Sanctions screening of counterparties selecting a provider and configuring thresholds

Alena Sharykava

09.03.2026 | 6 min read

Updated: 09.03.2026

I have led COREDO since 2016, and during that time the COREDO team has carried out hundreds of projects for company registration abroad, licensing of financial services, implementation of AML processes and setting up sanctions screening. The geography of our clients and projects: from EU countries (Czechia, Slovakia, Cyprus, Estonia), the United Kingdom and Singapore to Dubai – has taught me a simple truth: sanctions screening of counterparties and sanctions checks of partners and suppliers give businesses an advantage when embedded in the operating model, and not ‘tacked on’ at the last minute just for show.

When these elements are synchronized, automated sanctions monitoring becomes a reliable risk filter and a driver of operational efficiency.

Regulatory guidelines: what to consider

COREDO’s practice confirms: successful screening begins with understanding the standards. We follow the recommendations FATF and the AMLD5/6 requirements in the EU, take into account the regulations of the European Commission, HMT provisions in the UK, and also the expected practice of FinCEN and OFAC for companies with an international presence. The compliance landscape is multijurisdictional by definition, which means the policy should cover the EU, UN, OFAC, HMT and industry lists.

GDPR and local data protection requirements form the legal basis for processing personal data. In international screening, cross-border transfer, lawful bases for processing, data retention policy and log retention periods are important. The COREDO team sets up the legal framework in parallel with the technical design to eliminate gaps between IT and legal.

Sanctions Screening Architecture

Source coverage and validity

Choosing a sanctions screening provider starts with evaluating list coverage: EU, UN, OFAC, HMT, FinCEN, sectoral and regional lists, as well as PEP lists and adverse media. We compare providers of sanctions lists along three axes: the validity of sources and the method of updating sanctions lists in real time, the completeness of UBO data and the quality of PEP attributes, and the transparency of entity resolution.

Checking the correctness and timeliness of data sources: a mandatory step. I always ask the team to show not only the provider’s marketing promises but also the update log, normalization methodology and cross‑verification mechanisms against external registers and sanctions databases. External validation and test datasets help identify gaps before going to production.

Integration of AML/KYC into transactions

Integrating sanctions screening into the KYC process and transaction monitoring addresses two tasks at once: preventing the onboarding of sanctioned persons and protecting payment flows. We use APIs and webhooks to integrate with CRM and ERP, and we also connect the event broker to message queues (Kafka, RabbitMQ) for scalable processing.

Batch vs real‑time – a frequent choice. For large client registries, batch processing with nightly windows and bulk upload handling works, while for payments, real‑time screening of counterparties with an SLA for response times of up to hundreds of milliseconds is critical. In COREDO projects we agree on SLAs: response time, availability and recovery, so that business units understand the service boundaries and the fault‑tolerance design.

Data and entity resolution: matches

Quality starts with ETL processes to prepare data for screening: name normalization, data overlays for verification of addresses and documents, and standardization of date formats. Entity resolution and data unification are key to reducing alerts that arise due to transliteration discrepancies and spelling variants.

For matching we use name comparison algorithms: Levenshtein, Soundex, Metaphone and their hybrids. We combine deterministic vs probabilistic matching with contextual features: date of birth, address, citizenship, country of risk. Machine learning to improve counterparty matching yields a steady increase in precision without an increase in false negatives, if supported by training datasets, drift monitoring and regular model retraining. Detection of transliteration and spelling variants is a mandatory feature; without it a multi‑jurisdictional environment generates unnecessary alerts.

Thresholds and sensitivity of the risk profile

Configuring thresholds and sensitivity allows managing the system’s risk profile, reducing the number of false positives and increasing the speed of response. Below we consider options for threshold policy, from a static model to adaptive and risk-oriented approaches — to find the optimal balance between security and noise.

Types of threshold policies

Setting the thresholds for sanctions screening should reflect the risk appetite. Approaches to defining thresholds can be static (uniform rules), adaptive (changing sensitivity in response to risk signals), and risk-oriented (differentiation by segments). Tuning match sensitivity and thresholds works best when combined with filtering by country, industry and risk level, as well as business rules.

The COREDO team implemented rule flexibility: business rules, scripts and ML segmentation for different business units and risk profiles. This allows, for example, tightening the policy for international payments and correspondent banks in the payments business, and in logistics: taking export controls and trade embargoes into account.

Calibration of hypotheses and A/B tests

Testing and calibrating thresholds on historical data show how the number of alerts per 1000 checks changes – KPI, sensitivity to regions and impact on operational load. We measure precision and recall in sanctions screening, compute the F1 metric to assess match quality, and analyze false positives, as well as missed matches (false negatives) and the risk of missing sanctions.

Name, date of birth, address, PEP and UBO

Matching by name, date of birth and address forms the basis for assessing a counterparty’s sanctions risk. Checking PEPs and UBOs as part of sanctions monitoring is no less important than a direct match with a sanctions list, especially in complex ownership structures.

Operational model: alerts, escalation, audit

In the operational model, the key control elements are alerts, rapid incident escalation and regular process audits: all of this sets the framework for control and transparency of actions. Below we will examine real cases and escalation rules where a human remains in the decision loop, and assess the impact of such scenarios on response speed and audit quality.

Escalation cases: human in the loop

Managing workflow and escalation for matches is critical for speed and reputation. Case management and remediation workflow tools allow assigning roles, applying an escalation matrix and controlling deadlines. Human-in-the-loop processes combine automation and expert review: the “automaton vs human” decision depends on the confidence level and the risk threshold.

For high-risk cases we apply EDD (enhanced Due Diligence): an in-depth check of sources of funds, beneficiaries and business connections. In scenarios requiring notifications, we prepare SARs and interact with the regulator or partner bank using agreed templates.

Whitelists and independent validation

Whitelist and exception rules in sanctions screening reduce the volume of repeated manual review if implemented correctly. Best practices for documenting threshold policy and exception rules include the date of introduction, review period, rationale and revocation procedures.

internal audit and independent provider validation assess the resilience of the model and coverage completeness. Validation ensures that minimizing false positives in screening does not lead to an increase in missed matches, and testing on external datasets confirms the portability of settings.

Audit trail and reporting

Auditing and preserving action logs during screening is not only a compliance requirement but also a team training tool. We record solution versions and threshold changes to see how the policy evolves.

Choosing a provider and deployment model

When choosing a provider and determining the deployment model, coverage, working methodology and adverse media analysis become key, since they directly affect the project’s effectiveness and resilience. A clear understanding of these aspects will help select a vendor and deployment scheme that withstand real risks and provide the required level of control.

Coverage and adverse media methodology

We compare providers by coverage and methodology criteria. Assessment of list coverage includes OFAC, EU, UN, HMT, FinCEN, PEP lists and adverse media. Provider benchmarking and testing methodology include a golden set of cases, external validation and transliteration stress tests.

We check comprehensive screening: sanctions, adverse media, risk scoring and the presence of data overlays for addresses and documents. Our experience at COREDO has shown that a provider with a transparent SLA, a clear commercial model and a well-defined update roadmap delivers a better TCO over a 3–5 year horizon.

SaaS vs on-premise: architectures and TCO

The choice between a SaaS and an on‑premise solution for sanctions screening depends on data requirements, jurisdictions and speed of implementation. SaaS starts faster and is cheaper upfront, while on‑premise provides greater control and independence. We analyze multi‑tenant vs single‑tenant architectures, vendor lock‑in risks and contract exit procedures, including data export and API compatibility.

Integration and performance

Integration of a sanctions data provider API is not only about endpoints, but also about retry models, limits, webhooks and versioning. In complex landscapes we use message queues, stream processing and scaling to balance batch processing vs event streaming.

Supply and international settlement risks

Supply chain and international settlement risks arise at the intersection of logistics, finance and regulatory requirements, creating threats both to timely delivery and to the security of payments. Let’s examine how supplier selection, interactions with correspondent banks and compliance with export control affect the resilience of business operations.

Export control: banks and suppliers

For exporters, managing sanctions compliance risks is important: export control, trade embargoes and Licensing of shipments. Correspondent relationships and screening of counterparty banks include configuring thresholds for international payments and correspondent banks taking into account country risk and partner banks’ requirements.

Use cases in logistics, trade and financial contracts vary in their sensitivity to timing and data completeness. In our projects, business rules take into account industry lists, end‑user controls and geographic blocks, while automated sanctions monitoring tracks real‑time updates across key risk chains.

Multijurisdictional screening context

Comprehensive screening combines sanctions, PEP, adverse media and risk scoring to give compliance a full profile of a counterparty. Configuring rules for different business units and risk profiles increases accuracy and reduces manual work, especially in a multijurisdictional environment with differing legal regimes.

Sanctions screening in a multijurisdictional environment takes into account local prohibitions and secondary sanctions. At COREDO we document the decision‑making logic for matches: when automation closes a case and when human review and escalation to a committee are required.

Data Security

Security must be a priority in any handling of user information, and preserving data confidentiality requires coordinated procedures and technical safeguards. It is especially important to consider the legal framework and rules for cross-border transfer, which define permissible practices and liability when exchanging information between jurisdictions.

Legal Framework for Cross-Border Transfer

GDPR, cross-border data transfer and the legal framework: an integral part of the project. We create a registry of processing operations, agree on purposes, justify legitimate interest or consent, and define the data retention policy and log retention periods taking into account regulatory timeframes and operational needs.

Fault Tolerance and Incidents

The response plan for false positives and incidents sets a unified tactic: when alerts spike we prioritize, document decisions, and, if necessary, engage external communication with banks and regulators. This approach reduces stress load on the team and maintains the rhythm of operations.

ROI and KPIs for the Board of Directors

In the economics of modern business, ROI and KPIs are the languages boards of directors speak when assessing project effectiveness. Specifying quality metrics and processing costs allows linking operational improvements to financial results and demonstrating the real contribution of initiatives to profitability.

Quality metrics and processing cost

Performance metrics are the language of conversation with the board. We track the number of alerts per 1,000 checks, precision, recall, the F1 metric, as well as the cost to process a single alert and cost per true positive. These indicators are transparent and help make decisions on threshold calibration and investments in automation.

Scaling and change management

The strategy for scaling sanctions screening as the business grows relies on modularity and independent environments for new jurisdictions. Threshold tuning for new markets and products goes through A/B testing of thresholds and analysis of impact on KPIs, which helps avoid noisy rollouts.

Rules for documenting decisions and change management record who, when and why thresholds or matching logic were changed. Such a log is the internal auditor’s best friend and a shield against operational surprises.

Combating Evasive Activity

Systematic training and the development of an appropriate corporate culture are key to reducing risks and improving teams’ readiness to detect abuses. Particular attention should be paid to personnel and to the role of the expert in the operational fight against manifestations of evasive activity and in implementing working practices.

The Expert’s Role in Personnel

Personnel training requirements include knowledge of regulatory standards, the practice of reading sanctions decisions, and an understanding of how fuzzy matching and transliteration work in sanctions screening. Human‑in‑the‑loop processes are effective when an analyst can see an explainable matching model and quickly make a decision.

Evasion Scenarios and UBO Control

Sanctions circumvention scenarios and indicators of evasive activity include multilayered structures, transit through “gray” jurisdictions, and name mimicry through transliteration. Graph analysis and external registries help detect risky patterns early.

How COREDO implements projects: case studies

Here are several case studies that clearly demonstrate how COREDO implements projects in the fintech space, including licensing and screening. Each example shows the stages of work, decisions made, and results achieved, to logically prepare for a detailed breakdown of subsections.

Licensing and screening of fintech companies

In another case for a crypto services provider in the UK we expanded list coverage, added adverse media, and configured EDD for high-risk geographies. The solution developed at COREDO included a hybrid approach to thresholds and an ML module for entity resolution, which reduced false positives while maintaining high recall.

Exporter’s supply chain

For an exporter operating in Singapore and Dubai, we implemented comprehensive beneficial owner checks and sanctions control for the supply chains. The threshold policy was risk-oriented: strict rules for routes subject to export controls and trade embargoes, and adaptive rules for stable corridors. By integrating with ERP and streaming event processing through Kafka, the company received early signals about risks related to suppliers and correspondent banks.

Implementation roadmap

• Define the regulatory perimeter: FATF, AMLD5/6, EU/UK rules, GDPR and local data requirements. Agree on retention and logging policy.
• Conduct provider benchmarking by coverage (OFAC, EU, UN, HMT, FinCEN, PEP, adverse media), update methodology and SLA. Assess TCO and vendor lock‑in risks.
• Design the architecture: APIs and webhooks, message queues, batch vs real‑time, response time and recovery requirements. Include a DR plan and monitoring.
• Build a robust data layer: ETL, normalization, transliteration, matching algorithms (Levenshtein, Soundex, Metaphone), entity resolution and drift control.
• Set thresholds: static, adaptive, risk‑based. Calibrate on historical data, run A/B tests and document threshold policy.
• Organize the workflow: case management, escalation matrix, EDD and SAR procedures. Configure whitelists and independent validation.
• Launch metrics: alerts per 1,000 checks, precision/recall/F1, cost per true positive. Schedule regular committees to review parameters.
• Train the team: regulatory requirements, interpreting sanctions rulings, handling matches and tools. Update training and tests as the system evolves.

Conclusions

Sanctions screening: it’s not about “catching a match”, but about a resilient risk-management system that supports a growth strategy. When data sources are valid, the threshold policy is documented, and the workflow is transparent, the business gains speed, accuracy and confidence in international dealings. I see this every time the COREDO team completes a project: compliance becomes part of the competitive advantage rather than an obstacle to growth.

If you are planning expansion into new markets, registration in the EU or the UK, obtaining licenses for payment or crypto services, or want to strengthen the AML framework in logistics and trade, it’s worth starting with the architecture of sanctions screening. Rely on data, build adaptive thresholds, manage escalations and metrics — and the system will pay for itself sooner than you might think. At COREDO we build such solutions so they endure business growth and changing rules, and the team can confidently face any audit.