Definition

For regulatory requirements, each client has to be updated periodically.

The period depends on the client risk; existing periods are 12 months, 30 months and 60 months.

Timeline

Status diagram

stateDiagram
[*] --> InProgress
InProgress --> Overdue: not completed within 90 days
Overdue --> TimedOut: not completed 30 days after Overdue
InProgress --> Completed: review completed 
Overdue --> Completed: review completed 
Completed --> [*]
TimedOut --> [*]

Sequence diagram

Case periodic review validated

sequenceDiagram
Title: Periodic review
autoNumber
Participant XPO
Participant Partner
Actor User

Note over XPO, User: Periodic review requested
XPO ->> Partner: Webhook 
Partner ->> User: Collection of updates
User ->> Partner: Update 
Partner ->> XPO: PUT /sca/user

Note over XPO, User: when all updates saved
Partner ->> XPO: POST /sca/v3.0/users/{{appuserid}}/periodic-review

Case periodic review not validated

sequenceDiagram
Title: Periodic review
autoNumber
Participant XPO
Participant Partner
Actor User

Note over XPO, User: Periodic review requested
XPO ->> Partner: Webhook PeriodicReview
Partner -->> User: Collection of updates requested


Note over XPO, User: first reminder
XPO ->> Partner: Webhook PeriodicReview
Partner -->> User: Collection of updates requested

Note over XPO, User: second reminder
XPO ->> Partner: Webhook PeriodicReview
Partner -->> User: Collection of updates requested

Note over XPO, User: third reminder
XPO ->> Partner: Webhook PeriodicReview
Partner -->> User: Collection of updates requested

Note over XPO, User: Overdue
XPO ->> Partner: Webhook PeriodicReview
Partner -->> User: Collection of updates requested

Note over XPO, User: TimedOut
XPO ->> Partner: Webhook PeriodicReview
XPO ->> Partner: Webhook ClosureRequestCreatedOrUpdated

Rules

Responsabity

As a partner, you are reponsible of

• collect all updates from the enduser
• validate that the review is completed

Overdue: account blocked

When the periodic review is overdue, all accounts are blocked for debit transactions.

SCA

Please note that validating the review is a sensitive process. Therefore, it is necessary to perform an SCA, even if one has already been performed for the modification of personal data.

Editable attributes

All information regarding the KYC not editable at the moment.

Best pratice proposal

As the overdue date approaches, the user must be restricted in order to compel them to update their information. During an initial period, they could for example be allowed to close the pop-up displayed at login. Then, during a second period, this pop-up would no longer be dismissible, forcing them to complete it.

How to test

Use the simulator: https://docs.xpollens.com/reference/mockperiodicreview

{
"followUpIntervals": [
  "00.00:01:00", // first reminder after 1 min
  "00.00:02:00", // second reminder after 2 min
  "00.00:03:00" // third reminder after 3 min
],
"overdueInterval": "00.00:04:00", // after 4min, periodic review overdue
"timeoutInterval": "00.00:02:00", // 2 min after, total 6min, periodic review timedout
}

https://docs.xpollens.com/reference/mockperiodicreview

Errors

{
    "type": "https://tools.ietf.org/html/rfc9110#section-15.5.6",
    "title": "Periodic review is final. Operation not authorized.",
    "status": 405,
    "traceId": "00-e5415f6014de2bc17a52f895c6e31d9a-9d2d1891dc596f65-01"
}

FAQ

FAQ1 - Is the digital scoring recalculated after a review?

Not for now.

FAQ2 - In case of multiple accounts for a user, all accounts are closed.

FAQ3 - Is the email address reusable after closure?

Yes.

FAQ4 - During their commercial relationship, a user updates personal data. Does this change affect the periodic review date (RequestedAt) ?

No.