Sanctions Screening

The sanctions screening product does three things: it ingests lists from source, it matches, and it makes the result usable both from the API and from inside a fraud flow.

List coverage

Lists are pulled again every day from more than 400 sources. There are two kinds of source:

• Official publisher files — the list is pulled from the issuing authority's own file or API.
• OpenSanctions datasets — national and international lists whose official file is not pulled directly, and non-sanctions risk lists (PEP, wanted persons, debarments and so on), come from datasets published by OpenSanctions.

The main lists pulled directly from official publishers:

Further national sanctions, terrorism and debarment lists (e.g. Monaco, New Zealand, Czechia, Poland, Latvia, Azerbaijan, South Africa, Argentina, Iraq, Jordan, Brazil; the EBRD and US federal exclusion lists) are also pulled from their official publisher.

Data freshness is monitored: when a source has not updated within its expected interval, the freshness watchdog surfaces it. Screening against a stale list carries the same risk as not screening at all.

List publication

Pulled lists do not go straight into screening. List versions that pass quality checks together form a list publication; screening always runs against the publication active at that moment.

• Every screening pins the publication it read and returns it (publicationId, publicationRevision). "Which version of which lists did we screen this customer against" therefore has an exact answer.
• Every screening has an immutable evidence record (evidenceRef).
• The response states what the screening covered (coverageStatus, uncoveredRiskDomains). When no list covers a requested risk domain, the result is PARTIAL.
• With no active publication the screening is not run and there is no fallback to older data; the response is an error. Details: When screening cannot run.

Risk domains

Every list belongs to one or more risk domains. Screening covers every domain by default; narrow it with riskDomains if you need to.

Screening types

Indirect exposure

Looking for direct matches is not enough: a company owned by a sanctioned person may not be listed under its own name. The sanctions side maintains an identity/entity relationship graph, and sanction-indirect-exposure queries a subject's indirect connection to a sanctioned party.

Calling it from inside a fraud flow

Screening does not have to be a separate service call. Place it as a node in a fraud flow and the result feeds the decision directly:

This lets a policy like "block on a sanctions match, review on indirect exposure" live in a single flow. See Flows and Resolution.

What we do not do

• PEP coverage is a compilation. No government publishes a single official PEP list; PEP data is compiled from open datasets (such as OpenSanctions PEP collections, Wikidata and the Turkish Presidency's cabinet page). We do not claim this coverage is exhaustive.
• The lists field of a match tells you which lists it came from; uncoveredRiskDomains tells you which risk domains a screening did not cover.
• We do not quote a catch-rate percentage for name matching. Match quality depends on your own threshold and on the quality of the data you send; threshold tuning is covered in AML Screening.

Related

• Sanctions Screening API — endpoints, request/response contract, continuous monitoring
• AML Screening — risk domain and mode selection, threshold tuning
• Screening in the Panel — the panel's screening screens and the PDF report
• Adverse Media Screening — off-list reputational risk
• Screening History — access to past screening records