Transaction and Payment Screening

Transaction and Payment Screening

Transaction (payment) screening is real-time sanctions screening of payment messages in flight, before settlement. It is distinct from transaction monitoring (covered next), which looks at patterns of activity after the fact to detect money laundering. Payment screening answers a single urgent question: does this payment involve a sanctioned party, country, or item, such that it must be stopped before the money moves?

What gets screened

A payment message — a SWIFT MT103 customer credit transfer or its ISO 20022 successor pacs.008 — contains multiple parties and free-text fields, and all of them are screened, not just the named beneficiary:

Block versus reject

When a real hit is confirmed, the correct action depends on the sanctions program. Under OFAC, property in which a blocked person has an interest must be frozen (blocked) — the funds are held in a blocked account and cannot be returned to the sender. For payments merely involving a sanctioned jurisdiction without a blocked-person interest, the bank may reject the payment (return it without processing). Confusing block and reject is a classic exam trap: a blocked transaction must be reported to OFAC within 10 business days, and a year-end report of blocked property is due by September 30.

Screening is not a SAR decision

A confirmed sanctions hit triggers a sanctions action (block/reject and OFAC reporting), which is separate from the suspicious-activity reporting regime. The two can both apply, but they are different obligations. On CAMS, do not answer "file a SAR" for a clean sanctions block; the immediate duty is to stop the payment and file the OFAC report.

Sanctions evasion through data stripping

A major enforcement theme is stripping — removing or altering originator/beneficiary information from payment messages so that screening filters do not fire. This practice is the basis of several of the largest correspondent-banking penalties on record. Detecting cover payments (MT202COV) and incomplete originator data is therefore a core control, reinforced by FATF Recommendation 16, the "travel rule," which requires complete originator and beneficiary information to accompany wire transfers.

Worked scenario

A same-day MT103 names a beneficiary that exactly matches an OFAC SDN entry, confirmed by address. The funds have not yet been released. The correct CAMS workflow: hold the payment, confirm the match, block the funds (do not return them to the originator), notify the sanctions/compliance officer, and file the OFAC blocking report within 10 business days. Releasing the payment "because the customer is long-standing" is wrong; so is quietly returning the funds, which would be an unauthorized release of blocked property.

Real-time screening and the cost of false positives

Payment screening must be fast — it sits in the live payment flow, and every alert holds a payment until an analyst clears it. This creates intense pressure to minimize false positives without weakening coverage. The same fuzzy-matching and threshold considerations from batch screening apply, but with an added time dimension: a payment held too long can breach settlement deadlines and harm customers, while a payment released too quickly can violate sanctions.

Institutions therefore staff real-time screening for prompt review and use disambiguation data, whitelists of cleared true non-matches, and tuned thresholds to keep legitimate payments moving while still stopping true hits.

Comprehensive sanctions, 50% rule, and jurisdictions

Screening is not only about named individuals. Comprehensive (country) sanctions prohibit dealings with entire jurisdictions, so country and address fields matter as much as party names. OFAC's 50 Percent Rule extends blocking to any entity owned 50% or more, directly or indirectly, by one or more blocked persons — even if that entity is not itself named on the SDN list. A payment to an unlisted company can therefore still require blocking if its ownership traces back to sanctioned parties, which is why screening must connect to beneficial-ownership data rather than treating list-name matching as sufficient.

Governance and escalation

Like all controls in this chapter, payment screening operates under documented procedures: clear hold-and-investigate steps, defined escalation to the sanctions officer, recordkeeping of every hit and disposition, and independent testing of filter coverage. Confirmed blocks are reported to OFAC within 10 business days, and blocked property is reported annually by September 30.

Common traps

• Screening only the beneficiary and missing intermediary banks or free-text references.
• Returning (rejecting) funds that should have been frozen (blocked) under OFAC.
• Treating a sanctions hit as merely a SAR matter and missing the OFAC reporting deadline.
• Forgetting the 50% rule, so a payment to an unlisted but sanctioned-owned entity is released.
• Overlooking stripped or incomplete originator data, which is itself a red flag for evasion.