Screening versus monitoring: when you need each

Two different questions

Screening asks: is this person or company a concern right now? You run it when you meet someone new, before a payment, or when something about them changes.

Monitoring asks: has anything changed since we last looked? It runs in the background across everyone you already deal with, and only speaks up when something new touches one of them.

Most businesses need both. Screening protects the front door; monitoring protects the house.

Why one-off checks go stale

Sanctions and watch lists change constantly. Governments add, update and remove entries throughout the year, sometimes in large batches after a major event. A customer who was clear on the day they joined can be listed a month later.

Adverse media changes too. A supplier who looked clean last year may be in the news today. If you only check at onboarding, you will not know until someone else tells you.

What good monitoring looks like

Good monitoring is quiet. If it raises the same alerts every day, people stop reading them. The features that keep it useful are:

A baseline. When you first load your list, existing matches are reported separately, so they are not mistaken for new events.

Change-based alerts. Only additions, changes or removals on the lists are checked against your records.

One alert per change. Once you mark an alert, the same change should not come back.

Memory. If you cleared a match last month and nothing on the listing changed, it stays cleared.

Delivery where you work: email, chat or your own systems.

How often is often enough?

It depends on your risk. Payment firms and banks usually expect continuous or daily monitoring for sanctions. A small business with a few dozen stable suppliers might re-screen monthly or quarterly. Healthcare organisations commonly re-check exclusions monthly.

Whatever you choose, write it down in your procedure, explain why it fits your risk, and make sure it actually happens. A stated policy that is not followed is worse than a modest one that is.

Deciding who to monitor

You do not have to watch everyone with the same intensity. A risk-based approach might look like this:

High-risk customers and key vendors: continuous monitoring for sanctions, PEP and adverse media.

Standard customers: continuous sanctions monitoring, periodic full review.

Low-risk, low-value relationships: periodic re-screening.

Keep the list current. Remove people you no longer deal with, and add new ones as part of onboarding.

Making alerts actionable

Every alert should tell the reviewer what changed, which record it touches, why it matched and what to do next. It should also be easy to mark: not a match, confirmed, or escalated, with a short reason. Those marks are your evidence later.

Track how long alerts wait. An alert that sits for a week defeats the point of monitoring.

KEY TAKEAWAYS

1Screening is a point-in-time check; monitoring watches for change.

2Lists change all year; onboarding-only checks go stale.

3Good monitoring is quiet: baseline first, one alert per change.

4Match monitoring intensity to risk, and write the choice down.

A worked example

A marketplace screens every seller at sign-up. Six months later, one seller's parent company is added to a sanctions list after a major designation round. Without monitoring, nobody notices until the payment provider freezes the account and asks questions.

With monitoring, the list change is compared with the seller base overnight. One alert is raised: the parent company of seller 4412 has been listed. The reviewer confirms the link, suspends payouts, files any required report and records the decision. The payment provider later asks what happened, and the full record is exported in minutes.

Common mistakes

Treating onboarding screening as enough.

Monitoring everyone daily for everything, then ignoring the alerts.

Not removing people you no longer deal with.

Clearing the same false match again every week because decisions are not remembered.

No owner for the alert queue.

Checklist

Decide who is monitored and how often, by risk.

Load the list with a baseline.

Make sure alerts reach a named owner.

Track time to resolve alerts.

Review the monitored list quarterly.

A deeper look: what counts as a change

Not every list update matters to you. A list publisher may correct a spelling, add an alias, change an address, remove a listing or add a new one. Each of these can touch your records differently.

A new listing that matches one of your customers is the obvious case. An added alias is subtler: a customer you cleared last month might now match the new alias, so the earlier decision needs a second look. A removal can matter too: a supplier you stopped using because it was listed may now be eligible again, and you may want to record that.

Good monitoring tells you which kind of change happened and shows the previous decision alongside it, so the reviewer starts from context instead of from scratch.

Questions people ask

Does monitoring replace periodic reviews? No. Monitoring watches for list and news changes. Periodic reviews also refresh what you know about the customer: ownership, activity, documents. Most programmes need both.

What about customers we have offboarded? Stop monitoring them, but keep their records for the retention period your rules require.

How fast must we act on an alert? Your procedure should set a target, often one business day for sanctions alerts, and you should measure against it.

What to tell your board or partner bank

Explain who is monitored, against what, how often, who reviews alerts, how fast, and how decisions are recorded. Bring numbers: how many records, how many alerts last quarter, how many were real, how long they took to close. That picture is what a partner bank or board wants to see.

Setting up monitoring step by step

List every relationship you must watch: customers, vendors, partners, grantees.

Assign each a risk tier and decide what is watched for each tier: sanctions only, or sanctions, PEP and adverse media.

Load the list and let the baseline run. Review existing matches separately from new alerts.

Name an owner for the alert queue and a deputy for holidays.

Set response targets by alert type and measure them weekly.

Connect alerts to where your team works: email, chat or your case system.

Each quarter, remove relationships that ended and add new ones that were missed.

Once a year, review the whole set-up: tiers, sources, targets and outcomes. Record what you changed and why.

Small teams can run this in under an hour a week once it is set up. The time goes into the few alerts that matter, not into re-checking everyone by hand.

Key terms

Screening: Checking a name, company or payment against lists and sources to find risk.

Monitoring: Checking customers, vendors or transactions continuously or on a schedule, rather than once.

Re-screening: Running existing customers or vendors through screening again, for example when lists change.

Alert fatigue: When too many low-value alerts make reviewers less careful, so real risks are missed.

Material change: A change in a customer or vendor, such as new owners, that should trigger a fresh review.

Risk-based approach: Spending more effort on higher-risk customers and less on lower-risk ones, as regulators expect.

Summary

Screening and monitoring answer different questions, and most businesses need both. Screen at the door, before money moves or a contract is signed. Monitor everyone you already deal with, because lists and news change throughout the year. Keep monitoring quiet with a baseline, change-based alerts and remembered decisions, so that the few alerts that arrive are read and acted on. Decide who is monitored and how often by risk, write that choice down, give the alert queue a named owner and a response target, and review the whole set-up once a year. When a board, auditor or partner bank asks how you know your book is still clean, the answer is your monitoring set-up and its numbers.

REPORTS THAT HELP