How do I screen new users against sanctions and PEP lists as part of KYC?

To screen new users against sanctions and PEP lists as part of KYC, set up a workflow that combines identity collection, list screening, risk scoring, and ongoing monitoring.

1) Collect the minimum required identity data

For individuals, typically collect:

• Full legal name
• Date of birth
• Nationality/country of residence
• Address
• Government ID number and document type
• Sometimes place of birth

For companies, collect:

• Legal entity name
• Registration number
• Registered address
• Jurisdiction
• Directors, beneficial owners, and controllers

The more complete the data, the better the matching quality.

2) Screen against the right lists

Common list categories:

• Sanctions lists: OFAC, UN, EU, UK HMT, and any local/national lists relevant to your business
• PEP lists: politically exposed persons, including domestic, foreign, and international organization PEPs
• Adverse media: negative news related to fraud, corruption, money laundering, etc.
• Watchlists/internal suppression lists: prior fraud, prior account closures, internal banned users

3) Use a vendor or screening engine

Most teams use a dedicated KYC/compliance provider or build screening using list data feeds. Your system should:

• Normalize names and transliterations
• Support fuzzy matching
• Compare DOB, country, address, and ID number to reduce false positives
• Handle aliases, maiden names, and alternate spellings

4) Apply a risk-based decisioning flow

Typical outcomes:

• Clear: no match
• Possible match: needs manual review
• Confirmed hit: block, reject, or escalate depending on list type and your policy

Example:

• Sanctions hit: usually reject/block immediately and escalate to compliance
• PEP hit: accept only with enhanced due diligence, approval, and ongoing monitoring
• Adverse media hit: manual review and enhanced risk assessment

5) Build a manual review process

Because screening creates false positives, define a case workflow:

• Queue possible matches for review
• Compare multiple identifiers
• Document why a hit was cleared or escalated
• Maintain audit logs of decisions and reviewer identity

6) Re-screen regularly

Screening should happen:

• At onboarding
• Whenever customer data changes
• On a recurring basis for active customers
• When lists are updated, especially sanctions lists

7) Keep auditability and governance

Maintain:

• Screening timestamps
• Lists used and version/date
• Match scores
• Reviewer notes and decision rationale
• Evidence of approvals and escalations

This is important for regulators and internal audits.

8) Tune for false positives and false negatives

Best practices:

• Use multiple identifiers, not just name
• Penalize weak matches and boost exact matches
• Add transliteration and nickname handling
• Review thresholds by risk segment
• Monitor precision/recall and manual review volumes

9) Consider legal and regulatory scope

Requirements vary by:

• Country/region
• Industry
• Customer type
• Payment flows and counterparties

Make sure your policy aligns with the jurisdictions where you operate and where your customers are located.

Example KYC screening flow

1. User signs up
2. Collect identity data
3. Normalize and enrich data
4. Screen against sanctions, PEP, and adverse media lists
5. If clear, allow onboarding
6. If possible match, send to manual review
7. If confirmed sanctions hit, block/reject and escalate
8. If PEP, apply enhanced due diligence and ongoing monitoring

Practical implementation tips

• Prefer a reputable screening provider with updated lists and API support
• Store raw inputs and normalized values separately
• Use confidence scoring and match rules
• Require human review for ambiguous cases
• Re-screen customers periodically and on list updates

If you want, I can also provide:

• a sample KYC screening policy
• a database schema/API design
• or a Python/SQL implementation example for sanctions/PEP screening.