AML Screening: Customers, Payments and Transactions

AML screening is an umbrella term for checks designed to identify financial-crime, sanctions and reputational risk. Banks, payment firms, fintechs and other regulated businesses use it to compare customer and payment data against sanctions lists, politically exposed person, or PEP, data, and adverse media.

The term can be confusing because it covers different controls at different points in a relationship or payment flow. Customer screening assesses the people and businesses an institution serves. Payment or transaction screening assesses a specific transfer before it is released. Both are distinct from transaction monitoring, which searches account activity for patterns that may indicate suspicious behavior.

What AML screening checks

Screening engines compare names and other identifiers against data sources relevant to the institution's legal obligations and risk appetite. A match is not automatically evidence that a customer or payment is prohibited or suspicious. It is an alert that requires enough information and review to determine whether the records refer to the same person or entity.

• Sanctions screening checks official restrictive-measures lists. For a US-facing institution, this commonly includes US sanctions administered by the Office of Foreign Assets Control. EU firms must consider EU restrictive measures and, where applicable, national lists. The relevant coverage depends on the institution, its jurisdictions, currencies, customers and counterparties.
• PEP screening identifies people entrusted with prominent public functions, along with relevant family members and close associates where required. PEP status is not an allegation of wrongdoing. It generally calls for a risk-based assessment and, in higher-risk cases, enhanced due diligence.
• Adverse-media screening searches credible reporting and other relevant sources for allegations or evidence of financial crime, corruption, fraud, sanctions evasion or related misconduct. Unlike an official sanctions list, adverse media requires careful source assessment, context and corroboration.

Customer screening at onboarding and throughout the relationship

Customer screening is usually part of customer due diligence at onboarding. The firm collects identifying information, verifies identity where required, establishes beneficial ownership for legal entities, and screens the customer, owners, controllers and sometimes connected parties. The precise scope should reflect applicable rules and the product's risk.

The work does not end once an account is opened. Ongoing screening reruns customer records when sanctions, PEP or adverse-media data changes, and when the institution learns new information about the customer. It may also be triggered by periodic review or a material change, such as a new beneficial owner. Rescreening matters because a person or entity can be added to a sanctions list after onboarding, or new risk information can emerge.

Payment and transaction screening before execution

Payment screening, often called transaction screening, examines an individual payment before it is executed. It can assess payer and payee names, banks, intermediaries, account details, addresses, free-text payment messages and other available fields. The goal is to identify parties or details that may connect the transfer to a sanctioned person, entity, country, vessel or other restricted interest.

When a potential match is found, the payment may be stopped, held or routed for investigation, depending on the institution's rules and legal obligations. Reviewers use identifiers such as date of birth, address, nationality, registration number, bank identifier and ownership information to distinguish a true match from a similarly named but unrelated party. A confirmed match can require blocking, rejecting, reporting or another action under the applicable regime.

Transaction screening is not transaction monitoring

The terms are often used interchangeably, but they address different questions. Transaction screening asks whether this specific payment matches a risk list before the payment proceeds. It is primarily a name and identifier matching control tied to a payment event.

Transaction monitoring analyzes behavior across activity over time. It may identify unusual movement of funds, rapid transfers through an account, activity inconsistent with an expected customer profile, structuring of payments or links among accounts. Monitoring alerts can arise after transactions have occurred, although many systems analyze activity close to real time. An alert is investigated and, where warranted, can lead to a suspicious activity or suspicious transaction report under the relevant jurisdiction's rules.

From alerts to customer risk and enhanced due diligence

Screening outcomes should feed a documented customer risk rating rather than exist as isolated alerts. A confirmed PEP relationship, credible adverse media, exposure to higher-risk jurisdictions, complex ownership or recurring payment alerts may increase risk. Conversely, an alert cleared as a false positive should be recorded with the rationale and should not be treated as a risk finding.

A higher risk rating may lead to enhanced due diligence, or EDD. EDD can include obtaining more information on source of wealth and source of funds, understanding the purpose of the relationship, verifying ownership and control more deeply, obtaining senior-management approval where required, and applying more frequent review or monitoring. The measures should be proportionate to the identified risk and legal requirements.

Common screening problems

False positives are a persistent operational challenge. Names can be common, transliterated differently across alphabets, abbreviated or ordered inconsistently. Overly broad matching can generate large volumes of irrelevant alerts, slowing legitimate payments and obscuring genuine risks. Matching rules should balance sensitivity with precision, and reviewers need access to reliable identifiers.

Data quality is equally important. Missing dates of birth, incomplete legal-entity records, inaccurate payment fields and weak beneficial-ownership data make both matching and alert resolution harder. Institutions also need appropriate list coverage. Official lists should be updated promptly, while PEP and adverse-media sources need sufficient geographic, language and entity coverage for the institution's footprint. No data source is complete, so screening should operate alongside sound due diligence, monitoring, governance and human investigation.

AML screening is most effective when a potential match is treated as the start of a documented risk assessment, not as an automatic conclusion.