Screening and watchlists
Which list, as it stood when — answerable years after the filing
A screening hit here is a snapshot, not a lookup. It records the list, the exact published version, the entry as it read at match time, the algorithm, the threshold in force, the raw name similarity and every corroboration adjustment applied to it. Adjudication is a permissioned human decision with a written rationale.
No sanctions, PEP or adverse-media feed adapter ships in this build, and it has not been established that a commercial feed may lawfully be redistributed to an on-premise data centre at all. An empty screening queue is a statement about what has been run — not evidence that anybody is clean.
The problem
The dangerous screening system is the one that looks clean
Screening is the control most likely to fail silently. A feed that stopped refreshing, a list that was never published, a run nobody triggered — all three produce the same green screen as a genuinely clear book.
An empty queue that means nothing
Zero pending hits is consistent with perfect screening and with no screening at all. Unless a system tells you what it has actually matched against, and when, the absence of hits is not information you can act on or defend.A hit that cannot be re-derived
Two years later, a regulator asks why the name was cleared. If the list has refreshed since, the entry has been amended and the threshold retuned, a system that stores only a decision and a score cannot reconstruct what was actually compared.A designation nobody re-checked
Lists change. A customer screened clean at onboarding and never re-screened is not a customer who is clear — they are a customer whose status is unknown, and no screen that reports the original result will tell you which.
How it works
Publish a version, screen against it, snapshot the match
A list becomes effective at the moment it is published, not when it is edited — so the version a hit points at is a fixed thing that later edits cannot rewrite. Everything downstream hangs off that.
Compliance administrator
Maintain the institution's own lists
Internal lists come in two kinds and the distinction is an obligation, not a label: a blacklist means do not do business, a greylist means keep doing business and watch it. An entry carries an external identifier, a primary name, an entity kind — natural person, legal entity, vessel, aircraft or unknown — any number of independently matched aliases, a reason code, a written reason an examiner will read, optional corroborating nationality, and an optional expiry after which a scheduled republish removes it from the index without anybody pressing a button.Compliance administrator
Import in bulk, and see exactly what was refused
A CSV import applies the rows it can and quarantines the rows it cannot, with the line number, the error and the raw line kept for inspection. An import that aborted on row nine would leave the institution screening against yesterday’s list while the screen said the upload had failed — which is the worst of both outcomes. Re-using an external identifier updates the existing entry rather than creating a second one.MLRO or compliance administrator
Publication is the moment a list becomes effective
Publishing reads the complete live master, not the page on screen, and writes an immutable version into the screening index. It is idempotent on content — an unchanged list writes no new version — and every hit produced afterwards pins the version number it matched against. Entries are removed by a soft delete with a required reason, because an audit entry pointing at a row that no longer exists is only half a record.Analyst
A run is requested, and the request is part of the evidence
Screening is initiated explicitly: the name to screen, optional date of birth and nationality for corroboration, an optional party identifier that links the run to a known customer, and a reason — ad-hoc investigation, real-time counterparty, ongoing review, batch follow-up or onboarding. The run returns its own identifier, how many candidates were considered, how long it took, how many hits it produced and how many previously approved matches were suppressed.Platform
The score is arithmetic you can check, not a verdict
A hit records the raw name similarity produced by the named algorithm, then each corroboration adjustment applied to it — date of birth, nationality and identifier each contributing a match bonus or, for date of birth, a mismatch penalty — and the adjusted score that results, against the threshold that was in force at the time rather than the value configured today. The screen lays the arithmetic out term by term and recomputes it: if the stored score cannot be reproduced from the recorded policy, the hit is flagged as unexplained rather than displayed as evidence.Platform
The entry is snapshotted as it read at match time
The hit keeps the primary name, matched spelling, external identifier, entity kind and programmes as they stood when the match was made, alongside the live entry. If the list has been amended since, the screen shows the drift explicitly. Nothing is backfilled — a snapshot invented from today’s list would look exactly like a record of what matched, which is precisely the artefact that must not exist.MLRO or analyst
Adjudication requires a rationale before it will accept a decision
Both decisions are disabled until a rationale is written. Confirming a match is a deliberate act behind a confirmation step that says plainly what it means: the decision endpoint updates only a hit that is still pending, and no screen in this product reopens one. The obligation attached to the list kind is stated beside the decision — a confirmed sanctions match is an asset freeze and a filing trigger; a confirmed PEP match triggers enhanced due diligence and senior sign-off and is not by itself a reason to exit a relationship; adverse media is open-source reporting that informs risk rating and carries no automatic obligation.
In the product
The screening queue
The queue is built so that the honest answer is the one on screen: what is in force, what has been run, what is ageing, and what the score was actually made of.
Placeholder — TODO: capture the screening queue screen (/screening) from a seeded demonstration tenant — no screenshot of it exists yet. Replace with sourced, approved content before this page is made public.
/screeningscreening queue
Screenshot slot. Capture from a seeded demonstration tenant with synthetic data and replace this frame. Do not substitute a mock-up of the interface.
What the capture must show
- Standing coverage bannerA permanent warning when nothing of kind sanctions or PEP has a version in the index: no customer has been matched against one, and the empty queue below is not a clean book.
- Screened againstEach list in force named with its version and kind, so the reader can see what the queue is a queue of — or a plain statement that no list, internal or provider, is in the index.
- Decision filtersPending, confirmed, cleared and suppressed — four states, with pending the default, and no combined view that would hide which of them a number refers to.
- Corroboration on the hitDate of birth, nationality and identifier each shown as match, mismatch or unknown, with the adjusted score and the name-alone score beneath it when corroboration weakened the match.
- AgeingHits past a week carry an ageing chip. It is amber rather than red on purpose: a screening hit has no statutory clock of its own, so the screen shows age rather than inventing a breach.
- Adjudication panelA required rationale, two verdicts, and a confirmation step that states the decision cannot be undone from any screen in the product.
Controls
What makes a screening decision hold up
Each of these exists because of a specific way a screening system misleads the person reading it.
Versioned lists, pinned to the hit
A list is screened against as it stood when it was published, not as it stands now. The version number, publication time and entry count travel with every hit, so a refresh cannot rewrite the history of what matched.The score reconciles, or it is flagged
The screen recomputes the adjusted score from the snapshotted policy and compares it against the stored value. A hit whose own record cannot reproduce its own score is reported as unexplained rather than presented as evidence.The obligation is stated with the decision
Sanctions, PEP, adverse media, internal blacklist and internal greylist each carry a written duty on the hit itself, so the person deciding is not left to infer what a confirmed match on that particular kind of list actually obliges the institution to do.Adjudication is separated and permissioned
Running a screen, deciding a hit, maintaining a list, importing entries, publishing a version and configuring a source are six different rights. Executive roles can see list metadata and never the named entries.An unresolved hit blocks the decisions that depend on it
Approving a customer application fails closed unless the pinned screening run has no unresolved hit, and the case workspace warns before closure when linked screening evidence is still undecided — a case closed over an undecided sanctions match is a decision the platform cannot defend on the institution's behalf.A configured source that is failing says so
Provider feeds show their last status, their full last error untruncated, when they last ran and when they are next due. A refusal is recorded as a fact on the source rather than swallowed, because a feed that quietly stopped refreshing is indistinguishable from one that is working.
Where the edges are
No feed ships, and nothing screens by itself
These two sentences are the most important on this page. Both are enforced in the product with visible warnings rather than left to the reader to discover.
In the product today
- Internal blacklist and greylist management: entries with aliases, entity kinds, reason codes, corroborating attributes and expiry; bulk CSV import with row-level quarantine; soft removal with a required reason; versioned, idempotent publication.
- Screening runs against the published index with a bounded candidate set, a named algorithm, and a recorded request carrying the reason, the policy and the timings.
- Hits that snapshot the list version, the entry as it read, the algorithm, the threshold in force and every corroboration term, with drift against the live entry shown explicitly.
- Adjudication with a mandatory rationale, a stated obligation per list kind, and the decision bound to the actor and the time in the audit chain.
- Provider-source configuration with adapter identifier, list kind, source, refresh interval and an enable flag that defaults to off, plus visible last-status and last-error reporting.
Not claimed here
- Any sanctions, PEP or adverse-media data. No feed adapter ships. Whether a commercial feed may lawfully be redistributed to an on-premise data centre is an open licensing question, so a configured source records that no provider is registered under that identifier on every run — deliberately, because a placeholder that made screening look like it was happening would be worse than an empty list.
- Automatic screening. Nothing in the platform screens on its own: onboarding does not screen as a side effect, and publishing or refreshing a list loads the index without re-screening anybody already on the books. Re-screening after a list change is an operational procedure the institution runs.
- Reopening an adjudicated hit. The decision endpoint updates only a pending hit and no screen reopens one. Suppression exists as a state and renders as a badge, but the four-eyes route to set it is not built — the control documentation describes suppression and reopen approval that the current build does not implement.
- Fuzzy-matching benchmarks. No false-positive rate, recall figure or match-quality metric is published, because none has been measured against a licensed list on a real book.
Keep reading
Related capabilities
Screening evidence attaches to the customer and to the case, and the licensing question above is the one to settle before an implementation starts.
Before you buy a feed
Talk through the licensing question first
Whether a commercial sanctions feed can be redistributed into your data centre changes the deployment shape, the contract and the timeline. It is worth an hour before it is worth a procurement.