A sanctions or PEP screening tool is only as good as its lists, its matching and how quickly it picks up changes, and most failures regulators describe come from exactly those three gaps. OFAC's own compliance framework lists screening software faults, failure to update lists and missed alternative spellings among the root causes of past breakdowns. This vendor-neutral buyer's guide helps compliance, financial crime and technology teams choose screening tools for customer onboarding, ongoing monitoring and payments. It covers list data and coverage, fuzzy matching, adverse media, PEP data, ownership screening and how to test accuracy in a proof of concept. The regulatory obligations themselves are explained in the CDD, EDD, PEP and sanctions screening guide, which this page does not repeat.
Key takeaways
- List freshness is a control: measure the time from an official list change to it being live in your screening, for every list you depend on.
- Test matching on your own data: false positive and false negative rates depend on your customer base, scripts and data quality, not on vendor benchmarks.
- Ownership matters as much as names: under OFAC's 50 Percent Rule an entity owned 50% or more in aggregate by blocked persons is blocked even if it is not on the list.
- Explainability decides audit outcomes: every alert and every discount decision must show which list entry, which fields and which score drove it.
- PEP and adverse media data vary widely: compare coverage, sourcing and update practice on a sample of your own markets before buying.
Define requirements
- Screening points: onboarding, periodic and event-driven rescreening of the whole customer base, payment and transaction screening, supplier and third-party screening, and employee screening where policy requires it.
- Regimes and lists: which authorities apply to you. Typical sets include OFAC's SDN and Consolidated Non-SDN lists, the UK Sanctions List published by the FCDO (since 28 January 2026 the only source for UK designations, after the OFSI Consolidated List closed), the EU consolidated financial sanctions list and the UN Security Council Consolidated List, plus national lists in your markets.
- PEP scope: foreign and domestic PEPs, family members and known close associates, and how long former PEPs stay in scope. In the UK, for example, regulation 35 of the Money Laundering Regulations 2017 keeps measures in place for at least 12 months after a PEP leaves office.
- Volumes and latency: customer records, daily changes, payment messages per second at peak, and the response time payments can tolerate.
- Data and scripts: languages and scripts in your customer data (Cyrillic, Arabic, Chinese and others), transliteration needs, and data quality issues such as missing dates of birth.
- Deployment and data protection: SaaS or on premises, data residency, and whether customer data can leave your environment.
- Operating model: alert volumes your team can handle, four-eyes review, case management and regulatory reporting.
Capability areas
| Area | What to look for |
|---|---|
| Sanctions list data | Direct ingestion from official sources (for example OFAC's Sanctions List Service and the FCDO's XML and CSV downloads), delta handling, timestamps on each list version, historic versions for look-backs |
| Ownership and control | Data on entities owned 50% or more in aggregate by sanctioned persons, with ownership chains shown; flags for control without majority ownership |
| PEP data | Coverage by country and role level, family and close associate links, start and end dates of roles, sources cited for each profile |
| Adverse media | Source breadth and languages, deduplication, relevance categories (financial crime, corruption, terrorism), entity resolution so articles attach to the right person |
| Name matching | Fuzzy, phonetic and transliteration matching, handling of name order, titles, initials and aliases, configurable thresholds per list and per segment |
| Secondary identifiers | Use of date of birth, nationality, address, vessel IMO numbers, business identifier codes and registration numbers to score and discount matches |
| Payment screening | Real-time screening of payment messages including structured ISO 20022 party and address fields, free text, countries, ports and vessels, with hold and release workflow |
| Ongoing monitoring | Automatic rescreening when a list changes or a customer record changes, without full batch reruns |
| Case management | Alert triage, evidence capture, four-eyes approval, audit trail and reporting to regulators |
| Tuning and testing | Sandbox for threshold changes, test data sets, before and after impact analysis, model documentation |
| Integration and security | APIs for onboarding and payment systems, SSO and role-based access, scoped API credentials, full logging |
Evaluation criteria
| Criterion | Illustrative weight | How to evidence it |
|---|---|---|
| Match accuracy on your data | 25% | True positive capture on a seeded test set and false positive rate on a sample of real customers |
| List coverage and freshness | 20% | List inventory with sources, measured lag from publication to live screening over the trial period |
| PEP and adverse media quality | 15% | Blind sample of known PEPs and negative news subjects in your markets |
| Explainability and audit | 15% | Alert detail, decision history, exportable model and threshold documentation |
| Payment performance | 10% | Latency at peak volume, behaviour when the service is degraded |
| Operations and case management | 10% | Analyst time per alert, workflow fit, reporting |
| Commercials and data terms | 5% | Pricing metric, data licence limits, exit and data return |
Weights are illustrative. A payments business will weight latency and payment screening higher; a wealth manager will weight PEP depth and adverse media higher. OFAC does not recommend a specific match threshold and expects firms to set thresholds from their own risk assessment, so the tool must let you set, test and justify them.
Questions to ask vendors
- For each list we need, what is the source, how do you detect a change, and what was your median and worst lag from official publication to live screening last quarter?
- How do you represent the OFAC 50 Percent Rule, including aggregated and indirect ownership, and where does that ownership data come from?
- Show us how a match score is calculated for a transliterated name with a partial date of birth. Which fields influence the score and which only discount?
- Can thresholds differ by list, customer segment and screening point, and how do you test the effect of a change before it goes live?
- How are PEP profiles sourced and verified, what role levels do you cover in our countries, and how do you record end dates?
- How does adverse media avoid attaching articles to the wrong person with the same name?
- What happens to payment screening if your service or a list feed is unavailable? Do payments fail closed?
- Can we rescreen our entire customer base against a single new designation within hours?
- Can we export all alerts, decisions and configuration history for a regulator or independent tester?
- How do you protect our customer data, which subprocessors see it, and where is it stored?
Red flags
- No clear list inventory or no timestamps showing which list version screened a record.
- Matching described as proprietary with no explanation of scoring or how to tune it.
- Exact or near-exact matching only, with no transliteration or alias handling.
- No ownership data, or ownership limited to entities named on official lists.
- Vendor-supplied accuracy figures with no offer to test on your data.
- Thresholds set by the vendor and not changeable or testable by you.
- Payment screening that fails open when the service is degraded.
- PEP profiles with no sources or no role dates.
Proof of concept
- Build a test set: a sample of real customers (pseudonymised where policy requires), plus seeded true matches drawn from each official list, with spelling variants, transliterations, reordered names and missing identifiers.
- Add ownership cases, including entities owned through intermediaries, and payment messages with sanctioned parties in structured fields and in free text.
- Run all candidates at agreed thresholds and record true positives, false negatives and false positives per list and per scenario.
- Measure list freshness over the trial: note each official list change and when each tool reflected it.
- Test PEP and adverse media on a blind sample from your markets, scoring coverage and relevance.
- Have analysts work a day's alerts in each tool and record time per alert and the quality of the audit trail.
- Load test payment screening at peak volume and test failure behaviour.
- Document results, threshold rationale and remaining gaps so the selection itself is defensible to an examiner.
How NHI Mgmt Group can help
We provide independent requirements, RFP and evaluation support across identity verification, fraud prevention, customer identity and screening controls. Browse vendors in our products directory or contact us.
Related NHI Mgmt Group resources: CDD, EDD, PEP and sanctions screening · KYB Guide · AML programme and transaction monitoring · EU AML Regulation and AMLA Guide