Watchlist Screening

Watchlist screening is the compliance process of comparing the names and details of customers, beneficial owners, counterparties and payment parties against lists of people and organisations that present legal or financial crime risk. Banks, payment companies, money transmitters, crypto firms, insurers and many non-financial businesses screen at onboarding, at regular intervals during the relationship and on individual transactions. A match may mean the firm must block a payment, freeze funds, apply extra checks or decline the business.

The term is broader than sanctions screening, which deals only with sanctions lists. Watchlist screening also covers politically exposed persons (PEPs), law enforcement wanted lists, regulatory warning lists, adverse media and the firm's own internal lists of customers it has exited. It is a core part of know-your-customer and anti-money laundering programmes.

The lists a firm uses depend on where it operates and what risks it faces. The main categories are:

• Sanctions lists. Lists published by governments and international bodies, such as the US Office of Foreign Assets Control's Specially Designated Nationals (SDN) list, the United Nations Security Council consolidated list, the EU's consolidated financial sanctions list and the UK's sanctions list. Dealing with listed persons is generally prohibited by law. See sanctions list.
• PEP lists. Commercial databases of senior public officials, their family members and close associates, used to apply enhanced due diligence. See politically exposed person screening.
• Law enforcement and regulatory lists. Wanted persons, debarment lists and regulators' warnings about unauthorised firms.
• Adverse media. News and public records about involvement in crime, fraud or corruption, often screened as a separate process under adverse media screening.
• Internal lists. Customers the firm has exited, people linked to past fraud, and names subject to court orders.

Most firms buy screening data from commercial providers that aggregate official lists, add PEP and media data, and update the files daily or more often.

Screening software compares a customer's name, and where available date of birth, nationality, address and identity numbers, against list entries. Exact matching is not enough, because names are spelt differently, transliterated from other alphabets, shortened or rearranged. Systems therefore use fuzzy matching that scores how similar two names are, and match on aliases, known spellings and word order. Each firm sets a threshold above which a possible match generates an alert.

Alerts are reviewed by analysts, who compare the secondary details to decide whether the match is real. A name check that hits a common name will often be a false positive, discounted because the date of birth or nationality differs. A true match is escalated, documented and acted upon, which may include filing a report with the authorities.

Screening happens at several points. Customers and their beneficial owners are screened at onboarding. The whole customer base is rescreened whenever lists change and periodically in any case, since a customer may be added to a list after the account is opened. Payments are screened in real time, checking the names of the payer, payee, banks and sometimes free-text fields in the payment message against sanctions lists, so that a prohibited transfer can be stopped before it is executed. Firms that handle crypto apply similar checks to wallet addresses, described under wallet screening.

Because thresholds are set to avoid missing true matches, screening produces large numbers of false positives, often well over 90% of alerts at many institutions. Reviewing them is costly and slows onboarding and payments. Firms try to reduce the burden by improving data quality, tuning matching rules, using secondary identifiers automatically, whitelisting customers who have been cleared before and applying machine learning to prioritise alerts. Any tuning must be tested and documented, because regulators penalise firms that miss real matches through overly loose settings.

Sanctions regimes in most countries impose strict liability or near strict liability, meaning a firm can be penalised for processing a prohibited payment even without intent. Supervisors expect screening to be risk-based, with the lists, thresholds and processes justified in the firm's risk assessment and covered by independent testing. Enforcement actions by OFAC and other authorities have often cited failures such as screening only some fields of a payment message, outdated lists or systems that ignored certain spellings. The 50 percent rule adds complexity, as entities owned by listed persons may be blocked even if not named on any list.