Sanctions Lists and Internal and External Watch Lists

1. Why This Topic Matters

Sanctions compliance is one of the highest-stakes areas of an AML/CFT programme. Unlike most AML obligations, which are risk-based, sanctions obligations are largely strict liability: a financial institution that processes a payment for a designated party can face civil and criminal penalties even if it had no intent and no knowledge. Regulators such as OFAC (United States), OFSI (United Kingdom), the EU Council and national authorities implementing UN Security Council resolutions have imposed fines running into hundreds of millions and even billions of dollars for screening failures. Beyond fines, institutions face loss of correspondent banking relationships, reputational harm and, in extreme cases, loss of access to USD clearing.

For the CAMS exam, this topic sits within the Data Onboarding and Screening Technology domain. The examiners expect you to understand not only what the lists are, but how they are loaded into screening systems, how matching technology works, why false positives and false negatives occur, and how an institution governs the whole process. Questions frequently test the distinction between sanctions lists (mandatory, legally binding) and watch lists (risk-management tools), and between external lists (sourced from third parties) and internal lists (created by the institution itself).

2. What Are Sanctions Lists?

A sanctions list is an official register, published by a government or supranational body, of individuals, entities, vessels, aircraft, and sometimes entire countries or sectors with which dealings are prohibited or restricted. Key lists you should recognise:

OFAC (US Treasury Office of Foreign Assets Control)
- Specially Designated Nationals and Blocked Persons List (SDN List): the primary US list. Assets of SDNs must be blocked (frozen) and US persons are generally prohibited from dealing with them.
- Consolidated Sanctions List: includes non-SDN lists such as the Sectoral Sanctions Identifications (SSI) List, Foreign Sanctions Evaders (FSE) List, Non-SDN Menu-Based Sanctions (NS-MBS) List, and others.
- The 50 Percent Rule: any entity owned 50 percent or more, directly or indirectly, in aggregate by one or more blocked persons is itself blocked, even if it does not appear on the list by name. This is a classic exam point.

United Nations Security Council Consolidated List
Issued under Chapter VII of the UN Charter; UN member states are obliged to implement these designations into domestic law. Many countries' lists derive from the UN list.

European Union Consolidated Financial Sanctions List
Directly applicable in all EU member states through Council Regulations; includes autonomous EU measures as well as UN-derived listings.

United Kingdom (OFSI / UK Sanctions List)
Post-Brexit the UK maintains its own consolidated list under the Sanctions and Anti-Money Laundering Act 2018.

Other national lists
Canada (SEMA, Special Economic Measures Act), Australia (DFAT Consolidated List), Switzerland (SECO), Japan (MOF), Singapore (MAS), Hong Kong, and many others.

Types of sanctions programmes
- Comprehensive (country-based) sanctions: prohibit virtually all dealings with a jurisdiction (historically Cuba, Iran, North Korea, Syria, Crimea region).
- Targeted or smart sanctions: aimed at specific persons, entities, vessels or aircraft (list-based).
- Sectoral sanctions: restrict specific activities, such as new debt or equity financing, with named entities in defined sectors (for example Russian energy, finance and defence).
- Secondary sanctions: target non-US persons who engage in significant transactions with sanctioned parties, extending reach extraterritorially.
- Thematic programmes: counter-terrorism, counter-narcotics, cyber, human rights (Global Magnitsky), non-proliferation.

Obligations when a true match is found
- Block (freeze): hold the property and report to the regulator (OFAC requires a blocking report within 10 business days and an annual report of blocked property).
- Reject: return the transaction where the prohibition does not require blocking (for example, certain sectoral or country programmes) and file a reject report.
- Do not tip off the customer in a manner that would violate law, and escalate to the sanctions compliance officer.

3. What Are Watch Lists?

Watch lists are broader than sanctions lists. Appearance on a watch list does not automatically create a legal prohibition; it signals elevated risk that must be assessed through enhanced due diligence. Watch lists are classified as external or internal.

External watch lists (sourced from governments, regulators or commercial vendors):
- Politically Exposed Persons (PEP) databases: domestic and foreign PEPs, their family members and close associates, usually compiled by vendors such as World-Check, Dow Jones Risk and Compliance, LexisNexis, Accuity and others.
- Law enforcement and regulatory lists: FBI Most Wanted, Interpol Red Notices, FinCEN Section 311 special measures designations, FinCEN 314(a) requests, SEC and FINRA enforcement actions, debarment and exclusion lists (World Bank, OIG LEIE, SAM.gov).
- Country risk lists: FATF high-risk and other monitored jurisdictions (the so-called black and grey lists), EU high-risk third countries, Transparency International Corruption Perceptions Index, tax haven lists.
- Adverse media (negative news): structured or unstructured feeds flagging persons linked to financial crime, corruption, terrorism, trafficking or fraud in reputable news sources.
- Industry-shared lists: consortium data on fraud, mule accounts or terminated merchants.

Internal watch lists (created and maintained by the institution itself):
- Exited or de-risked customers: relationships terminated for financial crime reasons, to prevent re-onboarding through another branch or product.
- Subjects of prior SARs/STRs or internal investigations.
- Declined applicants who failed onboarding due diligence.
- Internal blacklists of counterparties, beneficial owners or addresses linked to fraud or suspicious activity.
- Whitelists (good-guy lists): records confirmed as false positives against a specific list entry, used to suppress repeat alerts. These must be tightly governed and periodically revalidated because a whitelisted name can become a true hit if a new designation is added.
- Internal PEP or high-risk customer registers flagged by relationship managers.
- Employee and insider lists for conflict-of-interest and insider screening.

Key distinction for the exam: a sanctions list hit that is confirmed as a true match triggers a mandatory legal action (block or reject). A watch list hit triggers risk-based action: enhanced due diligence, senior management approval, enhanced monitoring, or a business decision to decline the relationship.

4. How It Works: Data Onboarding of Lists

Before any screening can occur, lists must be reliably loaded into the screening engine. This is the data onboarding component.

Sourcing: institutions either download lists directly from the issuing authority or subscribe to a commercial aggregator that consolidates hundreds of lists into a single feed with standardised fields. Vendor lists add value through de-duplication, enrichment (dates of birth, aliases, identifiers, photographs), and categorisation, but the institution remains accountable for coverage.

List selection and scoping: the institution documents which lists are in scope based on its legal obligations (jurisdictions of incorporation and operation, currencies cleared, correspondent relationships) and risk appetite. A US-dollar clearing bank must screen OFAC lists regardless of where it is located; an EU bank must screen EU lists; a global bank typically screens all major lists plus local lists in every country of operation.

Update frequency: sanctions lists change without notice, sometimes several times a week. Best practice is automated daily or intraday updates with alerting when a new version is published, followed by immediate rescreening of the customer base against the delta (the new or changed entries). Lagging updates is a frequently cited examination finding.

Data quality and normalisation: list records contain names in multiple scripts, aliases (also known as, formerly known as), weak aliases, dates of birth, nationalities, passport numbers, addresses, vessel IMO numbers, aircraft tail numbers, cryptocurrency wallet addresses and BIC codes. Onboarding involves parsing these into structured fields, transliterating non-Latin scripts, removing noise words, and mapping to the screening engine schema. Poor list data quality produces both false negatives (missed hits) and excessive false positives.

Customer and transaction data quality: the other side of the match. Screening is only as good as the customer data captured at onboarding. Incomplete names, missing dates of birth, free-text address fields and unstructured payment messages degrade matching. Hence the link between data onboarding (KYC data capture) and screening effectiveness. ISO 20022 structured payment messaging is intended to improve this.

Version control and audit trail: every list version must be retained with timestamps so the institution can prove which list was in force when a transaction was screened.

5. How It Works: Screening Technology

Two principal screening modes:
- Customer (name) screening: performed at onboarding, then periodically (batch rescreening) and whenever a list changes or customer data changes. Covers customers, beneficial owners, directors, authorised signatories, guarantors and connected parties.
- Transaction (payment) screening: performed in real time on inbound and outbound payments, trade finance documents and securities trades before execution. Screens originator, beneficiary, intermediary banks, free-text fields, vessel names, ports and goods descriptions.

Matching techniques:
- Exact matching: character-for-character; rarely sufficient alone.
- Fuzzy matching: tolerates spelling variations, typos, transpositions using algorithms such as Levenshtein (edit distance), Jaro-Winkler, and n-gram comparison.
- Phonetic matching: Soundex, Metaphone and similar algorithms match names that sound alike (Mohamed, Muhammad, Mohammad).
- Transliteration and script handling: converting Arabic, Cyrillic, Chinese and other scripts into Latin equivalents and recognising multiple valid transliterations.
- Token and name-order handling: recognising reversed names, missing middle names, initials, titles and honorifics.
- Secondary identifier matching: using date of birth, nationality, ID numbers and addresses to strengthen or discount a name match.
- Stripping and standardisation: removing noise words (Limited, LLC, Mr), punctuation and diacritics before comparison.

Thresholds and tuning: the engine produces a match score; alerts are generated above a configured threshold. Setting the threshold too high causes false negatives (missed true matches, the most serious failure); setting it too low floods analysts with false positives. Tuning uses sample testing, above-the-line and below-the-line analysis, and documented rationale approved by governance. Different thresholds may apply to sanctions lists versus PEP or adverse media lists, reflecting the different consequences of a miss.

Alert management workflow:
1. Alert generated and assigned a risk level.
2. Level 1 review: analyst compares identifiers to discount obvious false positives (different gender, date of birth, country).
3. Level 2 escalation for possible or true matches to the sanctions team or compliance officer.
4. Decision: false positive (document and possibly whitelist), true match (block or reject and report), or request for more information from the customer or correspondent.
5. Four-eyes review for all true match or release decisions; full audit trail of rationale.

Model validation and testing: screening systems are models and should be independently validated. Testing includes injecting known list names with deliberate variations to measure detection rate, verifying all in-scope lists are actually loaded, checking that all relevant data fields are screened, and reviewing whitelists. Regulators expect documentation of configuration and periodic end-to-end testing.

Emerging technology: machine learning is used to prioritise alerts and reduce false positives, natural language processing supports adverse media screening, and blockchain analytics tools screen cryptocurrency wallet addresses against OFAC-listed addresses. Institutions must ensure explainability and avoid letting models suppress true hits.

6. Governance and Programme Elements

OFAC's Framework for Compliance Commitments identifies five essential components that map directly onto this topic: management commitment, risk assessment, internal controls, testing and auditing, and training. For list management specifically, examiners look for:
- A documented list management policy naming the owner of each list and the process for adding, changing or removing lists.
- Change control for screening engine configuration.
- Escalation procedures and clear roles between the business, compliance and the sanctions unit.
- Record retention of alerts, decisions and list versions (typically five years or more).
- Training for front-line staff on recognising sanctions red flags not caught by automated screening, such as stripping of payment data by a correspondent, vague goods descriptions, or shipping routes through sanctioned ports.

7. Common Red Flags Related to List Screening
- Payment instructions with missing or altered originator information (possible wire stripping).
- Use of nicknames, initials or shortened names inconsistent with identity documents.
- Customers requesting the institution not to include certain names in payment fields.
- Entities whose ownership is deliberately kept just below 50 percent by sanctioned persons.
- Vessels that switch off AIS transponders or change flags frequently.
- Sudden increase in transactions with jurisdictions bordering a comprehensively sanctioned country.

8. Exam Tips: Answering Questions on Sanctions Lists and Internal and External Watch Lists

Tip 1: Separate legal obligation from risk management. If a question describes a confirmed match to a sanctions list, the correct answer involves blocking or rejecting and reporting to the competent authority. If it describes a PEP or adverse media hit, the correct answer is enhanced due diligence and senior management approval, not automatic freezing. Picking a sanctions action for a watch list hit, or vice versa, is a common trap.

Tip 2: Remember the 50 Percent Rule. When a scenario mentions a company not on any list but owned 50 percent or more by one or more SDNs, the entity is treated as blocked. If ownership is below 50 percent, the entity is not automatically blocked but may warrant caution and enhanced due diligence.

Tip 3: Know which list belongs to which authority. SDN is OFAC (US). The Consolidated List under Chapter VII is the UN. OFSI is the UK. The EU publishes Council Regulations. Questions may test whether a non-US institution must comply with OFAC: the answer usually hinges on US nexus such as USD clearing, US persons, or US-origin goods, plus the reach of secondary sanctions.

Tip 4: Internal versus external lists. Any list the institution creates from its own experience (exited customers, prior SAR subjects, declined applicants, whitelists) is internal. Any list obtained from a government, regulator or vendor is external. If a question asks how to prevent a de-risked customer from reopening an account at another branch, the answer is an internal watch list integrated into onboarding screening.

Tip 5: False positives versus false negatives. A false positive is an alert on a party that is not actually listed; it costs time and money. A false negative is a missed true match; it causes regulatory breaches. If asked which is more serious from a compliance standpoint, choose false negative. If asked how to reduce false positives without increasing risk, choose answers involving secondary identifiers, data quality improvement, documented tuning and governed whitelists, not simply raising the threshold.

Tip 6: Timing of screening. Customer screening happens at onboarding, periodically, and upon list or customer data changes. Payment screening happens in real time before the transaction is executed. An answer suggesting payments are screened after settlement or only monthly is wrong.

Tip 7: List update frequency. Best practice is automated, near real-time or at minimum daily updates with rescreening against changes. Any option implying quarterly or annual list refreshes is incorrect.

Tip 8: Whitelists need controls. Whitelisting a specific customer-to-list-entry pair is acceptable; whitelisting a customer against all future hits is not. Look for answers that mention periodic revalidation and documented approval.

Tip 9: Accountability cannot be outsourced. Using a vendor-aggregated list or a third-party screening provider does not transfer regulatory responsibility. The institution must perform due diligence on the vendor, confirm list coverage and test outputs.

Tip 10: Watch for the best answer, not just a correct one. CAMS questions often offer several plausible actions. Prefer the answer that is risk-based, documented, escalated to the appropriate officer, and compliant with legal obligations. Avoid answers that involve tipping off the customer, unilateral front-line decisions to release a sanctions hit, or ignoring an alert because the customer is long-standing.

Tip 11: Data quality links to screening. Questions in the data onboarding domain may describe poor matching results and ask for the root cause. Frequently the answer is incomplete or unstructured customer data captured at onboarding, inconsistent name formats, or lists not properly normalised, rather than a defect in the algorithm itself.

Tip 12: Reporting obligations. Know that OFAC requires blocked and rejected transaction reports within 10 business days and an annual blocked property report, and that other jurisdictions have equivalent reporting duties to their sanctions authority. A freeze without a report is an incomplete answer.

9. Worked Example Question

A bank's real-time payment screening system generates an alert on an outbound wire. The beneficiary name is a 92 percent fuzzy match to an SDN, but the beneficiary address is in a different country and the date of birth on file differs from the list entry. What should the analyst do first?

Reasoning: a high score with conflicting secondary identifiers is a possible false positive, but the analyst must not release unilaterally based on assumptions. The best answer is to hold the payment, review all available identifiers, document the comparison, and escalate to the sanctions compliance function for a decision under a four-eyes process. An answer that releases the payment immediately because the address differs, or that blocks and reports without analysis, is weaker. If after full review the identifiers clearly show a different person, the payment is released and the decision is documented; if doubt remains, the payment is blocked and reported.

10. Summary Checklist
- Sanctions lists are mandatory; watch lists are risk-based.
- External lists come from authorities and vendors; internal lists are self-generated.
- Onboard lists through automated, frequent, quality-controlled feeds with version control.
- Screen customers at onboarding and periodically; screen payments in real time.
- Use fuzzy, phonetic and transliteration matching with secondary identifiers and governed thresholds.
- Manage alerts through tiered review, four-eyes decisions and complete audit trails.
- Apply the 50 Percent Rule and secondary sanctions awareness.
- Block or reject true sanctions matches and report within required timeframes.
- Validate, test and tune the system independently, and never outsource accountability.