Sanctions & Watchlist Screening

Sanctions & Watchlist Screening is a combined procedural and technological measure by which financial institutions identify and restrict transactions or relationships involving sanctioned or high-risk individuals, entities, or jurisdictions. It systematically compares customer and transaction data against official sanctions lists (e.g., UN, OFAC, EU), PEP records, adverse media sources, and internal watchlists. This process operates in real time or via scheduled batch checks, flagging or blocking potential matches to prevent unauthorized or illegal transactions. Integrated with KYC/CDD and transaction monitoring workflows, it enables compliance teams to investigate alerts, apply measures such as account freezing or transaction rejection, and perform enhanced due diligence. By disrupting illicit flows and ensuring compliance with AML/CFT standards, it helps protect the institution’s operations from misuse by sanctioned or high-risk parties and mitigates legal and reputational risks.

[
Code
M0005
]
[
Name
Sanctions & Watchlist Screening
]
[
Version
1.0
]
[
Application Level
Tactical
]
[
Functional Category
Onboarding & Customer‐Related Due Diligence
]
[
Client Lifecycle Stages
Ongoing Relationship, Onboarding, Pre-Onboarding Engagement, Ad Hoc Interaction, Post Alert
]
[
Created
2025-01-23
]
[
Modified
2025-04-02
]

Client Lifecycle Stages

CL0004
|
Ongoing Relationship
|

Periodic re-screenings or real-time screening of transactions.

CL0003
|
Onboarding
|

Standard practice to check prospective clients.

CL0002
|
Pre-Onboarding Engagement
|

Standard practice to check prospective clients.

CL0007
|
Ad Hoc Interaction
|

E.g., a one-time payment from a potential match to a sanctions list.

CL0005
|
Post Alert
|

Additional or repeated screening if suspicious events occur.

Mitigated Techniques

T0003.001
|
|

Regularly screen custodial mixer operators and their cryptocurrency addresses against applicable sanctions and regulatory advisories. If mixers are designated or blacklisted, immediately block or freeze related transactions to prevent inadvertent facilitation of sanctioned entities.

Screen beneficial owners, counterparties, and associated entities involved in foreign real estate transactions against sanctions lists, PEP databases, and adverse media before processing. Confirm that no restricted parties are exploiting cross-border real estate deals to disguise illicit capital or evade sanctions controls. Escalate flagged matches promptly for further investigation or action.

Conduct automated, real-time checks against sanctions databases and watchlists for new account registrations and cross-border transactions. Closely examine activity routed through high-risk or sanctioned jurisdictions, linking it to suspicious account openings or repeated personal data overlaps. Blocking or thoroughly vetting these connections interrupts illicit layering flows through mule accounts.

Maintain an internal watchlist of known anonymizing IP ranges, including Tor exit nodes, and systematically flag or block connections and transactions originating from these IP addresses. By screening anonymizing endpoints, institutions reduce criminals’ ability to exploit anonymous networking undetected.

T0015.002
|
|

Maintain and regularly update an internal watchlist of IP addresses known to be associated with open proxies, suspicious VPN endpoints, or anonymizing networks. Correlate login and transaction IP addresses against these updated lists in real-time to flag or block illicit activity and facilitate more timely investigative follow-up.

Screen charitable organizations, their management, and major donors against terrorism watchlists, global sanctions databases, and adverse media. This measure directly addresses infiltration risk by identifying potential extremist or sanctioned individuals early, preventing fund diversion to unauthorized entities.

T0020.001
|
|

Regularly screen remote mining providers, associated wallet addresses, and cross-border payments for sanctions or watchlist matches. Institutions should block or restrict transactions involving sanctioned entities or jurisdictions to prevent the use of these services for layering illicit funds.

T0023.002
|
|

Run sanctions/PEP screening with phonetic, diacritic, and transliteration logic so that minor spelling changes of a listed individual still trigger a match.

Individually screen each declared (or discovered) passport and nationality against relevant sanctions and watchlists. Investigate inconsistent or contradictory identity details, such as mismatched birthdates or unexplained passport origins, to detect possible misuse of multiple citizenships for evasion of scrutiny.

Regularly screen diamond exporters, importers, and associated carriers against conflict diamond watchlists, specialized sanction lists, and high-risk jurisdictions. Immediately review flagged or potentially restricted entities to prevent transactions with designated parties and ensure compliance with conflict diamond regulations.

T0051
|
|

Regularly screen customers and related parties for changes in PEP status or new adverse media referencing bribery, illicit enrichment, or embezzlement. Update beneficial ownership checks to detect concealed changes in control tied to corruption allegations. Promptly escalate any matches or material negative findings for further enhanced due diligence (EDD) or service restrictions.

Extend existing screening processes to include specialized anti-corruption and PEP databases. Any match or partial match indicating involvement in misappropriation or corruption triggers closer scrutiny of account flows and sources of funds. By linking standard sanctions screening with in-depth checks for known public-official misconduct, financial institutions can isolate and investigate high-risk clients tied to potential embezzlement of government resources.

Routinely screen suppliers, buyers, and shipping agents involved in precious metals or gemstone transactions against conflict mineral advisories, international sanctions lists, and negative media references. Flag or prohibit dealings with restricted entities to prevent illicit commodity flows.

Screen all prospective CBI/RBI applicants and associated beneficial owners against relevant sanctions and watchlists to identify individuals attempting to evade restrictions through second citizenship or residency. Investigate any matches thoroughly before proceeding to ensure compliance with international sanctions requirements.

Routinely screen the names, beneficial owners, and key stakeholders of entities operating in or transacting through high-risk jurisdictions against relevant sanctions lists, PEP databases, and adverse media. Immediately flag or restrict relationships involving sanctioned or suspicious parties to prevent the abuse of secrecy laws and weak oversight found in certain regions.

Screen all involved parties, including ultimate beneficiaries and intermediaries, against sanctions lists, adverse media, and internal watchlists. This tactic specifically targets front companies seeking to bypass financial sanctions by rotating letters of credit through multiple jurisdictions.

Screen all third-party payers or depositors against sanctions lists and watchlists. Immediately suspend or investigate transactions involving matches to high-risk jurisdictions, ensuring external payers cannot exploit unmonitored channels to conceal illicit funds.

Conduct periodic and event-driven screenings of diplomatic or state-owned entities, including their authorized representatives, against sanctions lists, adverse media, and PEP databases. Even when diplomatic immunity applies, this measure prevents individuals or organizations under sanctions or corruption investigations from bypassing controls.

Screen all trustees, beneficiaries, and signatories listed on trust accounts against sanctions and PEP databases. Expedite secondary investigations to confirm if any match indicates a sanctioned or politically exposed party attempting to conceal involvement through the fiduciary arrangement.

Screen junket operators, principals, and VIP clients rigorously against PEP databases, sanctions lists, and adverse media. Immediately flag and investigate irregularities to prevent individuals with political or sanction risks from leveraging junket programs for large-scale cross-border laundering or corrupt practices.

Screen newly formed or reconfigured corporate entities, board members, and beneficial owners against sanctions lists, watchlists, and adverse media databases. Establish enhanced monitoring to identify attempts at sanctions evasion through layered or newly created entities that shift funds across different regions. Block or freeze activity tied to any sanctioned parties or regions known to enable corporate secrecy.

Screen mobile wallet accounts, prepaid card issuers, and crypto wallet addresses against sanction lists, adverse media, and known high-risk jurisdictions. Block or restrict accounts that show matches or close links to sanctioned entities, ensuring no regulatory breaches occur via alternative payment routes.

Screen all customer accounts and transactions in real-time or batch processes against relevant sanctions lists (e.g., OFAC, UN, EU) to promptly detect restricted entities or high-risk jurisdictions. For any matches or near matches, institute immediate follow-up verification, freeze or reject transactions as appropriate, and escalate to specialized compliance teams for additional review. This ensures sanctioned parties cannot exploit front or shell companies to bypass restrictions.

Incorporate specialized watchlists and adverse media sources that track organizations and individuals involved in illegal commodity dealings, such as wildlife trafficking or conflict minerals. Screen onboarding customers, existing accounts, and transactions against these lists to detect and block relationships or payments tied to blacklisted traffickers, thereby curtailing illicit flows at key choke points.

T0143.002
|
|

Continuously screen customers, counterparties, and payment details against arms embargo lists, watchlists of known weapons traffickers, and conflict-zone sanctions. Promptly block or freeze assets when matching sanctioned persons or entities to prevent funds from facilitating illicit arms transactions.

T0148
|
|

Screen all participants in maritime-related transactions against watchlists that cover known pirate organizations, extremist groups, or sanctioned entities. In instances of flagged matches, such as recognized pirate negotiators or affiliates, immediately freeze or escalate the transaction to restrict pirates' ability to receive ransoms through the financial system.

References

  1. Noémi També. (2023). Institutional Proliferation Finance Risk Assessment Guide. Royal United Services Institute for Defence and Security Studies. http://www.rusi.org

  2. També, N., Alsancak. F. (2024). Challenges for counter-proliferation finance and sanctions control in banking. Royal United Services Institute for Defence and Security Studies. https://www.rusi.org/explore-our-research/publications/special-resources/challenges-counter-proliferation-finance-and-sanctions-control-banking