How often should KYC be refreshed?

Published August 2026 · By the UltimateCRM team · Educational overview as of August 2026 — not legal, tax, or compliance advice. Confirm requirements with your compliance counsel.

The honest answer: no fixed interval

For RIAs, no rule says "refresh KYC every N months." The obligation comes from the fiduciary duty of care: advice must be suitable for the client's current circumstances, which quietly requires that you know their current circumstances. A profile from 2021 supporting advice given in 2026 is the compliance problem — not a missed calendar interval.

Adjacent rules do set reference points. Broker-dealers live under FINRA's know-your-customer and suitability rules and must attempt to update account records at least every 36 months; Reg BI's care obligation points the same direction. Even for pure RIAs, those figures shape examiner instincts about what "reasonable" looks like.

What good practice looks like

• Annual touch, documented. Review the profile at the annual client review — and record that you did, even when nothing changed. "Reviewed, no changes" with a date is evidence; silence is not.
• Event-driven refreshes. Retirement, inheritance, sale of a business, marriage, divorce, a death in the household — any of these outdates a profile immediately, whatever the calendar says.
• Document the attempt. Clients ignore questionnaires. A recorded attempt with a follow-up shows the process worked even when the client didn't respond.
• Tier by risk. Complex, concentrated, or vulnerable-client situations justify a faster cadence than a straightforward diversified household.

Why KYC data actually goes stale

Here's the structural problem nobody puts in their policy manual: in most firms, the KYC profile is a separate copy of facts that live elsewhere. Net worth is in the planning tool, income is in last year's notes, and the KYC form is a snapshot that started aging the day it was signed. The refresh process is really a reconciliation process — and reconciliation is exactly the kind of work that slips.

The UltimateCRM approach: derive, don't re-type

UltimateCRM keeps one wealth dataset per household, powering planning, net worth, and the KYC profile alike. KYC wealth figures are derived from the living plan (with explicit overrides where you need them), so they can't silently diverge from reality — updating the plan updates the profile. What still needs human judgment — risk tolerance, objectives, attestations — is captured per client, and the compliance worklist auto-derives refresh obligations so an aging profile becomes a visible work item instead of an exam finding. When the examiner picks a household, the current profile, its history, and the evidence of review are one click, not one archaeology project.