AML Screening: Sanctions, PEP, Adverse Media Checks

AML screening checks customers, owners, and counterparties against sanctions lists, politically exposed person data, watchlists, and negative news. Firms run it at onboarding and again whenever lists or customer details change. The hard part is not running the check, but reviewing matches fast enough while still catching every true hit.

What AML Screening Covers and How It Differs From Transaction Monitoring

AML screening asks one question: is this person or company on a list that should change how we treat them? It matches a name, and ideally a date of birth or nationality, against sanctions, PEP, and other risk data. So screening looks at who customers are, not at what they do.

Transaction monitoring is a different control, because it watches how money moves after an account is live. Screening sits inside customer due diligence instead. You verify the identity first, then screen that verified identity, and the result decides whether you proceed, apply extra checks, or refuse. Screening also reaches beyond customers, since many firms screen beneficial owners, directors, payment counterparties, and even suppliers.

Who Must Screen and Why: The FATF Baseline

Most regulated businesses must screen, because national rules follow the FATF standard. Banks, fintechs, crypto exchanges, insurers, and many payment firms fall in scope. In practice, if a business must run Know Your Customer checks, it must screen too.

The stakes are high, because dealing with a sanctioned party can bring fines and criminal exposure. Sanctions duties are often strict, so good intent does not excuse a miss. That is why screening is one of the few controls where a single error can be very costly.

Screening Types: Sanctions, PEP, Adverse Media, and Internal Lists

Each type answers a different risk question, so a sound program combines them instead of relying on one.

Screening type	What it checks	What a match means
Sanctions	Official UN, national, and regional sanctions lists	Prohibition: no dealings, and assets must be frozen
PEP	People in prominent public roles, plus relatives and close associates	Higher risk, so enhanced due diligence applies
Adverse media	News and public records about crime, fraud, or corruption	Possible risk that needs review and context
Watchlists and internal lists	Law enforcement lists, crime records, and your own blocked parties	Depends on the list, so policy decides the action

Sanctions Screening

Sanctions are the strictest category. Under FATF Recommendations 6 and 7, countries must apply targeted financial sanctions linked to terrorism and weapons proliferation. So a confirmed sanctions match is not a risk score, but a legal stop.

PEP Screening

Politically exposed persons are not banned. Instead, FATF Recommendation 12 asks firms to apply extra checks, because public roles create corruption risk. That usually means senior approval, source of wealth questions, and closer monitoring.

Adverse Media Screening

Adverse media screening looks for negative news, such as reports of fraud, bribery, or organized crime. Because news can be wrong, old, or about a namesake, analysts must judge relevance before acting.

When to Screen: Onboarding, Periodic, and Event-Driven

A single check at account opening is not enough, because lists and customers both change. Most programs therefore screen at three moments.

1. At onboarding. Screen before the account opens or the first payment leaves, so a prohibited customer never gets in.
2. On a schedule. Re-screen the base at intervals, especially high-risk segments.
3. When something changes. Screen again when a list updates, or when the customer changes name, address, nationality, or ownership.

The third moment matters most for sanctions. Authorities can add a name on any day, and the duty to freeze starts then, not at your next review. That is why many teams now favor perpetual KYC, which monitors continuously instead of waiting for fixed cycles.

How the AML Screening Process Works

A screening check moves through a clear sequence, and each step shapes the alert an analyst sees. Understanding it helps teams find where false positives come from.

1. Collect. Gather the customer identifiers, ideally verified with a document and a face match.
2. Screen. Match those identifiers against sanctions, PEP, and other lists.
3. Score. Return a similarity score and a risk level for each potential match.
4. Review. An analyst confirms or dismisses the match using secondary identifiers.
5. Decide. Approve, reject, or escalate, and record the reasoning.

The quality of step one drives everything after it. When identity is verified first with liveness and a face match, screening runs against a confirmed name rather than a claimed one.

Match Review: Similarity, Secondary Identifiers, and Escalation

Screening tools rarely give a clean yes or no. They return possible matches, and most turn out to be false positives, so a good review process separates real hits quickly.

Use Similarity Scores, Then Secondary Identifiers

Names alone are weak evidence, because many people share names and spellings vary across languages. So tools score how closely a name matches a listed one. Then analysts compare date of birth, place of birth, nationality, and ID number to confirm or rule out the hit.

Set Thresholds You Can Defend

The match threshold controls the trade-off. A low threshold catches more spelling variants but floods analysts with noise, while a high threshold cuts noise but risks a missed match. Whatever you choose, test it on real data and record the reason, because auditors will ask.

Escalate, Decide, and Record

Outcome	What to do	Evidence to keep
False positive	Clear the alert and note why it does not match	Identifiers compared and the analyst’s reasoning
Possible match	Escalate to a senior reviewer, especially for sanctions	Extra documents requested and the decision
True sanctions match	Block, freeze assets, then report to the authority	Timeline, actions taken, and report reference
True PEP or adverse match	Apply enhanced due diligence and reassess risk	EDD findings, approval, and risk rating

Screening Business Customers and Their Owners

For a company customer, screening the company name alone leaves a large gap. Sanctioned people often hold assets through companies, and some rules treat a company as sanctioned when sanctioned owners control it. So a complete check covers the entity, the people on its board, and every beneficial owner.

In practice, this means running each owner through the same sanctions and PEP checks as an individual customer. Then record how the team resolved each hit, since an owner match can change the risk of the whole relationship.

Building a Risk-Based Screening Policy

A written policy keeps screening consistent across teams and over time. It should answer a few questions clearly.

1. Which lists apply? Name each sanctions, PEP, and internal list, and explain why.
2. Who gets screened? Customers, owners, directors, and, where relevant, counterparties.
3. When? At onboarding, on list updates, and at periodic reviews.
4. What threshold? State the match threshold and the testing behind it.
5. Who decides? Define review levels, escalation, and sign-off for true matches.
6. What gets recorded? Set the minimum evidence for closing any alert.

Review the policy at least once a year. Also review it whenever the firm enters a new market or launches a new product.

Common AML Screening Mistakes

Most screening failures are not technical. They come from process gaps that look small until an audit or an enforcement case exposes them.

• Screening once and never again. A customer can become sanctioned after onboarding, so one-time checks leave a growing blind spot.
• Screening only the account holder. Owners and directors matter too, especially for business customers.
• Using unverified data. If the name or date of birth is wrong, the screening result is worthless.
• Clearing alerts without notes. Undocumented decisions look like no decisions to an auditor.
• Treating every list the same. A sanctions hit and a PEP hit need very different responses.

Choosing an AML Screening Provider

Screening tools look similar on a feature list, so evaluation should test what actually drives outcomes.

Evaluation point	What to look for
List coverage and freshness	Which sanctions and PEP sources, and how often they update
Matching control	Adjustable similarity thresholds and secondary identifiers
Ongoing screening	Monitoring and bulk re-screening of the existing base
Identity link	Whether screening ties to verified identity, not a typed name
Audit trail	Clear records of matches, decisions, and reasons

For teams that want this in one place, Verihubs watchlist screening groups results by profile type, including Sanction, PEP, relatives and close associates, special interest persons, Watchlist, and Crime. It assigns a risk level to each type: high for sanctions and watchlists, medium for PEPs, and low for close associates. Teams can set a minimum similarity score, add date of birth and country to sharpen matches, run bulk searches, and keep an internal blacklist. Its Monitor feature then flags any screened person who later gains new profile data or a fresh sanction.

Screening still has boundaries. It tells you who a customer is on paper, but it will not reveal hidden owners or unusual payment flows. For that, you need beneficial owner checks and a transaction monitoring system as well. Pairing screening with identity verification and a clear KYC workflow keeps the whole control honest, and the wider picture sits in KYC and AML differences.

Frequently Asked Questions

What is AML screening?

AML screening checks customers, owners, and counterparties against sanctions lists, PEP data, watchlists, and adverse media. It helps firms spot prohibited or high-risk parties before and during a business relationship.

What is included in an AML check?

An AML check usually includes identity verification, sanctions screening, PEP screening, adverse media checks, and a risk assessment. For business customers, it also covers the company’s owners and directors.

What is the role of sanctions screening in KYC?

Sanctions screening is the KYC step that confirms a customer is not a sanctioned person or entity. Because sanctions duties are strict, a confirmed match stops onboarding and triggers an asset freeze and a report.

What is the difference between AML screening and transaction monitoring?

Screening checks who a customer is against risk lists, while transaction monitoring watches how money moves after the account is live. Screening uses identity and list data, and monitoring uses transaction data.

How often should AML screening be done?

Screen at onboarding, then again whenever a list changes or the customer’s details change. Many firms also re-screen high-risk customers on a schedule, but continuous monitoring catches new designations faster.

Do business customers need AML screening?

Yes. Firms should screen the entity, its board members, and its beneficial owners, because sanctioned or politically exposed people often hold assets through companies.

What is a false positive in AML screening?

A false positive is an alert that looks like a match but is not. It usually happens when a customer shares a similar name with a listed person, and analysts clear it by comparing secondary identifiers.

AML Screening Works When Review Is as Strong as the Search

Running names against lists is the easy part of AML screening. The real work is choosing the right sources, screening at the right moments, and clearing alerts quickly without missing the one that matters. So verify identity first, screen everyone who matters, tune thresholds on real data, and keep watching after onboarding. Then your team spends its time on genuine risk instead of noise.

Want screening that starts from a verified identity? Reach out to Verihubs to pair watchlist screening with verified identity and ongoing monitoring.