Sanctions and PEP Screening: How to Build a Process You Can Defend
Rajesh Kumar
A defensible screening process names the lists you check, screens customers, owners and relevant counterparties at onboarding and again when lists or circumstances change, works every alert through the same documented steps, escalates anything it cannot clear, and keeps a record of who decided what and why. A confirmed sanctions match means freezing without delay, not tipping off and reporting through the channels set out in current official guidance.
Key takeaways
- Screening has two jobs: complying with sanctions and identifying politically exposed persons so you can apply extra care.
- Write down which lists you use, how often you re-screen and who is responsible. Vague answers fail reviews.
- Most alerts are false positives. What matters is that each is cleared consistently and with a recorded reason.
- A confirmed match is urgent. Know in advance who acts and how, because there is no time to work it out on the day.
- A cleared alert with no record is, to a reviewer, an uncleared alert.
What screening is for
Screening serves two purposes that are often mixed together. The first is sanctions compliance: making sure you do not deal with, and do promptly freeze the assets of, persons and entities that appear on the sanctions lists you are required to follow. The second is the identification of politically exposed persons, so that you can apply a higher level of scrutiny to relationships that carry greater risk of corruption and misuse.
The two have different consequences. A sanctions match can require immediate action. A politically exposed person is not wrongdoing in itself, and many are entirely legitimate customers, but the relationship needs more care. A good process keeps them separate in its logic and its records.
Which lists and sources to use
At a minimum, UAE businesses are generally expected to screen against the United Nations Security Council consolidated list and the UAE local terrorist list, and to follow the guidance of the Executive Office for Control and Non-Proliferation, which publishes the official sources and the notification routes. Some firms add other lists because of their customers, their banking partners or their markets. That is a business decision, and it should be a conscious one that is recorded in your procedure.
Use official sources for the lists themselves, and check that your copy is current. If you rely on a commercial tool, confirm which lists it covers and how quickly it updates, and do not assume that its coverage matches your obligations. For politically exposed persons there is no single official list, so firms combine commercial data, public sources and their own judgement. Whatever you choose, document it.
Who to screen, and when
- At onboarding: the customer, every beneficial owner, director and authorised signatory, and any other party who has a significant role in the relationship.
- On a schedule: re-screen your whole customer base regularly. How often depends on your risk, but it must be defined and followed.
- When lists change: new designations can appear at any time. Your process should catch them quickly, either by continuous screening or by re-screening promptly when the lists are updated.
- On events: a change of ownership, a new signatory, a new counterparty or a payment to an unfamiliar party should each trigger a fresh check.
- Counterparties where relevant: if you process or arrange payments, consider screening the other side as well, not only your own customer.
Manual or automated?
A small firm with few customers can screen manually against the official lists if it follows a clear method and records each check. Once volumes grow, manual screening becomes error-prone, and a tool is sensible. Tools are not magic. They need careful configuration, because settings that are too loose bury your team in noise and settings that are too tight miss genuine matches. Good results also depend on good data. Names transliterated inconsistently, missing dates of birth and nationalities, and shortened company names all reduce accuracy.
Whichever route you take, test it. Create a few dummy records with names close to listed entries and check that the system alerts on them. Keep the test results. It is excellent evidence that your process works as intended.
Working through an alert
Most alerts will be false positives, caused by common names, partial matches or similar spellings. The aim is not to avoid alerts. It is to resolve each one the same way every time, using the same evidence, and to leave a trail.
- Log the alert with a date, a reference and the list that produced it.
- Compare every identifier you hold against the listed entry: full name, date and place of birth, nationality, passport or identity numbers, address, and for entities the registration number, country and activity.
- Decide the outcome using defined categories, shown in the table below.
- Write the reasoning in plain words, naming the identifiers that were compared and how they differ or match.
- Have a second person review any decision that clears a close call, and have the compliance officer approve anything escalated.
- File the record with the customer file.
| Outcome | What it means | What happens next |
|---|---|---|
| Clear | Identifiers show the customer is a different person or entity | Record the reasoning and close. No further action. |
| Escalate | You cannot rule the match in or out with the information you hold | Gather more information, involve the compliance officer, and consider a partial name match report. |
| Possible match | Several identifiers match but not all, or identifiers are missing | Treat with urgency. Pause the relationship or transaction where appropriate and follow current official guidance on notification. |
| Confirmed match | The customer or counterparty is the listed person or entity | Freeze without delay, do not deal, do not tip off and report through the channels set out in current official guidance. |
Politically exposed persons
A politically exposed person is someone who holds, or has held, a prominent public function, and the definition normally extends to close family members and close associates. The category is broad and can include domestic and foreign officials, senior figures in state-owned bodies and members of political parties and international organisations. Check the exact definition in the rules that apply to you.
Being a politically exposed person is not a reason to refuse a customer. It is a reason to apply enhanced measures: senior approval before onboarding, a closer look at the source of wealth and the source of funds, and tighter ongoing monitoring. Document why you accepted the relationship and what extra steps you took. Think too about how long to keep applying the measures after someone leaves office, and write that down as a policy rather than deciding case by case.
If you find a confirmed or possible sanctions match
This is the one part of screening where time matters most. The expectation is that assets of a listed person are frozen without delay, that you do not deal with them, and that you tell the authorities through the proper route. Current guidance describes the expected speed and the reports to submit, including the funds freeze report and the partial name match report, so check it now rather than during an incident. Make sure that people know in advance who has authority to freeze, who files the report and how, and that nobody speaks to the customer about it.
Rehearse it. A short exercise once a year, in which the team talks through a hypothetical confirmed match and sees whether everyone knows their part, is worth far more than a paragraph in a manual.
Records that make decisions defensible
A reviewer will pick alerts at random and ask you to show what happened. For each, you should be able to produce the following.
- The date and time of the alert and the list or source that produced it.
- The person or entity screened and the identifiers used.
- The identifiers on the listed entry and how they compared.
- The outcome, the reasoning and the name of the person who decided.
- Any second review or escalation, with dates.
- For clear outcomes, enough detail that someone else would reach the same conclusion.
Mistakes to avoid
- Screening only at onboarding and never again.
- Relying on a tool without knowing which lists it covers or how often it updates.
- Leaving owners, directors and signatories out of scope.
- Closing alerts with a one-word reason, or no reason at all.
- Treating a politically exposed person as an automatic refusal, or as no different from anyone else.
- No plan for a confirmed match, and no named person with authority to act.
- Never testing the system with realistic dummy records.
In-house or outsourced?
Many firms keep decisions in-house but outsource the heavy first-line work. A provider reviews raw alerts, clears the obvious false positives against a documented method and escalates the rest to your compliance officer. That can save time and improve consistency, provided the provider follows your written criteria and you still own the decisions that matter. Whatever you outsource, check the quality: sample a set of cleared alerts every quarter and see whether you would have reached the same decision.
Where Adventant fits
Adventant helps firms run sanctions and PEP screening, from writing alert-handling procedures to reviewing alerts on your behalf through our operational outsourcing service. Use the form below to tell us what you need. This article is general information, not legal advice. Sanctions obligations carry serious consequences and change often, so check current official guidance for your sector.
Frequently asked questions
Which sanctions lists must UAE businesses screen against?
UAE businesses are generally expected to screen against the United Nations Security Council consolidated list and the UAE local terrorist list, and to follow the guidance of the Executive Office for Control and Non-Proliferation. Some firms add other lists based on their customers and markets. Confirm what applies to your sector.
How often should I screen my customers?
At onboarding, then regularly and whenever lists or circumstances change. How often depends on your risk, but the frequency must be defined, followed and recorded. Continuous screening is one way to catch new designations quickly.
Is a politically exposed person a reason to refuse a customer?
No. It is a reason to apply enhanced measures, such as senior approval, closer checks on the source of wealth and funds and tighter monitoring, and to record why you accepted the relationship.
What should I do if I find a possible sanctions match?
Treat it as urgent, escalate to your compliance officer, do not tell the customer, and follow current official guidance on freezing and reporting, including the partial name match report where relevant. Plan this in advance so people know their roles.
What records should I keep for cleared alerts?
The date, the list, the identifiers compared, the outcome, your reasoning and the name of the person who decided, plus any second review. A reviewer should be able to reach the same conclusion from the record alone.