Sanctions Screening Controls Testing

Sanctions screening is the one financial crime control with no tolerance for error. A missed match against a designated party is not a quality issue to be averaged across a portfolio — it is a potential breach with strict-liability consequences. And yet it is the control institutions most often take on trust: the lists are assumed current, the thresholds left as the vendor set them, and the system’s ability to catch a true match never actually tested.

Sanctions screening controls testing replaces that faith with evidence.

Screening fails at the seams

Screening engines rarely fail in the obvious way. They fail at the seams — a list that updated a day late, a fuzzy-match threshold tuned slightly too loose, a transliteration or alias the matching logic was never tested against. Each is invisible in normal operation and decisive in the one case that matters. We test the seams: list coverage and currency, matching and fuzzy-logic thresholds, and the system’s behaviour against known name variants.

Validate, don’t assume

The only way to know a screening control works is to test it with cases where you know the right answer. We use controlled and synthetic test cases — including near-match, alias and transliteration scenarios — and analyse historical alerts to confirm whether the engine performs as the institution believes. The methodology and results are documented to a standard a regulator will accept, an approach explored further in sanctions screening testing.

The decision is part of the control

A screening control is not only its matching engine; it is the human disposition of the alerts it raises. We assure the alert-handling process: whether true matches are escalated correctly, whether discounting decisions are documented with rationale, and whether the audit trail would survive challenge. Catching the match is half the control — handling it defensibly is the other half.