Alert investigation and false positives
Most alerts are innocent lookalikes; the discipline is proving it with evidence — and recognising the rare true match that must be escalated.
IN ONE LINE
An everyday analogy: the investigation office receives a held visitor and a poster that looks a bit like them.
The job is a careful side-by-side comparison: name against name, birthdate against birthdate, papers against papers — with the reasoning written down as it goes.
Two failure modes bracket the work.
Keep stopping innocent people without ever clearing them, and the gate becomes useless and cruel.
Wave the real target through because the queue was long and the last two hundred holds were harmless, and the entire system has failed at the only moment it existed for.
The written record is what protects everyone later: it shows the release was earned by evidence, or the escalation raised in time.
WHAT IT ACTUALLY IS
Every alert resolves to a documented finding.
A false positive means investigation showed the alerted party is not the listed one — the payment is released or the customer cleared, with the evidence recorded.
A true match means the party is the listed person or entity — the alert escalates to sanctions compliance, where freeze, rejection, and reporting decisions are made under the applicable regime, with legal advice where the conclusion is not obvious; frontline investigators do not make that call alone.
A third outcome is honest uncertainty: the information at hand cannot settle it, so the investigator requests more — from the customer file, from the relationship manager, or from another bank in the chain — and the alert stays open until the answer arrives.
HOW IT WORKS
Practitioner standards are about evidence quality under time pressure.
"Not a match — common name" is not a disposition; the record states which identifiers were compared and what each showed: the list entry's birthdate versus the customer's verified one, the address history, the entity's registration number.
Releases pass a second pair of eyes, so no single person can clear a payment alone.
Consistency is engineered, not hoped for: procedures define what suffices to close each alert type, quality assurance samples closed alerts from both piles, and calibration sessions keep investigators aligned.
Some alerts cannot be settled by identifiers at all — a party who resembles no list entry but may be owned by listed persons raises an ownership question, and the linked escalation scenario shows why that goes to specialists rather than being closed at the front line.
THE WORDS
- False positive
- An alert that turns out not to be a real match — the flagged party merely resembles the listed one. Most screening alerts end this way.
- True match
- An alert confirmed on investigation as genuinely concerning the listed party, triggering blocking, rejection, or escalation under the applicable regime.
READ FIRST
CONNECTED TO
SOURCES
- Wolfsberg Group Sanctions Screening Guidance — The Wolfsberg Group
- Revised guidance on entities owned by persons whose property and interests in property are blocked (the 50 Percent Rule) — US Department of the Treasury, Office of Foreign Assets Control
- Payments Signal editorial teaching models — Payments Signal
Derived from Alert investigation and false positives. Every claim on this card is sourced on that page.