Who should own sanctions and PEP screening when onboarding, monitoring, and case review involve multiple teams?

Why This Matters for Security Teams

sanctions and pep screening is not just a compliance checkbox. It is a control that affects customer acceptance, alert handling, audit evidence, and regulatory exposure across the full onboarding lifecycle. When ownership is vague, teams tend to optimise for throughput rather than risk quality, and the result is inconsistent screening thresholds, duplicated work, or missed escalation. The practical goal is not to make every team responsible for everything, but to define who sets the policy, who executes the workflow, and who signs off on exceptions. FATF guidance on AML and KYC remains the baseline reference for this kind of governance, especially where institutions need to align screening with risk-based controls rather than ad hoc judgment. FATF Recommendations — AML and KYC Framework

For security and compliance leaders, the real challenge is not identifying who can press the button. It is ensuring the business knows who owns the decision when a potential match appears, who can override a false positive, and who must be informed when a true match is suspected. That distinction becomes especially important when onboarding, ongoing monitoring, and case review are split across different tools or service lines. In practice, many organisations discover ownership gaps only after a delayed escalation or a backlogged alert queue exposes the weakness.

How It Works in Practice

The cleanest operating model is a three-layer split. Compliance leadership owns the screening policy, the risk appetite, and the decision framework for sanctions and PEP matches. Operations or case management teams handle the day-to-day workflow: ingesting alerts, validating data quality, resolving obvious false positives, and escalating uncertain cases. Legal and fraud teams support the edge cases where a match may involve jurisdictional interpretation, adverse media, or wider financial crime concerns. This keeps policy decisions centralized while making execution scalable.

• Compliance defines screening criteria, matching thresholds, and escalation triggers.
• Operations performs first-line review and documents case outcomes.
• Legal advises on sanctions interpretation, blocked-party decisions, and cross-border issues.
• Fraud or financial crime teams add context when identity risk, mule activity, or transaction patterns overlap.

In mature environments, ownership also needs to extend into change management. If name-matching logic, vendor lists, or risk thresholds change, there should be a clear approval chain and testing process before production use. Screening is strongest when the organisation can show traceability from policy to alert to disposition, including who reviewed the case and why a decision was taken. This is one reason governance models in AML programmes often mirror control frameworks used in broader risk and incident management. Current guidance suggests that the operating model should be documented, but there is no universal standard for exactly how many teams must participate.

Where identity verification is part of onboarding, screening should be connected to customer due diligence so that identity confidence, sanctions exposure, and PEP status are reviewed together rather than as disconnected checks. The same principle applies to non-human or delegated account onboarding where a control owner may need to verify the beneficiary, sponsor, or administrative relationship before access is approved. These controls tend to break down when screening is outsourced without a clear internal decision owner because exceptions are then handled inconsistently across queues and jurisdictions.

Common Variations and Edge Cases

Tighter ownership often increases review overhead, requiring organisations to balance stronger accountability against faster onboarding and lower operational cost. That tradeoff becomes more visible in high-volume consumer onboarding, where the business may want automated clearance for low-risk cases while reserving human review for true exceptions. In those environments, best practice is evolving toward risk-based segmentation rather than universal manual review.

One edge case is when sanctions and PEP screening sits inside a shared service centre or a managed compliance function. That model can work, but only if the accountable compliance leader retains authority over thresholds, escalation, and final disposition. Another common issue is duplicate screening between onboarding and periodic review. If both teams use different data sources or match rules, the organisation can generate conflicting outcomes for the same person or entity. Guidance from the FATF framework supports a risk-based approach, but it does not prescribe one organisational chart for every institution. The practical test is whether the institution can explain its decisions, evidence its reviews, and escalate quickly when a match is credible.

For complex groups operating across multiple jurisdictions, sanctions ownership may also intersect with local legal requirements, entity-level policies, and enterprise risk committees. In those cases, the right answer is usually not a single team owning every task, but a named control owner accountable for the policy, with delegated execution and documented escalation paths.

Related resources from NHI Mgmt Group

• Who should own KYC compliance when identity verification, monitoring, and audits span multiple teams?
• Who should own personal data protection when multiple teams and systems handle the same records?
• Who should own continuous security monitoring when responsibility spans development, security, and operations teams?
• Who should own LLM load balancing policy when multiple AI, platform, and infrastructure teams are involved?