Watchlist screening

Checking individuals, entities and beneficial owners against global lists of sanctioned and high-risk parties: sanctioned persons, politically exposed persons, terrorists, and entities connected to financial crime.

For AUSTRAC reporting entities it is an obligation: customers must be screened, and evidence of each check kept. Missed screening carries significant penalties.

For everyone else it is how you establish who you are about to do business with before funds move or a contract is signed. Suppliers, distributors and counterparties carry the same category of risk as customers, without the same regulatory prompt to look.

Eight sources, and you choose which of them a given check runs. The first four are the global watchlist categories, aggregated from hundreds of sources across more than 268 countries:

• Sanctions lists — issued by governments and international bodies, including the major regimes such as the OFAC SDN list
• PEP registers — politically exposed persons globally, with their roles and affiliations
• Criminal and regulatory watchlists — individuals and companies involved in regulatory breaches or criminal activity
• Adverse media — published coverage connecting a subject to financial crime, returned with an AI-generated summary of the findings

The other four screen against specific registers:

• Banned or disqualified persons — the ASIC banned and disqualified registers, together with the ATO register of disqualified SMSF trustees
• Court screening — Australian civil and criminal court records
• Business screening — an Australian business against ASIC and other business registers
• UK business screening — a business against UK Companies House records

Several sources can run in one check, but not every combination is valid. A person-only source cannot run alongside a business-only one, and Australian and UK business screening cannot run together because they need different business number formats. Which sources are available to you also depends on what is enabled on your account.

Each check returns its result per source, not as a single combined verdict, so you can see which one a match came from. A sanctions hit and an adverse media mention require very different responses.

By configuring the matching rules to your own risk appetite instead of accepting a fixed sensitivity, and by reading the match percentage instead of treating every hit alike.

Every match returns a percentage showing how closely the subject matches the record:

• 100% — an exact match on all compared fields
• 90–99% — a very close match, usually the same person with minor spelling or data variations
• 70–89% — a moderate match; could be the same person, or a different person with a similar name. Manual review is recommended.
• Below 70% — a loose match, more likely a different person, though still worth reviewing depending on your risk appetite

Name matching sensitivity, country filters and minimum match thresholds are all configurable, and looser settings return more results at lower percentages. Tightening them reduces noise and raises the chance of missing a genuine match, which is precisely why the setting is yours and not ours.

The match is surfaced for review with the evidence attached: which list it came from, the matched record, and the strength of the match.

Screening does not make the decision for you, and it should not. A name match against a sanctions list is a serious finding requiring immediate action; a partial match against a PEP register for a customer with a common name may be nothing at all. Both need a human to look.

What the system provides is a documented review trail: what matched, who assessed it, what they concluded and when.

Yes. Customers, entities and beneficial owners are all screened.

This matters because sanctions regimes apply to companies and vessels as well as people, and because ownership structures are a well-established way of putting distance between a sanctioned individual and a transaction. Screening a corporate customer's name alone will not surface a sanctioned party who controls it.

For AML/CTF purposes the obligation reaches the people who ultimately own or control a corporate customer, so identifying them and screening them as individuals is part of the same check, not a separate exercise.

Two different clocks are involved here, and it is worth separating them.

The lists themselves are updated regularly from hundreds of sources across more than 268 countries, so a new designation reaches the underlying data without you doing anything.

Your customers are re-screened against those lists on the schedule you set for each monitor: daily, weekdays, a nominated day, the 1st or 15th of the month, or quarterly. That run is what compares your book against the updated list and raises an event.

So the interval that determines your exposure is your monitor schedule, not the list refresh rate. A list updated overnight and a monitor set to quarterly means the match waits for the quarterly run. Where that gap matters, sanctions in particular, a daily monitor is the control, and most programs run their sanctions monitor considerably more often than their slower sources.

Every check, whether it produces a match or a clear result.

The clear results are the part organisations tend to overlook, and they are frequently the more important record. Demonstrating that a customer was screened on a particular date, against a particular list, and returned nothing is what answers the question an auditor asks, which is not "what did you find?" but "did you look?".

Each record includes what was checked, the source, the outcome, the timestamp and the operator, together with any event raised and the notes and status changes from its review.

How long that material is kept is set per program, from no retention up to 84 months (seven years), with a default of 12 months. Programs supporting an AML/CTF obligation should be set to the full period explicitly.

Three options, and most organisations use more than one:

• One-to-one lookup in the portal — a browser interface for individual screenings, with no setup
• API integration — screening built directly into your existing onboarding and payment workflows
• Ongoing monitoring through WatchEye — your customer base screened continuously against updated lists

The usual pattern is to start with portal lookups to establish the process, add the API where screening needs to sit inside an automated flow, and run WatchEye underneath both so that customers already onboarded do not stop being screened.