Summary Sanctions screening is a zero-tolerance control. Governance failures here can produce enforcement outcomes disproportionate to the underlying business volume.
List management The screening list universe — regulatory, jurisdictional, internal — must be defined, sourced from authoritative providers, and updated on defined cycles with documented cut-offs.
Matching rules Match logic, fuzzy tolerances, and exclusion rules should be documented, tested and periodically re-benchmarked. Suppression of prior true positives is a common finding.
Alert disposition Investigator training, four-eyes review, and consistent disposition standards are the operational core. Metrics should include quality-assurance sampling, not just throughput.
Payment screening vs customer screening The two are related but distinct. Payment screening operates in the flow with strict latency requirements; customer screening operates on the base and on periodic refresh. Governance should treat them separately.
Testing Independent testing — synthetic name testing, historical replay, list-refresh regression — is the primary source of assurance beyond alert dispositions.
Limitations Screening cannot compensate for weak KYC. Beneficial-ownership gaps propagate straight through the screening layer.
Related expertise See [AML and Financial Crime](/expertise/aml).
Frequently asked questions
What should risk leaders know about list management?
The screening list universe — regulatory, jurisdictional, internal — must be defined, sourced from authoritative providers, and updated on defined cycles with documented cut-offs.
What should risk leaders know about matching rules?
Match logic, fuzzy tolerances, and exclusion rules should be documented, tested and periodically re-benchmarked. Suppression of prior true positives is a common finding.
What should risk leaders know about alert disposition?
Investigator training, four-eyes review, and consistent disposition standards are the operational core. Metrics should include quality-assurance sampling, not just throughput.
What should risk leaders know about payment screening vs customer screening?
The two are related but distinct. Payment screening operates in the flow with strict latency requirements; customer screening operates on the base and on periodic refresh. Governance should treat them separately.
What should risk leaders know about testing?
Independent testing — synthetic name testing, historical replay, list-refresh regression — is the primary source of assurance beyond alert dispositions.