Sanctions screening: “we screen our clients” is not enough

That is a useful starting point. But the more important questions are:

• how do you know your screening works
• what is the quality of the core data
• what happens when it doesn’t and how will you know

Recent enforcement offers some practical lessons—not just about screening technology, but about the information, judgement and oversight needed to make it effective.

Different failures, similar lessons

Deutsche Bank: a gap in the data.

OFSI’s May 2026 notice detailed a £165,000 penalty against Deutsche Bank’s London branch for two payments totalling more than £635,000 to Okko, a company wholly owned by a sanctioned entity. The third-party screening data did not include Okko or its ownership, so no alert was generated. OFSI recognised the value of external providers, but was clear that responsibility remained with the bank. A “no match” result did not establish that the payments were permissible.

Bank of Scotland: both technology and judgement failed.

In January 2026, OFSI published details of a £160,000 penalty, imposed in November 2025, involving 24 payments to or from a sanctioned individual’s account. Screening failed to identify spelling variations in the customer’s name. A subsequent politically exposed person review identified relevant adverse media, but the customer was incorrectly treated as having been removed from both UK and EU sanctions lists, rather than only the EU list. There was also no explicit instruction to escalate all potential sanctions connections to the relevant sanctions team.

Citibank: configuration and operational pressure.

OFSI’s September 2026 notice reported a £4.73 million penalty against Citibank’s London branch, covering 970 payments worth approximately £19.7 million. Among several failings, screening did not match “PAO Sovcomflot” with “Sovcomflot” because of how the system handled the corporate prefix. Delays in reviewing alerts and restricting accounts also contributed. This illustrates why testing must extend beyond whether the software produces an alert.

Trident Trust: you cannot screen people you have not identified.

A relevant Guernsey example is the GFSC’s July 2024 public statement concerning Trident Trust Company (Guernsey) Limited. Its £266,000 penalty covered wider regulatory failings, including ineffective sanctions controls. Failure to identify the beneficial owners behind its private yacht marine business meant it could not identify and report sanctioned individuals connected to those relationships. The lesson starts before the screening system: understand who sits behind the relationship.

What action should you take?

Test effectiveness, not just activity.

Test known sanctioned names and realistic variations, including spelling differences, missing names and corporate prefixes. Check that the API between system where the core data is held for screening actually feeds the screening system on the required frequency. Reporting that screening runs daily says little about what it might miss.

Understand the limits of your data and your provider.

Consider beneficial ownership, control, connected parties and relevant underlying assets—not just the named customer. Do you understand the fuzzy logic and can you explain it. Challenge list coverage, foreign characters, update times and data gaps. Outsourcing screening, including to a group function, does not remove the firm’s responsibility.

Proceedures and training.

Staff need clear guidance on how to review alerts, when and where to escalate and the timeframes – you don’t want someone sitting with a potential sanction hit for a week! Ensure staff have current training and an understanding that sanctions regimes can differ. Test the complete process: identifying a concern, investigating it, applying appropriate restrictions and making required reports. Plan for spike in alerts when new sanctions are introduced.

Give the board evidence, not reassurance.

Useful reporting includes overdue alerts, failed data uploads, testing results, time taken to investigate matches and progress with remediation. Look at trend analysis. These measures support a more meaningful discussion than screening volumes alone. Guernsey’s sanctions thematic highlighted the importance of this oversight, particularly where screening is outsourced.

Where a breach occurs, prompt and complete disclosure matters. Both Deutsche Bank and Bank of Scotland received penalty reductions, but disclosure did not remove the underlying breach.

The board question should not simply be “Do we screen?” It should be: “What evidence demonstrates that our controls identify sanctions exposure?”

Our next article will look further at screening, but with a focus on PEP’s and adverse media.