency (para. 4.10 of Bank of Russia Regulation No. 860‑P)
    • Record the results of monitoring the risk of the bank’s services being used at least once every six months

    What regular checking gives

    • You set the frequency of repeat checks by risk group in your own system, in the same way as in the internal control rules
    • Saved results and decisions are material for internal control and a Bank of Russia inspection

How much AML monitoring of customers costs

The price is made up of the checks you run when you onboard a customer and at each repeat check. No subscription fee for checks and no annual licence.

  • Lists and Russian databases

    5 ₽

    Catalogue

    per check: list of terrorists and extremists, passport validity, bankruptcy, register of controlled foreign persons

  • International screening

    36 ₽

    Price matrix

    per check: sanctions and PEP in one request

  • Repeat checks of the base

    on request

    Calculate

    base size, set of checks and repeat frequency — in a quote tailored to your process

Checks skipped for lack of data are not charged. Prices are in the price matrix. The trial period is 1 month. A set for your base — submit a request, and we will send you a quote.

Integration: the API and your accounting system

A repeat check is an API request from your system on a schedule. Comparison with the previous result, urgency and the decision log stay with you: NeuroVision returns the results of checks.

REST API

Send customers for checking with an API request when an agreement is opened, a new version of a list comes out or a deadline arrives on your schedule. The request returns a run number (runId); you get the result by polling every 5–10 seconds. API documentation

  • Repeat API request
  • Result by runId
  • From a KYC session
  • The decision is yours

A trial period of 1 month.

Payment is for completed checks.

AML monitoring glossary

Terms found in check results, the log and the internal control rules.

Ongoing AML monitoring of customers
A repeat check of customers you already serve against lists and statuses, with a review of the changes. At NeuroVision a repeat check is an API request; the schedule, comparison and log are in your system.
ongoing monitoring
Repeat screening
Checking an already screened base against a new version of a list or sanctions list.
re-screening
Baseline result
The result of a customer’s checks as of the date they were enrolled in repeat checks; every later result is compared with it.
baseline
Urgency level
The priority for reviewing a change in your system: “Stop” — freezing deadlines, “Review” — handle today, “For information” — take into account.
Freezing (blocking)
A ban on disposing of the funds of a customer on a list or in an IAC decision until removal from the list or cancellation of the decision.
asset freeze
IAC decision
A decision of the Interagency Commission for Countering the Financing of Terrorism to freeze the funds of a specific person (art. 7.4 of 115‑FZ).
Quarterly screening
A check of all customers against the lists at least once every three months with a report to Rosfinmonitoring.
Updating the records
Updating the customer’s application form: at least once a year, for low risk — once every three years, in case of doubt — within seven working days.
KYC refresh
Compliance investigation
Review of a match by a responsible employee: checking the data, a decision, measures and an entry in the log.
case management
Namesake
A person with the same name but a different date of birth or citizenship; not counted as a match.
false positive

Questions about AML monitoring of customers

It is a repeat check of customers you already serve against the Rosfinmonitoring lists, IAC decisions, UN lists, sanctions lists and the database of politically exposed persons. Unlike the check at onboarding, it is repeated for as long as the customer stays with you and shows only what has changed. At NeuroVision a repeat check is an API request; the schedule, comparison with the previous result and the decision log are in your system.

Yes. 115‑FZ requires you to check all customers against the list of terrorists and extremists and the UN lists at least once every three months and to report the results to Rosfinmonitoring, and to update customer details at least once a year, for low risk — once every three years. The term “continuous monitoring” itself does not appear in the law: how often to re-check the base between these deadlines is for you to define in your internal control rules.

It depends on how often you run the repeat check: if you run it after every new version of a list, you see the match right after it. Database checks are asynchronous: the request returns a run number, and you get the result by polling every 5–10 seconds. The deadline to freeze — 24 hours — runs from the publication of the list on the Rosfinmonitoring website; the official source is your personal account on that website.

The measures must be lifted no later than the next working day after removal (subpara. 6.1, para. 1, art. 7 of 115‑FZ). Removed list entries are returned separately, so a repeat check shows both the customer’s appearance on the list and their removal. The decision to lift measures is made by a responsible employee of your organisation.

No. NeuroVision returns the result of the check, while the freezing, the report to Rosfinmonitoring and the lifting of measures are carried out by your organisation. Through the API the result can be linked to your system so that the customer’s transactions are stopped until the responsible officer decides.

Keep the baseline result for each customer and the namesake marks in your own system, and compare each new response with the previous one: that way you see only a new match or a status change. If a list entry has changed, a pair closed earlier must be re-checked.

Yes. Each customer goes in a separate request, so your system can send a base of any size in turn, split it into groups by risk level and set each its own set of checks and schedule. Confirm the request limits when you connect.

Customer monitoring answers the question “who is the customer now”: lists, sanctions, PEP, statuses. Transaction monitoring tracks what the customer does: amounts, counterparties, signs of unusual transactions, of which suspicious ones are reported to Rosfinmonitoring no later than three working days. Transactions are handled by KYT, and transfers made without the customer’s consent by fraud monitoring.

Keep the results of repeat checks, matches and decisions in your system’s log with run dates and sources. For a quarter, the data on customers checked and matches found is compiled from it. Your organisation submits the report itself through the Rosfinmonitoring personal account.

A check against the list and other Russian databases costs 5 ₽, international screening with sanctions and PEP — 36 ₽, per the price matrix. A quote for your base, set of checks and repeat frequency is available on request: leave a request and we will send a quote. The trial period is 1 month.

Let’s discuss repeat checks of your customer base

Tell us how many customers you serve and which lists matter to you — we will open trial access and send a quote.

Can't put your request into words? Book a call and our team will contact you at a convenient time

Book a call

The company is included in the register of IT companies and the register of personal data operators of the Russian Ministry of Digital Development.

Address: Moscow, Presnenskaya Embankment 12 — Moscow City business centre, Federation Tower. Nearest metro stations: Delovoy Tsentr and Mezhdunarodnaya.