The AML Watchlist Screening compares customers, their beneficial owners, and relevant counterparties against the sanctions lists, politically exposed person (PEP) databases, law enforcement records, and other risk sources at onboarding and throughout the relationship. It helps the businesses in identifying the potential financial crime risks, investigate the matches and to determine whether additional checks or restrictions are applicable.
The screening supports the customer due diligence and the related controls under the FATF Recommendations. In the EU, Regulation (EU) 2024/1624, the Anti-Money Laundering Regulation (AMLR), further harmonises these obligations and is applicable from 10 July 2027. A screening alert is a potential match, not proof of wrongdoing. The compliance teams must confirm whether the record belongs to the customer and assess its significance before deciding what action is required.
Watchlist Screening in AML:
A watchlist is a list of people, entities, vessels, or wallets that a government, law enforcement body, or a regulator has flagged. The screening compares the collected data, such as full name, date of birth, nationality, and company registration details, against those lists. Each list has a different consequence. A confirmed sanction can prohibit a business relationship, while a PEP match requires further assessment under the applicable rules. Treating each alert the same way can obscure serious risks and can create unnecessary work for the compliance teams.
What AML watchlist screening covers
The Watchlist screening is an umbrella term for several checks, and each list covers a different purpose and the consequences.
| List type | What it covers | What a confirmed match means |
| Sanctions lists | People and entities designated under UN, regional or national sanctions regimes | Apply that regime’s restrictions, often freezing funds or other assets and making them unavailable |
| Sanctioned identifiers (crypto wallets and vessels) | Crypto wallet addresses and vessels named alongside designated parties | Treat it as a sanctions match |
| PEPs | Prominent public officials, their family members and close associates | Enhanced measures for foreign PEPs and higher-risk domestic PEPs. PEP status alone is no reason to refuse |
| Countries-risk screening | Countries under a FATF call for action (black list) or increased monitoring (grey list) | Black list means enhanced due diligence and, in the most serious cases, countermeasures. Grey list means factoring it into country risk |
| Debarment lists | Firms and individuals barred from development-bank-financed contracts, often for fraud or corruption | Ineligible for those contracts. The grounds inform your risk review |
| Law-enforcement and regulatory records | Wanted-person notices, enforcement actions, regulator warnings about unauthorised or clone firms | Escalate and assess against your risk appetite |
| Adverse media | Negative news about a customer | Review on a risk basis, keeping allegations separate from established findings |
| Government Databases | Official sanctions, enforcement, licensing, court, and other public-authority records. | Assess what the record means; inclusion alone is not an adverse finding |
| Internal watchlists | People or businesses flagged for previous fraud or other risk concerns | Review the flag and follow internal procedures |
| Government databases | Official sanctions, court, enforcement and licensing records | Assess what the record means; inclusion alone is not an adverse finding |
| Company and ownership registries | Company details, directors and beneficial owners | Confirm ownership and screen relevant parties; registration is not a risk flag |
| International and regional organisation lists | Sanctions, exclusions and other records issued by bodies such as the UN, EU and World Bank | Follow the requirements of the underlying list |
Legal Requirements behind AML Watchlist screening:
Each list in the table traces back to an international standard or a law. FATF Recommendations set international standards for countries, while the national laws and the regulatory rules establish business obligations. The requirements vary by the jurisdiction and sector.
FATF (Global Standard):
FATF Recommendations 6 and 7 set standards for countries to apply targeted financial sanctions under UN Security Council resolutions, freezing funds or other assets without delay and making them unavailable to designated persons. FATF Recommendation 12 sets standards for senior management approval, source of wealth and source of funds checks, and enhanced ongoing monitoring for foreign PEPs, and for domestic PEPs where the relationship is deemed to be higher risk. FATF Recommendation 19 sets standards for enhanced due diligence on customers from countries under a FATF call for action. For countries under increased monitoring, FATF recommends assessing each country for its exposure to money laundering risk.
European Union:
AMLR Article 20(1)(d) will require obligated entities to verify whether a customer or beneficial owner is subject to targeted financial sanctions, including whether sanctioned persons control a legal entity or hold more than 50% of its proprietary rights, individually or collectively. The AMLR applies from 10 July 2027. AMLR Article 26(4) requires that obliged entities regularly check that they’re meeting their obligation for financial sanctions on a frequency proportional to their exposure to non-compliance with these obligations. Credit and financial institutions must also re-check on any new designation.
EBA Guidelines on ML/TF risk factors (EBA/GL/2021/02) ask EU credit and financial institutions to check for adverse media reports or allegations of criminality about a customer or beneficial owner, and to judge how credible they are. In other jurisdictions, regulatory guidance may not directly mention the word adverse media; however, they usually ask you to monitor the reputation and publicly available information about an entity that can materially impact their risk profile.
United States:
Under US Office of Foreign Assets Control (OFAC) rules, the assets of anyone on the Specially Designated Nationals (SDN) List are blocked, and U.S. persons are generally prohibited from dealing with them. Blocking also extends to the entities owned, directly or indirectly, 50% or more by one or more blocked persons, individually or collectively.
United Kingdom:
UK sanctions regulations restrict dealings with persons that are designated for an asset freeze, including making funds or the economic resources available to them. The relevant restrictions also extend to entities they own or control, even if those entities are not separately listed.
United Arab Emirates:
Under the Cabinet Decision No. 74 of 2020, licensed financial institutions must screen against the UAE Local Terrorist List and UN Consolidated List regularly and immediately when notified of the changes. Confirmed matches trigger freezing and reporting obligations.
Australia:
The AML/CTF framework requires reporting entities to check the customers, relevant beneficial owners, representatives and the people on whose behalf services are received for targeted financial sanctions designations. Checks apply before providing a designated service and throughout the business relationship.
Hong Kong:
HKMA’s AML/CFT guideline for stored-value facility licensees calls for screening customers and beneficial owners at onboarding and against new or updated terrorist and sanctions designations as soon as practicable.
Singapore:
MAS Notice 626 requires banks to screen customers, beneficial owners, connected parties and authorised representatives against relevant money laundering and terrorism financing information sources and official lists. Screening must also take place periodically and following relevant updates.
Steps involved in the AML watchlist screening process:
The screening process runs as a loop. The most common failure is screening only once at the time of onboarding, since a customer who might be clean on day one can be designated as a flagged entity next month.
- Collect full name, date of birth, and nationality for individuals, and registration details and beneficial owners for businesses.
- Screen against the given lists with exact, fuzzy, and phonetic matching, so spelling variants, transliterations, and reordered names still surface.
- Review each potential match against secondary identifiers such as date of birth and nationality, then clear it or confirm it.
- For potential matches that can’t be resolved with available information, contact the relevant customer and request details that would clear any ambiguity without disclosing/tipping them off about any ongoing investigation.
- Act on confirmed matches as per the applicable restrictions and available exemptions (e.g., rejecting, blocking or reporting a transaction), applying enhanced due diligence for confirmed PEP matches and escalating to senior roles where required, with the rationale recorded.
- Re-screen your customer base whenever the lists update and whenever customer data changes.
How Shufti helps
Shufti Watchlist Screening software checks individuals, entities, vessels, aircraft, and crypto wallets against 4,000+ global watchlists, refreshed every 15 minutes, with matching across 80+ languages and scripts. Enrolled profiles are re-screened automatically on every refresh, so a match against a newly listed party reaches your alert queue within 15 minutes.
