Real-time transaction screening: checks in the payment path.

Screening before the money moves

Transaction security has two main controls, and they work at different times.

• Transaction monitoring looks at transactions after they happen, over days or weeks, for patterns that suggest money laundering or fraud.
• Transaction screening checks each payment before it is completed, against sanctions lists and other rules, so that a prohibited payment can be stopped.

The Wolfsberg Group, an association of global banks, describes screening cross-border payments before completing them as common practice, known as screening in real time. It says screening should happen at a point where the payment can still be stopped, before any commitment to move funds, and before a possible sanctions breach occurs. For domestic payments, where both banks apply the same local customer checks and sanctions rules, it may not be needed.

Customer screening and transaction screening work together. Customer (name) screening checks who an institution's customers are, at onboarding and whenever lists change. Transaction screening checks the other parties and details in each payment, which the institution may know nothing about.

What the international standards say. The FATF's revised Recommendation 16 on payment transparency (June 2025) requires institutions to take freezing action and not to deal with designated persons, but it does not say whether or how payment information should be screened. It expects institutions to have policies on whether to execute, reject or suspend a payment, and allows the receiving institution to check payments for missing information either after the event or in real time where feasible. The changes are to be in effect by the end of 2030.

What a screening control must do. The US Treasury's Office of Foreign Assets Control (OFAC), in its 2019 compliance framework, expects controls that identify, interdict, escalate and report prohibited transactions, using technology calibrated to the institution's risks and routinely tested.

Two honest limits, both from the Wolfsberg guidance: an alert is not, by itself, a sign of sanctions risk, and no screening system can catch every sanctions risk. It is one control among several.

What is screened, and why stripping is serious

The data in a payment. The Wolfsberg Group lists the information commonly screened:

• the parties: the payer and the beneficiary;
• banks and intermediaries, by name and by bank identifier code or routing number;
• free text, such as the remittance information field of an international payment message, where names and places can hide;
• geography: addresses, countries, cities and ports;
• where relevant, vessels and their identification numbers, securities identifiers and trade documents.

Amounts, dates and reference numbers generally do not matter for sanctions screening.

Structured data helps. International payments now use the ISO 20022 message standard, with labelled fields for names and addresses. The FATF and the Wolfsberg Group both say structured information improves screening. A city in its own field is matched far more reliably than one buried in a line of text.

Wire stripping. Screening only works if the information is there. Deliberately removing or altering information so a payment passes screening is called wire stripping, and it is treated as one of the most serious failures. The Wolfsberg Group's 2023 payment transparency standards say payment providers should not omit, delete or alter payer or payee information to avoid detection.

OFAC's 2019 framework notes that many of its enforcement cases involved institutions that tried to conceal activity by stripping or manipulating payment messages. In one settlement from 2012, OFAC described how a bank's staff overwrote the field identifying an Iranian ordering bank with a full stop, so its identifier would not appear, and sent payments onward without any mention of the Iranian beneficiary bank.

Common technical failures listed by OFAC include sanctions lists not updated, missing bank identifiers, and screening that does not catch alternative spellings of sanctioned places, such as "Habana" for Havana or "Kuba" for Cuba.

The lesson: protect the completeness of payment data as carefully as the screening engine itself, and treat any instruction to change payment details "to avoid problems" as a red flag.

The EU's sanctions rule for instant payments

Screening every payment against sanctions lists takes time, and instant payments must be completed within seconds. The EU's Instant Payments Regulation ((EU) 2024/886) changed how EU sanctions checks work for them.

Article 5d. Payment providers offering instant credit transfers must check whether any of their own customers are subject to EU targeted financial restrictive measures:

• immediately after any new designation or amendment; and
• at least once a day.

Having done that, the payer's and payee's providers must not additionally check, during each instant transfer, whether the payer or payee is designated under those measures. The rule has applied since 9 January 2025 to all providers offering instant transfers.

What it covers, and what it does not. "Targeted financial restrictive measures" here means only EU asset freezes and bans on making funds available adopted under Article 215 of the EU treaty. The rule does not remove:

• screening required by other EU measures or other countries' sanctions, where they apply;
• anti-money laundering duties;
• fraud checks.

Providers must also report each year on the share of instant payments rejected because of targeted financial restrictive measures.

Why this matters beyond the EU. It shows a design choice every fast payment system faces: move as much checking as possible to the customer level, done continuously, so that the payment itself can stay fast. The trade-off is that customer screening must be excellent and current, because it is no longer backed up by a check on every payment.

Fuzzy matching, false positives and testing

Sanctions screening compares names that are often spelled differently, transliterated from other scripts or deliberately disguised. Exact matching misses too much; fuzzy matching finds close variants but produces many false alerts. Managing that balance is most of the work.

What the Wolfsberg Group's 2019 sanctions screening guidance recommends:

• Risk-based choices: which lists, which data, and how exact or fuzzy the matching should be, with the reasons documented.
• Known false positives: a managed "good guys" list can suppress repeat alerts on a customer already cleared, with clear rules and review.
• Weak aliases: screening against very weak, generic aliases is not expected and is rarely productive.
• Timely list updates: new designations implemented as quickly and accurately as possible.
• Management information: alerts by list, jurisdiction and business line, so problems show up.
• Independent, risk-based testing: confirm the system raises the alerts it should, at the thresholds set, and that the data feeding it is complete and accurate.
• Four-eyes review for decisions on hits, with the reasons recorded.

OFAC's compliance framework similarly expects screening technology to be calibrated to the institution's risk and routinely tested.

No magic numbers. There is no official target for false positive rates or screening speed. Each institution must find the setting that catches real matches for its own risks and still lets genuine payments through on time, and be able to explain it.

In real time, speed matters too. A screening step that holds every payment for minutes defeats instant payments. Institutions design for most payments to clear automatically within the time available, with only genuine potential matches stopped for review.

What to do with a hit

When screening stops a payment, there are three possible outcomes: release it as a false match, reject it, or block it.

Blocking versus rejecting under US sanctions. OFAC explains the difference:

• Block the payment, freezing the funds, when a blocked person, such as someone on its Specially Designated Nationals list, has an interest in it. Blocked funds are held in a separate, interest-bearing account.
• Reject the payment, returning it to the sender and never passing it on to the beneficiary, when the transaction is prohibited but no blocked person has an interest.

US persons must report blocked property and rejected transactions to OFAC within 10 business days, and report blocked property held each year. These are US rules; other countries have their own.

Good practice for any institution:

• review hits quickly, with clear authority to release, reject or escalate;
• record the reasons for every decision, with four-eyes review for real matches;
• never tell the customer more than the law allows while a case is under review;
• report as the law requires, and keep records;
• feed lessons back into tuning, lists and data quality.

In Kenya: Kenya implements UN targeted financial sanctions under the Prevention of Terrorism Act, 2012 and regulations made under it. When the UN updates its lists, the Counter Financing of Terrorism Inter-Ministerial Committee circulates the updates through the Financial Reporting Centre to reporting institutions, which must review their relationships and assets, freeze funds of designated persons without prior notice, not make funds available to them, and report any freezing or attempted transaction to the Committee within 24 hours. These duties sit alongside the separate duty to report suspicious transactions. The Centre publishes the lists and notices on its website; check the current position.

Your certificate of completion

Enter your name as you want it to appear, then save the certificate as a PDF. In the print window, choose Save as PDF. A certificate is issued once per completion of the course.

Saolix does not record who takes this course, so it cannot verify these certificates. The certificate confirms completion of a free self-paced course and is not an accredited qualification.