Wolfsberg Sanctions Screening Guidance 2019: Key Points

The Wolfsberg Group's guidance on sanctions screening, dated 2019, is one of the most practical documents available on how to run screening as a control rather than a source of endless false alerts. It explains what screening can and cannot do, how to tune it, how to handle the alerts it produces and when to look back at what it missed. This guide summarises each part and what it means for a compliance team.

What the guidance covers

The paper treats screening as one control inside a wider financial crime compliance programme. It covers the two main forms, customer or name screening and transaction screening, and addresses risk assessment, data, list management, technology, alert handling, testing, governance and lookbacks. It takes a risk-based approach and does not expect every institution to apply every element to the same degree. It states no numeric thresholds. Frequency guidance is qualitative, for example rescreening as often as daily where data changes frequently.

It is industry guidance, not law. Your legal obligations come from the sanctions regimes that apply to you, such as the programmes described in our guide to the OFAC framework for sanctions compliance programmes.

What screening is, and what an alert means

Screening compares strings of text to find possible matches. An alert is only the first step: it must be investigated to confirm or discount a true match. Alphabets, languages, aliases and fuzzy matching all make it harder to decide whether a match is real. The paper also warns that some programmes, such as sectoral sanctions, may not be detectable through screening alone, and that where information is not in a screenable format the firm should consider other controls.

Building a sanctions screening programme

The guidance applies the usual pillars of a compliance programme: policies and procedures, a responsible person, a risk assessment, internal controls and testing. Policies should explain how alerts are resolved when information is unavailable, incomplete or unreliable. System configuration should be documented, including any limitations and any risk-based exclusions. A firm begins by defining the specific sanctions risk it is addressing and assessing the inherent exposure of its products, services and customers.

Technology and productive alerts

Larger or more complex firms should use technology that supports risk-based rules, quality alerts, metrics, data integrity and independent testing. The key idea is tuning: making deliberate, documented decisions about list scope, exclusions, suppression lists and the removal of data that is no longer relevant. The firm should write down the reasons for its rules, thresholds and any risk it accepts. Alert handling should give trained reviewers all the relevant firm and list data, and reviewers should record their rationale. A second review by a different person is optional and depends on risk.

The paper also covers reporting and governance. Management information should show alerts by list, jurisdiction and business, and should expose data and list omissions. Independent testing should look at alert generation, thresholds, rules, and the accuracy and completeness of data, and the sanctions team should decide whether to remediate or accept the risk. On the choice between building and buying, it points to configurability, rule availability, support for non-Latin characters, workflow and metrics, and asks firms to confirm they will keep enough compliance and technology expertise.

Customer and name screening

Reference data includes customers, their beneficial owners and related parties, employees, third-party providers, the securities held in custody and recipients of donations or sponsorship. The guidance asks which attributes are relevant to the sanctions being screened. Names matter for list-based programmes. Addresses matter for geographic programmes and help separate true from false matches, and dates of birth can help distinguish matches. The firm should weigh the value of each attribute against how reliable the data is.

On timing, automated and repeated screening is the most effective, while manual screening can be acceptable for a small or low-risk population. A firm screens when it establishes a relationship and then on trigger events or when customer or list information changes.

Transaction screening

Transaction screening should prioritise cross-border payments and consider currency and routing. Cross-border payments should be screened in real time, before completion, at a point where the transaction can still be stopped. Domestic screening may be unnecessary where all parties are subject to the same local sanctions and customer due diligence requirements. Relevant data includes the parties, agents, intermediaries, vessels (including IMO numbers in trade finance), routing codes, free-text fields and trade documents. The paper says amounts, dates and transaction reference numbers have little screening value. Firms should also watch for points where information could be altered to evade screening, which matters in areas such as crypto sanctions evasion.

List management

List management covers selecting, sourcing and maintaining lists, enhancing the data, whitelisting, geographic scope, exact versus fuzzy matching and frequency. The paper notes that adding a new list can cause a spike in alerts. Firms should monitor how quickly and accurately vendors implement new designations against the regulators' own publications. Internal lists need minimum inclusion criteria and data quality standards, a time frame based on risk, and regular review. The paper treats identifying details such as date of birth and nationality as aids to assessing alerts that need not be screened, and says weak aliases, such as short or numeric names and nicknames, are generally not worth screening.

Lookbacks and conclusion

If screening missed a sanctions-relevant data point, the firm should consider whether to change its configuration or lists and whether to carry out a lookback. The factors include root cause, likelihood of recurrence, mitigation options, public policy or law enforcement interest, and possible enforcement or disclosure implications. The conclusion is that screening is a primary control with limits, and should be combined with non-screening controls, linked to the firm's risk appetite and supported by accurate data, governance, trained staff and quality assurance.

What we could not confirm

We read a published copy of the guidance rather than the Wolfsberg Group's own file. The copy gives the year 2019 but we did not check whether later updates exist, so check the Wolfsberg Group's website for the current version. For compliance staff who need to keep their knowledge current, our CPD courses cover related compliance topics.

Frequently asked questions

Does the guidance set a fuzzy-matching threshold?

No. It discusses when to use exact or fuzzy matching but gives no specific thresholds.

Should every transaction be screened?

It prioritises cross-border payments, which should be screened before completion. Domestic screening may be unnecessary where all parties are under the same local sanctions and customer due diligence requirements.

Is a second reviewer mandatory?

No. A maker-checker review is optional and depends on risk.

Can screening catch every sanctions programme?

No. Some programmes, such as sectoral sanctions, may need other controls because screening alone will not detect them.