Alert investigation and false positives
Most alerts are innocent lookalikes; the discipline is proving it with evidence — and recognising the rare true match that must be escalated.
L0 Explain simply
An everyday analogy: the investigation office receives a held visitor and a poster that looks a bit like them. The job is a careful side-by-side comparison: name against name, birthdate against birthdate, papers against papers — with the reasoning written down as it goes. Two failure modes bracket the work. Keep stopping innocent people without ever clearing them, and the gate becomes useless and cruel. Wave the real target through because the queue was long and the last two hundred holds were harmless, and the entire system has failed at the only moment it existed for. The written record is what protects everyone later: it shows the release was earned by evidence, or the escalation raised in time.
L1 Core concepts
Every alert resolves to a documented finding. A false positive means investigation showed the alerted party is not the listed one — the payment is released or the customer cleared, with the evidence recorded. A true match means the party is the listed person or entity — the alert escalates to sanctions compliance, where freeze, rejection, and reporting decisions are made under the applicable regime, with legal advice where the conclusion is not obvious; frontline investigators do not make that call alone. A third outcome is honest uncertainty: the information at hand cannot settle it, so the investigator requests more — from the customer file, from the relationship manager, or from another bank in the chain — and the alert stays open until the answer arrives.
L2 Practitioner view
Practitioner standards are about evidence quality under time pressure. "Not a match — common name" is not a disposition; the record states which identifiers were compared and what each showed: the list entry's birthdate versus the customer's verified one, the address history, the entity's registration number. Releases pass a second pair of eyes, so no single person can clear a payment alone. Consistency is engineered, not hoped for: procedures define what suffices to close each alert type, quality assurance samples closed alerts from both piles, and calibration sessions keep investigators aligned. Some alerts cannot be settled by identifiers at all — a party who resembles no list entry but may be owned by listed persons raises an ownership question, and the linked escalation scenario shows why that goes to specialists rather than being closed at the front line.
L3 Technical details
Machinery that keeps investigation defensible: disposition taxonomies with reason codes, so outcomes are analysable rather than free-prose; investigation time targets differentiated by rail, because an instant payment and a batch file give different clocks; and previously-adjudicated-match registers that stop the same innocent namesake burning hours weekly — governed with expiry dates and automatic re-review when the list entry or the party's data changes. Ownership escalations follow their own track: the question "is this unlisted entity owned 50 percent or more by blocked persons" is researched with beneficial-ownership data and, where it matters, legal advice — under OFAC's rule, ownership by blocked persons aggregates across owners, so two listed persons at 25 percent each block the entity. Every element leaves an audit trail a regulator can replay.
Sources & standards2
- Official requirement
Revised guidance on entities owned by persons whose property and interests in property are blocked (the 50 Percent Rule) ↗ — US Department of the Treasury, Office of Foreign Assets Control · Aggregate ownership of 50 percent or more by one or more blocked persons
The rule speaks to ownership, not control; OFAC FAQs 398-402 elaborate on aggregation and indirect ownership.
- Market practice
Wolfsberg Group Sanctions Screening Guidance ↗ — The Wolfsberg Group · Alert handling by trained sanctions personnel; suppression and exclusion criteria
Wolfsberg guidance is industry market practice, not law; institutions vary in how they apply it.
L4 Standards & sources
What the source material establishes: the Wolfsberg Group guidance treats an alert as a starting point for review by trained sanctions personnel, never as a conclusion, and frames suppression rules and exclusion criteria as risk-based decisions the institution must own and document. Confirmed outcomes carry reporting duties that vary by regime: in the United States, reports of blocked property and rejected transactions must reach OFAC within 10 business days of the action, under its reporting regulations; EU and UK frameworks require reporting of freezes to the relevant competent authority — OFSI in the UK — on their own terms. The framing matters: investigation quality is a market-practice expectation, while reporting a confirmed match is a legal obligation with deadlines, which is why escalation paths to sanctions compliance are built for speed as well as accuracy.
Sources & standards3
- Market practice
Wolfsberg Group Sanctions Screening Guidance ↗ — The Wolfsberg Group · Alert generation and handling
Wolfsberg guidance is industry market practice, not law; institutions vary in how they apply it.
- Official requirement
OFAC Frequently Asked Questions ↗ — US Department of the Treasury, Office of Foreign Assets Control · Filing blocking and reject reports with OFAC within 10 business days
FAQs are added, amended, and renumbered over time; always check the live page for current numbering and text.
- Official requirement
UK financial sanctions general guidance ↗ — Office of Financial Sanctions Implementation, HM Treasury · Reporting obligations to OFSI for frozen assets
General in nature; regime-specific guidance and the underlying UK regulations take precedence over it.
Sources for this topic3
- Market practice
Wolfsberg Group Sanctions Screening Guidance ↗ — The Wolfsberg Group · Alert generation and handling
Wolfsberg guidance is industry market practice, not law; institutions vary in how they apply it.
- Official requirement
Revised guidance on entities owned by persons whose property and interests in property are blocked (the 50 Percent Rule) ↗ — US Department of the Treasury, Office of Foreign Assets Control · Entities owned by blocked persons
The rule speaks to ownership, not control; OFAC FAQs 398-402 elaborate on aggregation and indirect ownership.
- Simplified educational illustration
Payments Signal editorial teaching models — Payments Signal
What this simplifies: Investigation workflows are generalised across institutions that differ in team structure, tooling, and evidence standards. The ownership example uses round percentages and a two-owner structure; real analyses involve longer chains and incomplete data, and whether any specific entity is in scope is a legal conclusion this site never draws. All parties in the linked scenarios are fictional.
Used wherever diagrams, scenarios, figures, or example values are didactic constructions rather than sourced facts; every such use carries a simplifications disclosure. All people, companies, banks, and list entries in examples are fictional.
Deepest material on this page: L4 — Standards & sources. Where a topic stops short of implementation depth, that is a deliberate coverage decision, not an oversight — see coverage.