9.1 Screening at Onboarding: Sanctions Lists, PEPs, and Known Fraudsters

CAFCA sub-topic 2.5 covers the principles and purpose of screening for sanctions, including what information indicates a sanctions concern and how to select the right list. It also covers PEPs, the risks they pose, and the difference between foreign and domestic PEPs, as well as fraudsters. Chapter 10 covers payment screening and matching algorithms. This section focuses on onboarding decisions.

Why each screen exists

Selecting the appropriate sanctions lists

A firm screens against the lists that legally bind it and those it accepts by contract or policy:

• Where it is established and licensed. US persons must comply with OFAC. EU firms apply EU restrictive measures, and UK firms apply UK sanctions. UN Security Council designations apply through each member state's implementing law.
• Currency and clearing exposure. Clearing US dollars brings a US nexus, so many non-US firms also screen OFAC lists.
• Where customers and counterparties are. Local regimes, such as those of Singapore or Hong Kong, may add designations.
• Partner-bank and card-network contracts, which often require specific lists.
• Beyond the SDN list. OFAC also maintains non-SDN lists with different restrictions, such as the Sectoral Sanctions Identifications list and the Foreign Sanctions Evaders list. Ownership rules differ too: OFAC's 50% rule versus EU and UK ownership-and-control tests.

Document which lists, which versions and how often they are refreshed. Unverified free lists from unofficial websites are not a substitute for official sources or reputable vendors.

Information that indicates a sanctions concern

• Name or alias match plus corroboration: date of birth, nationality, address, passport or registration number, or vessel IMO number.
• Geographic nexus: residence, address, IP or device location, or phone country code in a comprehensively sanctioned region.
• Ownership or control: designated persons who own the applicant entity alone or together, or who act as directors or signatories. That is a facilitation risk even where an ownership rule is not triggered.
• Evasion signals: recently formed companies linked to designated groups, nominee directors, obscured ownership, and inconsistent addresses.

A nationality linked to a sanctioned country is not, on its own, a designation. Treat it as a risk factor, check whether a regime targets that category of person, and avoid blanket discrimination that the law does not require.

PEPs: foreign, domestic and international organisation

FATF extends the measures to family members and close associates. Some regimes go further. The EU, for example, applies enhanced measures to all PEPs, including domestic ones. PEP status is not a ban. It means higher risk of corruption-linked funds, which is managed with EDD. After a person leaves office, decide on a risk basis how long to keep enhanced measures, rather than using a fixed time limit.

Screening for fraudsters

Use internal blocklists (previously exited fraudsters and mule accounts), consortium databases, and negative device, email and phone data. A match should prompt a decision: decline, step up the checks, or review manually. The basis must be documented, and the data must be used within the scheme's rules and privacy law.

Process essentials

1. Screen the applicant, beneficial owners, directors and authorised signers at onboarding.
2. Re-screen the whole customer base when lists update (delta screening) and whenever customer data changes.
3. Disposition every alert as a true match, false positive or possible match. Escalate possible matches. Document the identifiers used to discount a match (Chapter 14).
4. Escalate true sanctions matches immediately to the sanctions officer, and follow blocking, rejection and reporting rules.

Realistic exam scenario

An applicant's name matches an entry on the EU consolidated list, but the listed person was born 30 years earlier and has a different nationality. Separately, the applicant states that her husband is a serving deputy minister in another country. The analyst should discount the sanctions alert, recording the date-of-birth and nationality differences. She should classify the applicant as a family member of a foreign PEP, which requires EDD, senior approval, source of wealth and source of funds, and enhanced monitoring. The application is not automatically declined.

Common exam traps

• "PEPs are prohibited customers." They are higher risk, not prohibited.
• Screening only once at onboarding.
• Screening only the applicant, missing beneficial owners and directors.
• Treating nationality as a sanctions match.