Updates should be done periodically based on the customer’s risk rating. Typically, every 2-5 years for higher-risk customers. Updates are also mandatory when there is a significant change to customer information or risk profile.