Advanced analytics in sanctions compliance

Watchlist Selection: Overlap Reduction  

The use of multiple screening lists with significant overlap of entities may add to the complexity and costs of system maintenance and testing, while also increasing analysts’ efforts to resolve unnecessarily duplicative alerts. Analytics will assist with the consolidation of lists and the identification and removal of overlap among watchlist parties.

List overlap identification can be performed in Python (and/or other open-source technology/tools) to identify distinct list entries. If naming conventions differ among lists due to regional, linguistic or alphabetic differences, open-source fuzzy logic algorithms and constructs such as RapidFuzz, FuzzyWuzzy or Jaro-Winkler can be applied to quantify levels of similarity between text strings. These algorithms serve to measure the “distance” between two text strings. In other words, edit-distance algorithms can be utilised to quantify the sameness of the character strings in question, with tolerances identified by the user. The result is a streamlined list of unique entries, reducing double-counting and eliminating the artificial inflation of sanction alert volumes.

Data Wrangling: Named-Entity Recognition for Critical Element Identification  

Most sanctions screening programmes identify potential matches solely through comparison of watchlist entities to text strings in fields commonly identified as compliance-critical data elements. Named-entity recognition (NER), a type of natural language processing (NLP), is an analytical approach to text mining of large, unstructured or otherwise unformatted data. Nimble in nature, NER tools identify tokens, or critical named-entity strings, within fields explicitly mapped to contain a name, as well as within free-format text fields such as payment notes and/or in analyst comments on onboarding forms.

The critical fields required for sanctions screening show up in various points along an institution’s       
compliance operations lifecycle. For example:

• In order to support a robust customer identification programme (CIP), onboarding documentation should include name, address(es), date of birth, SSN/TIN, etc., which are usually entered in clearly defined form fields.
• Ongoing customer due diligence (CDD) often entails re-screening of this same account data       
  at a later time on a risk-based frequency.

NER can identify potential matches against watchlist entities based on the aforementioned fields.

We can draw another illustrative example from the payments arena. Payments subject to sanctions screening require similar critical fields for counterparties, including financial institution information. For example, 31 CFR 103.33(g) of the Bank Secrecy Act, known as the “Travel Rule,” identifies the minimum required fields to be populated for funds transfers greater than $3,000 USD (or equivalent). Because many data elements critical to sanctions screening are required by such regulations, NER can be used on free-format fields such as those in SWIFT wire messages or peer-to-peer payment notes on platforms such as Venmo or Zelle.

Risk mitigation through robust CIP, CDD, payment screening and Travel Rule controls is considered the bare minimum action and often relies on screening against a pre-determined mapping of fields. A common gap in screening coverage is not that critical fields are missing from data — it is that the critical fields appear outside the mapped locations the system is programmed to screen. Through techniques such as NER, institutions create coverage against the risk from these gaps.

Screening: Optimised Good-Guy Lists for False Positive Reduction

Data analytics can support the use of good-guy lists with a risk-based approach to transactional and referential data analysis. By using the historical activity of an entity, such as a lengthy history of prior false positive alerts, institutions can rationalise with confidence the “why?” of false positives. This may be as simple as determining that in a system which only uses name fields for matching an individual who frequently triggers alerts, the person has a different date of birth or SSN than the sanctioned individual. Based on the results of this triage, the alerting party is assigned to the system’s good-guy list and corresponding narratives are pre-prepared with the documented support for a quick closure based on the mitigating factors.

Maintenance of good-guy list names should include periodic review to confirm that inclusion of names on the list is still appropriate. Supporting data to reaffirm good-guy listing during this review should include the most recent output/results generated from running the current up-to-date good-guy list against in-scope watchlists.

Alert Triage, Investigation and Remediation: Workflow Simplification

With the current availability of open-source analytics tools, institutions have the ability to challenge the operational efficiency of out-of-the-box vendor workflows. By assigning a risk-rating to sanctions screening hits or otherwise triaging alerts into useful groupings, compliance management can ensure the most efficient combination of alert and analyst efforts. For some institutions, this means pairing the most experienced analysts with the highest risk alerts. Depending on factors such as customer base or geographic exposure, this also may mean putting specific language speakers in charge of reviewing screening hits in a native or fluent tongue. Workflow efficiency is accomplished through the identification of, creation of a scorecard for, and assigning weight to factors such as name-match scoring, nature of the transaction, product/service line, and geographies or currencies involved, among others.

Some questions to consider when performing scorecard analysis:

1. Are there prior alerts for this customer/name? If so, how were they dispositioned?  

Prior positive matches may drive a higher risk rating and require more scrutiny. Similarly, many prior false positives for the same alert content usually indicate a lower level of effort may be needed to disposition — and an analytical model which may require further tuning/honing.

2. Does the type of alert make sense?

For example, if an entity hits against a watchlist entry for a person, or vice versa, this is usually indicative of a low-quality alert, which implies a low level of effort to disposition.

3. What geographies are involved in this alert?

Payments involving higher-risk jurisdictions or consisting of more complex payment flows through multiple countries require a higher level of effort.

4. What was the system-generated match score for this alert?

An alert with a score indicating proximity to an exact match is likely to require escalation anyway, so putting it in the most experienced hands will provide the most thorough and efficient work product.

5. In what language is the watchlist-matched entity?

A benefit of putting certain language or alphabet-based hits in the hands of native language speakers is cultivating a more nuanced understanding of any local language documentation, negative news, etc., as well as a familiarity with characters which may become ambiguous after translation.

Where Do We Go From Here?

Supporting a robust and risk-based sanctions programme with the use of emerging technology and further leveraging advanced analytics require an ever-evolving effort. Analytics and technology must be deployed as proactively as possible in order to stay on the forefront. Simply put, considering the ever-morphing regulatory landscape and level of scrutiny, an institution’s increasingly complex products, services and customer relationships require building out stronger sanctions detection competencies in order to combat advancing technology used for obfuscation, non-compliance and evasion.

Investment in the right tools, personnel and upskilling will help streamline sanctions workflows, optimise sanctions detection systems, augment risk insight generation, and soundly compile the requisite data for end-to-end sanctions compliance. As such, it is incumbent upon compliance stakeholders to seek out such opportunities for technological enhancement, no matter the size, geography/jurisdiction or business of the institution.