Capital Market Service Providers must review and update their customer due diligence information at least every three years, particularly for higher risk categories of customers. If, upon performing such a review, copies of identification documents are more than 12 months out-of-date, the Capital Market Service Provider must take steps to obtain updated copies as soon as possible.