How can payment providers manage sanctions risks in real-time?

Businesses are currently focused on the need for real-time data from vendors as they manage sanctions risks, according to a survey carried out in our recently published The State of Financial Crime 2022 report. An incredible 96% of firms said that real-time data would improve their performance in due diligence, while the number saying that it would improve their operations ‘significantly’ rose by 15 percentage points between 2020 and 2021.

The need to get things right, the first time, is natural enough for financial services firms. Avoiding sanctions breaches is a permanent challenge that threatens them with severe regulatory and reputational consequences in the event of failure. But achieving success is getting harder as western governments make wider use of sanctions to tackle international crises, as we see in the war in Russia and Ukraine. It is no surprise, therefore, that access to real-time data is such a major issue now, nor that so many firms are looking for better solutions beyond old-style screening methods.

The sanctions risk challenge

Financial businesses have a fundamental legal duty to identify, block and report attempts at sanctions evasion, making accuracy one of the most important qualities of sanctions data when it comes to screening customer names and high-risk transactions. Poorly curated risk data is the primary reason for the high rates of false positives. There are also of course the many unknown numbers of false negatives that will go ‘under the wire’ and create future regulatory risks for the firm.

But although businesses need accuracy, they need their sanctions data to be timely too. For regulators, speed is of the essence. The UK’s Office of Financial Sanctions Implementation (OFSI) says that firms need to report to them at ‘the earliest opportunity’. At the same time, businesses have a commercial duty to their customers to sustain fluid and responsive onboarding and payment systems to ensure a high-quality customer experience.

The pressure for real-time data

This requirement for accurate real-time risk data is always important, but is even more so now, as businesses face a fast-evolving geopolitical environment. As our recently reissued report The Evolving Use of Sanctions indicates, authoritarian governments’ military aggression, human rights abuses, corruption, etc., as well as the ongoing challenges of terrorism and organised crime, have encouraged growing numbers of democratic states to create autonomous sanctions regimes to deter, punish and disincentivise negative behaviour. As we have seen in the western reaction to the Russian invasion of Ukraine, multiple countries can apply their sanctions in a matter of days, and sometimes over a few hours.

Such fast-moving situations are difficult to manage because of the types of sanctions tools and risk data businesses are using. Some sanctions screening solutions for due diligence and payments - often based on decades-old technology - are not real-time. Changes to sanctions lists can take a day or more to be reflected in platforms, and actual refreshed screening of data against the new lists can take even longer, driven by a set schedule of daily overnight reviews. Delay is built-in, leaving designated targets plenty of opportunities to make illegal transactions before the changes kick in, and businesses facing the prospect of reputational damage or enforcement action at some point in the future.

Tackling the challenge

As a result of the problems facing the industry, many screening vendors are now saying that they provide ‘real time’ data for managing sanctions evasion risks. However, businesses need to take care when they hear this promise: increasing the number of scheduled sanctions lists updates or screening batch runs from one to a couple more a day, is not ‘real-time’, and given the speed of change we are seeing in sanctions regimes, still leaves material gaps in coverage. When vendors are using older models of technology, moreover, it also brings additional risks of outages and rising costs which might be passed on to the client.

Nonetheless, with advances in data collection and management, real-time updates and screening are a real possibility. With the most sophisticated internet ‘scraping techniques’, it is feasible to pull updates not only from published sanctions lists, but from official announcements and media as well, minute by minute. With the vast data resources of cloud computing, machine learning algorithms, and Application Programming Interfaces (APIs) - protocols that allow different platforms to talk to each other - it is also possible to screen continuously, allowing firms to investigate, block and report potentially sanctioned transactions as they happen. Supported by this kind of technology, businesses now have the opportunity to screen data with the confidence of knowing that they have the information they need when they need it.

Learn more about sanctions trends, regimes, and geopolitical hotspots in our new guide to the Evolving Use of Sanctions 2022.

About Charles Delingpole

Charles is a technology entrepreneur, and our founder and CEO. He has extensive executive experience in financial services across the US, Europe, and Asia. Previously he was the Co-Founder and CEO of MarketFinance, a business finance company that has raised over USD 59 mln in funding. Before that, he was an investment banker at J.P. Morgan Cazanove. When he was 16, Charles founded the world’s largest student discussion forum, The Student Room Group. Charles holds an MA in Politics from Trinity College Cambridge and an MSc in Management, Strategy, and Finance from the LSE.

About ComplyAdvantage

ComplyAdvantage is the financial industry’s leading source of embedded risk intelligence and detection technology. ComplyAdvantage’s mission is to neutralise the risk of money laundering, terrorist financing, corruption, and other financial crime. More than 500 enterprises in 75 countries rely on ComplyAdvantage to understand the risk of who they’re doing business with through the world’s only global, real-time database of people and companies. The company actively identifies tens of thousands of risk events from millions of structured and unstructured data points every single day.