Sanctions, PEP and Adverse-Media Screening

Introduction and context

Screening is a central preventive control in financial crime compliance. It helps an institution determine whether a customer, beneficial owner, counterparty, payment beneficiary, vessel, aircraft, or other relevant party is associated with sanctions, politically exposed person (PEP) risk, or adverse information. In investment banking, screening is particularly important because institutions deal with complex ownership structures, cross-border payments, securities transactions, correspondent banks, special-purpose vehicles, trusts, and high-value corporate clients.

Screening is not a single activity and it is not synonymous with anti-money-laundering (AML) compliance. Sanctions controls generally implement legally binding prohibitions or restrictions issued by governments and international authorities. PEP and adverse-media screening are broader risk-management controls. A PEP is not automatically prohibited from receiving services, and adverse media is not automatically proof of criminal conduct. These distinctions are essential for lawful, proportionate, and defensible decisions.

A mature screening framework combines accurate data, appropriate lists, risk-sensitive matching, human investigation, documented decisions, escalation, and continuous monitoring. Its purpose is not to eliminate every possible name match. Its purpose is to identify relevant risk efficiently, prevent prohibited activity, and ensure that uncertain cases receive appropriate review.

Learning objectives

By the end of this chapter, the reader should be able to:

1. Distinguish sanctions screening from PEP and adverse-media screening.
2. Select relevant sanctions and risk-information lists for a business and jurisdiction.
3. Explain exact, fuzzy, transliterated, and contextual name matching.
4. Apply ownership-and-control principles to entities and transactions.
5. Design an alert-disposition and escalation process.
6. Evaluate false positives, false negatives, data quality, and model risk.
7. Apply screening controls to onboarding, payments, securities activity, and ongoing monitoring.
8. Assess governance, ethical, regulatory, and technological issues in screening.

1. The screening universe

1.1 Sanctions screening

Sanctions are restrictive measures imposed by a competent authority. They may target countries, governments, companies, individuals, vessels, aircraft, sectors, goods, services, or types of conduct. Restrictions vary considerably. They may include:

• asset freezes or blocking obligations;
• prohibitions on making funds or economic resources available;
• restrictions on dealing with designated persons;
• trade or export controls;
• sectoral financing restrictions;
• correspondent-banking restrictions;
• travel bans; and
• transaction-specific licensing requirements.

The applicable obligation depends on the institution’s location, incorporation, branches, staff, currency, transaction route, customers, and applicable law. A global bank may therefore need to comply with several overlapping regimes. It must not assume that one consolidated list represents all legal obligations.

Sanctions screening is fundamentally an obligation-based control. The relevant question is often: “Would this proposed activity breach an applicable prohibition?” A name match is only an indicator; the legal analysis depends on the identity of the party, the nature of the restriction, the transaction, jurisdictional nexus, ownership and control, and any applicable licence or exemption.

1.2 PEP screening

A politically exposed person is an individual who is or has been entrusted with a prominent public function. Definitions differ by law, but commonly include senior political figures, senior government officials, judicial or military leaders, executives of state-owned enterprises, senior officials of political parties, and leaders of international organisations. Family members and known close associates are often included within enhanced due-diligence requirements.

PEP status is a risk factor, not evidence of wrongdoing. Public office can create exposure to bribery, corruption, misuse of public funds, influence trading, and conflicts of interest. However, a PEP may be a legitimate customer with transparent wealth and a lawful source of funds. Appropriate controls generally include risk assessment, senior-management approval where required, source-of-wealth and source-of-funds investigation, and enhanced ongoing monitoring.

1.3 Adverse-media screening

Adverse-media screening searches reliable public information for allegations or findings relevant to financial crime, regulatory misconduct, corruption, fraud, tax crime, money laundering, terrorist financing, sanctions evasion, human trafficking, environmental crime, or other material misconduct. It may also identify litigation, insolvency, regulatory enforcement, or reputational concerns relevant to a relationship.

Adverse media must be evaluated critically. A credible court judgment, regulator notice, or well-sourced investigative report is different from an unverified blog, duplicated story, political accusation, or allegation later dismissed. The institution should assess source quality, date, specificity, jurisdiction, outcome, relevance, and whether the subject is correctly identified.

1.4 Distinguishing the controls

The same person may appear in all three processes, but the decision logic differs. Treating every alert as a sanctions case can cause unlawful overblocking and customer unfairness. Treating a sanctions alert as merely reputational can create serious legal exposure.

2. List selection and data architecture

2.1 Selecting lists

List selection should begin with a legal and business-risk inventory. Relevant sources may include domestic national lists, supranational lists, foreign government lists applicable to the institution, sectoral lists, internal prohibited-party lists, PEP data, regulatory enforcement databases, and reputable adverse-media sources. The institution should document:

• the issuing authority and legal basis;
• jurisdictions and business lines covered;
• update frequency and delivery method;
• identifiers supplied, such as date of birth, nationality, address, passport, registration number, or vessel number;
• whether the list is comprehensive, informational, or advisory;
• licensing and permitted-use conditions; and
• ownership and control information.

A list should not be selected merely because it is commercially popular. The compliance function must map it to applicable obligations and risk appetite. List inventories should be reviewed when the institution enters a new market, offers a new product, changes payment routes, or becomes subject to new legislation.

2.2 Screening data

Effective screening depends on clean source data. Relevant fields include legal name, aliases, former names, native-script name, transliteration, date and place of birth, nationality, address, government identifiers, incorporation number, directors, shareholders, beneficial owners, vessel identifiers, and payment-message fields.

Data quality problems include missing middle names, inconsistent date formats, truncation, punctuation differences, inaccurate customer-provided data, and the use of nicknames. Payment data may be incomplete because messages contain abbreviated ordering-party or beneficiary information. These limitations should influence thresholds, manual review, and risk appetite.

2.3 Screening points

A risk-based programme commonly screens:

1. customers and beneficial owners at onboarding;
2. directors, authorised signatories, trustees, and connected parties;
3. counterparties and intermediaries before execution;
4. payment originators, beneficiaries, banks, and relevant free-text fields;
5. securities issuers, issuers’ owners, guarantors, and transaction parties;
6. assets such as vessels, aircraft, and commodities where relevant;
7. existing customers during periodic and event-driven reviews; and
8. updated lists and changed customer information.

Payment screening requires speed, high availability, and careful handling of partial data. Customer screening allows more contextual investigation. These are related but distinct operational problems.

3. Matching methods and alert quality

3.1 Exact and normalized matching

Exact matching compares strings after standardising case, punctuation, spacing, and sometimes legal-form suffixes. Normalisation can convert “A.B.C. Holdings Ltd.” and “ABC Holdings Limited” into comparable forms. It should not remove information that distinguishes people or entities. For example, removing all numbers may destroy an important registration identifier.

3.2 Fuzzy matching

Fuzzy matching identifies names that are similar but not identical. Techniques may include edit distance, token similarity, phonetic comparison, alias matching, and transliteration. A conceptual similarity score can be represented as:

Here, S is the composite match score; N is name similarity; I is identifier similarity; D is date-of-birth or incorporation-date similarity; A is address or other contextual similarity; and w₁, w₂, w₃, and w₄ are weights that sum to 1. This is a model-design representation, not a universal legal formula. The weights, thresholds, and fields must be validated against the institution’s data and risk environment.

Name similarity alone is weak evidence. “Mohammed Ali” may produce many alerts, while an uncommon name plus matching date of birth and nationality may be highly probative. A system should therefore use identifiers and context wherever available.

3.3 Transliteration and cultural naming conventions

Names may be written in Arabic, Cyrillic, Chinese, Korean, Hindi, or other scripts and converted into several valid Latin spellings. Name order may also vary. Some cultures use patronymics, clan names, or family names differently from Western conventions. Screening should preserve the original script where possible, use authoritative transliteration rules, retain aliases, and avoid treating a single transliteration as definitive.

3.4 False positives and false negatives

A false positive occurs when an alert is generated for a person or entity that is not the listed or high-risk subject. A false negative occurs when a relevant subject is not identified. Reducing false positives improves operational efficiency, but lowering thresholds without validation may increase false negatives.

Useful management measures include alert volume, confirmed-match rate, false-positive rate, investigation time, ageing, quality-assurance error rate, and missed-match incidents. Metrics should be segmented by list, product, geography, and data source. A high closure rate does not prove effectiveness if investigators are closing alerts without adequate evidence.

4. Ownership, control, and indirect exposure

4.1 Why entity screening is insufficient

A company may not be named on a sanctions list but may be owned or controlled by a designated person. Screening must therefore extend beyond the legal entity name. Relevant questions include:

• Who owns the entity directly and indirectly?
• Who can appoint directors or control voting rights?
• Who exercises effective control through agreements, financing, or nominees?
• Are multiple designated persons acting together?
• Does a sanctioned person benefit from the transaction even without formal ownership?

Ownership tests differ across legal regimes. Some regimes apply a specified ownership threshold, while others emphasise control or the prohibition on making funds available. The institution must apply the rule relevant to the transaction and jurisdiction, not an informal universal percentage.

4.2 Layered structures

Investment-banking clients may use holding companies, trusts, foundations, nominee shareholders, joint ventures, and private-equity structures. A beneficial-ownership chart should identify natural persons, ownership percentages, voting rights, control rights, and changes over time. Where information is incomplete or contradictory, the case should be escalated rather than resolved by assumption.

Ownership is also dynamic. A non-designated entity may become restricted after a share transfer, merger, appointment of a new director, or change in control. Screening should therefore be event-driven as well as periodic.

5. Alert investigation and disposition

A defensible workflow separates automated detection from human decision-making.

Figure: A risk-sensitive screening alert workflow from detection to disposition.

5.1 Investigation sequence

An investigator should first establish what generated the alert and which rule applies. The next steps are to compare identifiers, review the customer or transaction profile, examine ownership and control, consult reliable external sources, and determine whether the legal or risk criteria are met. Investigators should record both supporting and contradictory evidence.

A disposition should state:

• the alert and list or source involved;
• the identity information considered;
• the comparison of identifiers and context;
• the legal or policy analysis;
• the decision and rationale;
• approvals and escalations; and
• any restrictions, monitoring, or follow-up actions.

Typical outcomes include false positive, possible match pending information, confirmed sanctions match, PEP requiring enhanced due diligence, adverse information requiring risk treatment, or no actionable concern. “No issue” is not an adequate rationale.

5.2 Escalation

Escalation is required where identity cannot be resolved, a designated person may be involved, ownership information is incomplete, the transaction is urgent or unusual, a licence may be relevant, or legal obligations conflict. Front-line staff should not independently release a transaction where sanctions exposure remains unresolved. Escalation routes commonly include sanctions compliance, AML investigations, legal counsel, senior management, and the money-laundering reporting officer.

Confidentiality and tipping-off restrictions must be observed. A customer should not be told that a suspicious-activity report has been or may be filed where law prohibits disclosure.

6. Ongoing monitoring and control governance

Screening does not end at onboarding. Effective programmes combine:

• real-time or near-real-time payment screening;
• periodic rescreening against updated lists;
• event-driven reviews after ownership, address, management, or risk changes;
• review of new adverse information;
• quality assurance and independent testing;
• access controls and audit trails; and
• governance over vendor models and data feeds.

A rescreening policy should define how quickly new designations are applied, how existing customers and open transactions are rechecked, and how historical alerts are reassessed. Critical lists should have controlled update procedures, reconciliation checks, and contingency arrangements for outages.

Model governance should cover threshold calibration, validation data, change management, performance monitoring, explainability, and human override. Artificial intelligence can assist with entity resolution, document extraction, multilingual searching, and article prioritisation. It should not replace legal judgment or permit unexplained decisions. Generative systems may reproduce errors, amplify biased sources, or confuse allegations with findings. Human review, source traceability, and approved-use controls remain necessary.

7. Applied case: an illustrative investment-banking scenario

Background

Global Meridian Bank is arranging a syndicated loan for Northstar Infrastructure Holdings, incorporated in Country A. Northstar is owned through three holding companies and has a proposed construction project in Country B. A payment-screening alert identifies a beneficiary called “N. Infrastructure Trading.” A separate customer-screening alert links one indirect shareholder to a PEP database, while adverse media alleges corruption involving a former minister.

Problem

The names are not identical, the beneficial-ownership information is incomplete, and the payment must be executed quickly. The relationship team argues that the project is commercially important and that the PEP is no longer in office.

Analysis

The bank first identifies the applicable sanctions regimes based on its incorporation, branches, currency, transaction route, and counterparties. It then compares legal names, native-script names, addresses, registration numbers, directors, and payment references. It obtains an updated ownership chart and identifies the natural persons exercising voting and appointment rights.

The former minister’s status is not treated as an automatic prohibition. The bank determines the date and nature of the public function, the person’s family and close associates where relevant, and the source of wealth and funds connected with the investment. It evaluates the adverse-media sources: one article is an unverified opinion piece, while another is a regulator’s published enforcement action against a company controlled by the former minister’s close associate.

The payment alert cannot be cleared solely because the beneficiary’s name differs. The bank seeks registration and bank-account information and pauses execution under its internal sanctions procedure while the potential match is investigated. Legal counsel assesses whether the entity is owned or controlled by a designated person and whether any licence or exemption applies.

Approach and outcome

The bank records the evidence, escalates the payment alert, and obtains senior approval for the relationship only after enhanced due diligence is completed. It imposes transaction-specific controls, requires documentary evidence for project payments, adds event-driven ownership reviews, and establishes enhanced monitoring. If the investigation confirms a sanctions prohibition, the payment is rejected or blocked as legally required and relevant reporting is considered. If the sanctions concern is disproved but corruption risk remains, the relationship may proceed subject to documented AML controls. If source-of-wealth information is inadequate, the bank declines or exits the relationship.

Learning points

1. Different screening alerts require different legal and risk decisions.
2. Name similarity must be tested against identifiers and ownership evidence.
3. PEP status requires enhanced controls, not automatic exclusion.
4. Adverse media must be assessed for credibility, relevance, and outcome.
5. Commercial urgency must not override sanctions escalation.
6. Decisions must be reproducible from the case record.

8. Challenges, limitations, and ethical issues

Screening systems are limited by incomplete data, changing identities, common names, transliteration, opaque ownership, stale media, and inconsistent list quality. Excessive thresholds can miss matches; excessively sensitive thresholds can overwhelm investigators and delay legitimate activity. Poorly designed controls may also discriminate against customers from particular countries or linguistic groups.

Proportionality is therefore important. Institutions should collect and use information relevant to a legitimate compliance purpose, protect personal data, restrict access, and retain records according to law. PEP and adverse-media decisions should not become informal blacklists. Customers should be treated consistently, and where legally permitted, given an appropriate explanation or review route.

Senior management is responsible for adequate resources, risk appetite, escalation authority, and accountability. Compliance must have independence and access to the board or an appropriate committee. Internal audit should assess both technical operation and substantive effectiveness, including whether investigators understand and apply the legal distinctions.

9. Best-practice framework

A practical framework can be organised around ten principles:

1. Map legal obligations before choosing lists.
2. Maintain authoritative, complete, and timely customer data.
3. Screen relevant parties, assets, and payment fields.
4. Use fuzzy matching as an investigative aid, not as proof.
5. Apply ownership-and-control analysis to entities.
6. Separate sanctions, PEP, and adverse-media decision logic.
7. Use risk-based thresholds validated against actual data.
8. Document evidence, rationale, approval, and follow-up.
9. Escalate unresolved or legally sensitive cases promptly.
10. Test systems, vendors, staff performance, and outcomes continuously.

Chapter Summary

Sanctions, PEP, and adverse-media screening are connected but distinct components of financial crime control. Sanctions screening implements legally binding prohibitions and requires careful attention to jurisdiction, transaction type, ownership, control, licences, and reporting. PEP screening identifies heightened corruption risk and normally leads to enhanced due diligence rather than automatic rejection. Adverse-media screening identifies potentially relevant negative information, but allegations must be evaluated for reliability, identity, relevance, and outcome.

Effective screening requires appropriate list selection, quality data, multilingual and fuzzy matching, contextual identifiers, ownership analysis, human investigation, documented dispositions, escalation, and ongoing monitoring. Technology can improve efficiency, but it cannot replace legal interpretation, ethical judgment, or accountable governance. The central professional skill is to distinguish a technical alert from a substantiated compliance conclusion and to apply a proportionate, evidence-based response.

Key Terms

Sanctions: Government-imposed restrictions or prohibitions on persons, entities, countries, sectors, goods, or activities.

Designated person: An individual or entity identified under an applicable sanctions regime.

Asset freeze: A prohibition on dealing with or making funds or economic resources available to a restricted person.

PEP: A person entrusted with a prominent public function.

Family member: A relative included within applicable enhanced-due-diligence rules for a PEP.

Close associate: A person with significant business, professional, or personal connections to a PEP.

Adverse media: Public information indicating possible misconduct or risk relevant to a financial relationship.

Name normalisation: Standardising names by handling case, punctuation, spacing, and comparable variations.

Fuzzy matching: Comparing records using degrees of similarity rather than exact equality.

False positive: An alert that does not relate to the listed or relevant subject.

False negative: A relevant subject or risk that the screening process fails to identify.

Transliteration: Converting a name from one writing system into another.

Beneficial owner: The natural person who ultimately owns or controls a customer or arrangement.

Control: The ability to direct decisions, management, voting, or economic outcomes.

Alert disposition: The documented conclusion and action taken following investigation.

Enhanced due diligence: Additional investigation and controls applied to higher-risk relationships.

Event-driven review: A review triggered by a material change rather than a fixed calendar date.

Tipping off: Improperly disclosing information about a suspicious-activity investigation or report.

Model risk: The risk that a screening model or algorithm produces unreliable or misunderstood results.

Review Questions

Short Answer Questions

1. Why is a PEP not automatically prohibited from becoming a customer?
2. State two differences between sanctions screening and adverse-media screening.
3. What is a false positive in name screening?
4. Why must entity screening consider ownership and control?
5. Identify three fields that can improve the investigation of a name match.

Long Answer Questions

1. Explain how an investment bank should select and govern sanctions, PEP, and adverse-media data sources.
2. Discuss the role and limitations of fuzzy matching in multilingual customer and payment screening.
3. Describe a complete alert-investigation and disposition process, including escalation.
4. Explain why ownership-and-control analysis is essential for screening corporate customers.
5. Evaluate the governance, ethical, and data-protection issues associated with automated screening.

Analytical / Application Questions

1. A payment beneficiary has a similar name to a designated person, but the date of birth and country differ. What evidence should be collected before disposition, and what factors determine whether the payment can proceed?
2. A former minister is identified as a PEP and has been the subject of credible regulatory findings involving a company owned by a close associate. Design an enhanced-due-diligence and monitoring plan.
3. A bank’s alert volume has doubled after lowering its fuzzy-match threshold, while confirmed matches have not increased. Analyse possible causes and recommend a controlled calibration and validation approach.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes sanctions screening from PEP screening?

A. Sanctions screening concerns legally binding restrictions, while PEP screening identifies heightened risk requiring assessment.

B. PEP screening always requires rejecting the relationship, while sanctions screening is optional.

C. Sanctions screening applies only to cash transactions, while PEP screening applies only to securities.

D. There is no meaningful distinction because every PEP is sanctioned.

Correct Answer: A. Sanctions screening concerns legally binding restrictions, while PEP screening identifies heightened risk requiring assessment.

Question 2

What is the strongest basis for resolving a potential name match?

A. The customer’s assertion that the name is common

B. Name similarity considered together with identifiers and contextual evidence

C. The age of the screening software

D. The commercial importance of the transaction

Correct Answer: B. Name similarity considered together with identifiers and contextual evidence

Question 3

Which person is generally the focus of beneficial-ownership analysis?

A. The relationship manager

B. The institution’s external auditor

C. The natural person who ultimately owns or controls the entity

D. Any employee who signs a payment instruction

Correct Answer: C. The natural person who ultimately owns or controls the entity

Question 4

What is an appropriate response to unresolved possible sanctions exposure?

A. Release the transaction because the customer is longstanding

B. Delete the alert to prevent duplicate work

C. Ask the customer to choose the screening outcome

D. Hold or restrict the activity and escalate under the applicable procedure

Correct Answer: D. Hold or restrict the activity and escalate under the applicable procedure

Question 5

Which is an example of a false positive?

A. A designated person is missed because an alias was absent

B. An alert concerns a different person with a similar name

C. A sanctions list is updated promptly

D. A beneficial owner is correctly identified

Correct Answer: B. An alert concerns a different person with a similar name

Question 6

What is the normal significance of confirmed PEP status?

A. Automatic criminal liability

B. Automatic sanctions designation

C. Enhanced due diligence and appropriate approval or monitoring

D. Immediate public disclosure of the customer’s information

Correct Answer: C. Enhanced due diligence and appropriate approval or monitoring

Question 7

Why is adverse media evaluated for source quality and outcome?

A. All online information is legally conclusive

B. An allegation may be unreliable, outdated, or later disproved

C. Only anonymous sources can be used

D. Source quality determines a person’s nationality

Correct Answer: B. An allegation may be unreliable, outdated, or later disproved

Question 8

Which control is most appropriate after a major beneficial-owner change?

A. Wait until the next five-year review

B. Conduct an event-driven rescreening and ownership review

C. Remove the customer from all screening

D. Ignore the change if payment volume is low

Correct Answer: B. Conduct an event-driven rescreening and ownership review

Question 9

What is a principal risk of using an unexplained AI screening decision?

A. It guarantees zero false positives

B. It may be difficult to validate, challenge, or explain

C. It eliminates the need for data quality controls

D. It automatically satisfies every legal obligation

Correct Answer: B. It may be difficult to validate, challenge, or explain

Question 10

Which record is most important in supporting a defensible alert disposition?

A. Only the investigator’s initials

B. The customer’s marketing brochure

C. The evidence reviewed, analysis performed, decision, rationale, and approvals

D. A verbal statement that the alert was inconvenient

Correct Answer: C. The evidence reviewed, analysis performed, decision, rationale, and approvals