GLOBAL PAYMENTS KNOWLEDGEISO 20022 / SWIFT / SEPA / MT / MX
01 / INVESTIGATION & GOVERNANCE12 MIN

Alert investigation and false positives

Most alerts are innocent lookalikes; the discipline is proving it with evidence — and recognising the rare true match that must be escalated.

NOT STARTED

L0 Explain simply

An everyday analogy: the investigation office receives a held visitor and a poster that looks a bit like them. The job is a careful side-by-side comparison: name against name, birthdate against birthdate, papers against papers — with the reasoning written down as it goes. Two failure modes bracket the work. Keep stopping innocent people without ever clearing them, and the gate becomes useless and cruel. Wave the real target through because the queue was long and the last two hundred holds were harmless, and the entire system has failed at the only moment it existed for. The written record is what protects everyone later: it shows the release was earned by evidence, or the escalation raised in time.

L1 Core concepts

Every alert resolves to a documented finding. A false positive means investigation showed the alerted party is not the listed one — the payment is released or the customer cleared, with the evidence recorded. A true match means the party is the listed person or entity — the alert escalates to sanctions compliance, where freeze, rejection, and reporting decisions are made under the applicable regime, with legal advice where the conclusion is not obvious; frontline investigators do not make that call alone. A third outcome is honest uncertainty: the information at hand cannot settle it, so the investigator requests more — from the customer file, from the relationship manager, or from another bank in the chain — and the alert stays open until the answer arrives.

L2 Practitioner view

Practitioner standards are about evidence quality under time pressure. "Not a match — common name" is not a disposition; the record states which identifiers were compared and what each showed: the list entry's birthdate versus the customer's verified one, the address history, the entity's registration number. Releases pass a second pair of eyes, so no single person can clear a payment alone. Consistency is engineered, not hoped for: procedures define what suffices to close each alert type, quality assurance samples closed alerts from both piles, and calibration sessions keep investigators aligned. Some alerts cannot be settled by identifiers at all — a party who resembles no list entry but may be owned by listed persons raises an ownership question, and the linked escalation scenario shows why that goes to specialists rather than being closed at the front line.

L3 Technical details

Machinery that keeps investigation defensible: disposition taxonomies with reason codes, so outcomes are analysable rather than free-prose; investigation time targets differentiated by rail, because an instant payment and a batch file give different clocks; and previously-adjudicated-match registers that stop the same innocent namesake burning hours weekly — governed with expiry dates and automatic re-review when the list entry or the party's data changes. Ownership escalations follow their own track: the question "is this unlisted entity owned 50 percent or more by blocked persons" is researched with beneficial-ownership data and, where it matters, legal advice — under OFAC's rule, ownership by blocked persons aggregates across owners, so two listed persons at 25 percent each block the entity. Every element leaves an audit trail a regulator can replay.

Sources & standards2
  1. Official requirement

    Revised guidance on entities owned by persons whose property and interests in property are blocked (the 50 Percent Rule)US Department of the Treasury, Office of Foreign Assets Control · Aggregate ownership of 50 percent or more by one or more blocked persons

    Explains that entities owned 50 percent or more in the aggregate by one or more blocked persons are themselves blocked, even when not listed by name. · Checked 2026-07-12

    The rule speaks to ownership, not control; OFAC FAQs 398-402 elaborate on aggregation and indirect ownership.

  2. Market practice

    Wolfsberg Group Sanctions Screening GuidanceThe Wolfsberg Group · Alert handling by trained sanctions personnel; suppression and exclusion criteria

    Industry guidance on the elements of an effective sanctions screening programme: the risk-based approach, list management, matching technology, alert generation, and alert handling. · Checked 2026-07-12

    Wolfsberg guidance is industry market practice, not law; institutions vary in how they apply it.

L4 Standards & sources

What the source material establishes: the Wolfsberg Group guidance treats an alert as a starting point for review by trained sanctions personnel, never as a conclusion, and frames suppression rules and exclusion criteria as risk-based decisions the institution must own and document. Confirmed outcomes carry reporting duties that vary by regime: in the United States, reports of blocked property and rejected transactions must reach OFAC within 10 business days of the action, under its reporting regulations; EU and UK frameworks require reporting of freezes to the relevant competent authority — OFSI in the UK — on their own terms. The framing matters: investigation quality is a market-practice expectation, while reporting a confirmed match is a legal obligation with deadlines, which is why escalation paths to sanctions compliance are built for speed as well as accuracy.

Sources & standards3
  1. Market practice

    Wolfsberg Group Sanctions Screening GuidanceThe Wolfsberg Group · Alert generation and handling

    Industry guidance on the elements of an effective sanctions screening programme: the risk-based approach, list management, matching technology, alert generation, and alert handling. · Checked 2026-07-12

    Wolfsberg guidance is industry market practice, not law; institutions vary in how they apply it.

  2. Official requirement

    OFAC Frequently Asked QuestionsUS Department of the Treasury, Office of Foreign Assets Control · Filing blocking and reject reports with OFAC within 10 business days

    OFAC's official interpretive guidance on US sanctions programs, list maintenance, blocking, and compliance expectations. · Checked 2026-07-12

    FAQs are added, amended, and renumbered over time; always check the live page for current numbering and text.

  3. Official requirement

    UK financial sanctions general guidanceOffice of Financial Sanctions Implementation, HM Treasury · Reporting obligations to OFSI for frozen assets

    OFSI's general guidance on UK financial sanctions obligations, licensing, exceptions, reporting, and compliance. · Checked 2026-07-12

    General in nature; regime-specific guidance and the underlying UK regulations take precedence over it.

Sources for this topic3
  1. Market practice

    Wolfsberg Group Sanctions Screening GuidanceThe Wolfsberg Group · Alert generation and handling

    Industry guidance on the elements of an effective sanctions screening programme: the risk-based approach, list management, matching technology, alert generation, and alert handling. · Checked 2026-07-12

    Wolfsberg guidance is industry market practice, not law; institutions vary in how they apply it.

  2. Official requirement

    Revised guidance on entities owned by persons whose property and interests in property are blocked (the 50 Percent Rule)US Department of the Treasury, Office of Foreign Assets Control · Entities owned by blocked persons

    Explains that entities owned 50 percent or more in the aggregate by one or more blocked persons are themselves blocked, even when not listed by name. · Checked 2026-07-12

    The rule speaks to ownership, not control; OFAC FAQs 398-402 elaborate on aggregation and indirect ownership.

  3. Simplified educational illustration

    Payments Signal editorial teaching modelsPayments Signal

    This site's own simplified teaching models. · Checked 2026-07-12

    What this simplifies: Investigation workflows are generalised across institutions that differ in team structure, tooling, and evidence standards. The ownership example uses round percentages and a two-owner structure; real analyses involve longer chains and incomplete data, and whether any specific entity is in scope is a legal conclusion this site never draws. All parties in the linked scenarios are fictional.

    Used wherever diagrams, scenarios, figures, or example values are didactic constructions rather than sourced facts; every such use carries a simplifications disclosure. All people, companies, banks, and list entries in examples are fictional.

Deepest material on this page: L4 Standards & sources. Where a topic stops short of implementation depth, that is a deliberate coverage decision, not an oversight — see coverage.