Screening system architecture
One filter, many callers: how watchlist feeds, matching engines, hold queues, and case management fit into the bank's payment estate.
IN ONE LINE
An everyday analogy: the gate is not one guard but a small system.
A poster room receives and organises the posters from every authority.
Scanners stand at each entrance — the front door, the parcel gate, the loading dock — all consulting the same poster room.
A waiting room holds anyone flagged.
And an investigation office gathers every piece of paper about one flagged visitor into a single file, so the decision is made once, with everything known, instead of three times with fragments.
The dangerous failure is silence: if a scanner loses its connection to the poster room and keeps waving people through, the gate looks open and working — and checks nothing.
Architecture is what makes that failure loud.
WHAT IT ACTUALLY IS
A screening platform has recognisable parts.
List management ingests issuer and vendor files, normalises them, and publishes the watchlist the engine runs on.
The matching engine scores names and generates alerts.
Integration connects the engine to its callers: the onboarding system, the payment engine for each rail, batch jobs for rescreening the customer base — some callers need a synchronous answer in seconds, others submit millions of records overnight.
An alert store and case management layer collects related alerts, evidence, and decisions into one investigable case with a full audit trail.
Management reporting sits across it all: volumes, backlogs, aging, and hit rates.
The parts can come from one vendor or several; the seams between them are where coverage gaps hide.
HOW IT WORKS
The hard practitioner questions are about behaviour under stress.
Latency: an instant-payment rail gives the whole bank seconds, so screening gets a strict slice of that budget, around the clock.
Failure posture: if the engine is down, does the caller queue payments until it recovers, or stop the rail — fail-open is rarely defensible for sanctions, and whichever posture is chosen must be documented and tested, not discovered during the outage.
Capacity: list updates after major geopolitical events produce alert spikes precisely when timeliness matters most.
Duplication: when the payment engine and a channel both screen the same payment, investigators see double alerts unless deduplication is designed in.
And configuration promotion — a threshold change tested in one environment must be verifiably the thing deployed to production.
THE WORDS
- Case management
- The workflow layer that holds alerts and investigations — assignment, evidence, decisions, and audit trail — from creation to closure.
READ FIRST
CONNECTED TO
SOURCES
- Wolfsberg Group Sanctions Screening Guidance — The Wolfsberg Group
- Payments Signal editorial teaching models — Payments Signal
Derived from Screening system architecture. Every claim on this card is sourced on that page.