Risk-based screening
The freeze obligation is absolute, but how a bank designs its screening control is a set of documented, defensible risk decisions.
IN ONE LINE
An everyday analogy: airport security checks everyone, but not identically — some passengers get a basic scan, others a detailed search, based on route and risk signals.
No one skips security entirely, and the rules about what is forbidden on a plane are the same for all.
Sanctions screening works the same way: the prohibition itself is absolute and applies to every customer and payment, but the intensity of checking — which lists, how sensitive the matching, how often customers are re-checked — is calibrated to the risk of the business.
A domestic savings bank and a bank clearing dollars for other banks face very different exposure, and are expected to make different, documented choices.
WHAT IT ACTUALLY IS
A risk-based approach means an institution assesses its sanctions exposure — customer base, products, geographies, currencies, and delivery channels — and designs its screening programme in proportion.
The obligation to freeze and to not make funds available is not risk-based; what is risk-based is the control machinery around it: which lists are screened, which data attributes, how fuzzy the matching is allowed to be, how frequently the customer base is rescreened, and where in the payment flow screening happens.
The Wolfsberg Group's guidance describes this explicitly: screening is one control within a wider programme, and its calibration should follow from the institution's own risk assessment rather than from a universal template.
Two well-run banks can therefore make different choices and both be defensible.
HOW IT WORKS
In practice the risk-based decisions are specific and must be written down.
Examples: whether to screen against lists of jurisdictions where the bank has no legal obligation but its correspondents care; whether weak aliases generate alerts or only enrich investigations; whether low-risk domestic retail payments get a lighter matching configuration than cross-border flows.
Each choice trades alert volume against the chance of missing a true match, and each needs an owner, a rationale, and periodic review.
The common failure is silent drift: thresholds tuned down during a backlog and never revisited.
Auditors and regulators ask for the risk assessment behind the configuration, not just the configuration — a setting nobody can explain is treated as a finding regardless of whether it was, in fact, sensible.
THE WORDS
- Risk appetite
- The level of residual risk an institution has decided it will accept, written down and approved, against which screening settings are justified.
- DNFBP (Designated Non-Financial Business or Profession)
- Non-bank businesses — such as lawyers, accountants, real-estate agents, and dealers in precious metals — that FATF brings within AML obligations.
READ FIRST
CONNECTED TO
SOURCES
- Wolfsberg Group Sanctions Screening Guidance — The Wolfsberg Group
- Payments Signal editorial teaching models — Payments Signal
Derived from Risk-based screening. Every claim on this card is sourced on that page.