The Sanctions Screening Buying Guide

This guide gives you the questions to ask a screening vendor, and the answers that should worry you. It is written for the trade compliance or export control practitioner who is choosing a screening software, or checking whether the current tool still fits.

Over six months we interviewed 70 trade compliance practitioners across Europe: chemicals, semiconductor, energy, manufacturing, telecoms, aviation, packaging, logistics and technology. We asked how they screen business partners, what happens when a match appears, and where their time is spent. Everything in this guide comes from those conversations. Where we write “practitioners told us”, we mean a pattern that came up across several interviews, never one person's story.

The central finding is simple. Vendors talk about matching: how many lists, how good their matching logic is, and how low the false positive rate. However, practitioners spend their working time on resolution: the research, the decision, and the record that proves what they did. Today's vendor tools end at the match. Your time starts there, and so do the hours, the cost and the audit risk.

One note on words: vendors call it an alert. This guide calls it a match. It means the tool has found a name on a list that looks like your business partner, and a person still has to decide whether it is the same one.

Sections 2 to 11 each have three parts: what practitioners told us, the questions to ask, and the answers that should worry you. The last four sections give you a short list of things every tool must do, a 2-day test to run on your own cases, and all the questions in one list. For the shorter framework this guide builds on, see how to evaluate sanctions screening software.

What practitioners told us

Knowing which lists a company must screen against was named, again and again, as one of the hardest parts of the job. Practitioners who had built their own screening tools said the same: choosing and grouping the lists took longest and was never quite finished.

The default in many tools is to screen against everything. Practitioners described the result as a steady stream of matches from lists with no bearing on their business, dismissed by hand, week after week. Several said their false positive volume fell sharply once they had trimmed the lists to what applied to them. The cut itself took months, and in some tools every change needed a vendor ticket.

Grouping matters as much as selection. Practitioners wanted matches separated by list, in their own order of priority. A match on an asset freeze list and a match on an export control list mean different things for the business. Some tools bundled these together at the entity level. Others gave a match on a low-priority list, such as a regulatory enforcement list, the same visual weight as a hard stop.

Not every part of a company needs the same lists. Practitioners described screening employees, banks, visitors and business partners against different list sets, and needing different sets per country or business unit. Several also kept lists of their own: internal no-business lists, lists agreed with a customer, and lists that no data provider carries.

What practitioners told us

In our research, re-screening ran on every cadence from monthly to nightly, with a few programmes also triggering a check when an order or delivery was created. Practitioners on weekly or monthly runs knew the gap. Several described the same worry in almost the same words: a business partner is listed overnight, and the shipment leaves before the next run identifies the match.

The gap is not theoretical. Under EU restrictive measures, the asset freeze applies from the moment the listing is published in the Official Journal (Council Regulation (EU) 269/2014). Continued dealing after publication can breach the freeze, whether or not the programme has run its next re-screening. Daily re-screening is the practical baseline for every active business partner, and some practitioners we spoke to were moving from weekly to daily for exactly this reason. The reasoning behind that baseline is set out in how often to re-screen business partners.

Speed created a second problem. Some practitioners have very large business partner bases. Their full re-screening runs produced thousands of matches. Most of those matches were on partners that had been cleared the week before.

Two features decided whether that was manageable. The first is delta screening: checking what changed on the list against the partner base, instead of the whole base against the whole list. The second is carrying decisions forward: a match cleared on Monday does not come back unchanged on Tuesday. Practitioners on tools without these described their team re-reviewing the same names on every re-run.

Some practitioners also wanted a re-screen at the moment that matters most: just before an order ships, or when the receiving party changes at short notice. Their point was not that nightly is too slow in general. It was that the partner on the delivery note is not always the partner screened at order entry.

List updates also arrived late inside some tools. A few practitioners described list changes reaching their tool days after publication, or being entered into the system by hand.

What practitioners told us

Not one practitioner in our research described a clean, exact match. Every match they handled was a partial match on a name, an address, or both, and needed a person to interpret it. This was a typical case, so the quality of the explanation sets the speed of the whole programme.

Practitioners on tools that showed a percentage and nothing else said the same thing in different ways: a 65 percent name match tells you nothing about what to do next. They wanted to see which words matched, what was ignored, and how a legal form such as GmbH or LLC influenced the score. They also wanted to see whether the country of the listed entity matched the country of their partner. A country mismatch alone cleared a large share of matches at a glance, and some tools cannot do it at all.

Scripts were the hardest cases. Practitioners with business in Russia, the Gulf and China described three problems. A name can be written several ways in Latin letters. A common given name matches hundreds of listed people. A company changes its registered name every few years.

Some had built parallel manual checks on the free government list websites because their paid tool only matched on the full legal name.

Messy input came up as often as scripts. Practitioners described country fields holding the same country in three languages and several spellings, cities written as Moscow and Moskau, and abbreviations that mean different places in different countries. Global sales and customer service teams enter this data, and no compliance leader can check every field. What they wanted is a tool that normalises the input before it screens. It should recognise that Germany, Deutschland and Allemagne are one country, and show what it could not recognise.

Several said that would let them stop worrying about what every order desk in the group types in.

Noise cut both ways. Generic words such as “global” or “industry”, or a city name inside a company name, drove much of the false positive volume. Practitioners used exclusion words to reduce it, and several were uneasy about it, because an exclusion that is too wide can hide a real match. They wanted a threshold they could defend to their own oversight, and described testing their way to one on their own data rather than accepting a vendor default. Most who named a number sat between roughly 80 and 88 percent, with a few deliberately lower.

What practitioners told us

Practitioners in our research estimated that most of their screening time went to research after the match, not to the decision itself. The research looked the same across companies and sectors. Open the match, open a browser, and search the name, in more than one search engine when the business partner is Russian or Chinese. Find the website and check that the company exists and that its business fits what it is buying from you. Find the registry entry, check the address on a map, look for the owners, look for adverse news related to sanctions or export activity, and then decide.

Open browser tabs became the way practitioners measured this work, and up to 15 per match was the number they kept naming. A simple false positive took them a few minutes. An ambiguous match took twenty to thirty, and a complex case with ownership questions took hours or days.

Two pieces of information were missing from tools. The first is the actual listing: when the entity was listed, under which programme, with a link to the source document, and any later changes to the entry, such as a new alias, a new address, or removal from the list. Practitioners described leaving the tool to read the original publication because the tool did not carry the date, the aliases or the text.

The second missing piece is what the match means for your company. A match on a US list is a different question for a company with no US business than for one paying in US dollars. Some listings carry secondary sanctions language that only appears in the original text. Practitioners said no tool they had used told them whether a list applied to their situation, and several named this as the thing they most wanted.

The order of the results matters too. A screening run can return hundreds of matches, shown in whatever order the tool produces them. The one real hit can sit on page five, behind irrelevant entries, and nobody sees it until late in the day. Practitioners wanted the most serious matches at the top of the list.

So does the audience. The person who opens the match is often not a compliance specialist. Sales operations and order desks receive matches too, and their question is simpler: what do I do with this, and should I escalate. A summary that answers that in plain language was valued by practitioners at every level of experience, with one condition. Every fact in it must show its source, because anyone can publish anything online, and an unverified source is worse than none.

What practitioners told us

Documentation, not investigation, was what several practitioners named when we asked what took the most time. Every cleared match needs a note that explains the decision. Written by hand, practitioners put that at around five minutes per match, before any research.

The evidence lived everywhere except the screening tool. Practitioners described screenshots of the official list websites, saved and uploaded as proof. Research saved as screenshots in a shared drive. Email chains in the CRM standing in as the record. PDF reports filed in customer folders, with a spreadsheet to track when each business partner was due for re-screening.

Supporting emails that could not be attached to the case had to be pulled from mailboxes when the auditor asked. This was the common picture, and it included companies with mature, integrated screening.

Two record keeping gaps came up repeatedly. The first is a third possible result, next to “false positive” and “true match”. A match can be real and still not stop the business: the listed entity is on a list that does not apply to you, or the transaction is legally cleared. Practitioners described tools that only allowed “false positive” or “true match”, so a valid but irrelevant match had nowhere to go. Some built manual workarounds to record it and keep watching the entity in case it landed on a list that did matter.

The first gap has a reverse case too. A partner matches no list at all, but has to be blocked anyway because the company's bank or an outside adviser said so. That block also needs a place in the record, with the reason and who decided it.

The second gap is memory. Practitioners wanted the programme to know that this partner had been cleared five times, or that its parent had been rejected last year, instead of starting every match from nothing. Without that, the knowledge leaves with the person who screened it prior.

Practitioners who had been through audits described the same demand: the record for a specific partner or transaction, retrievable in minutes. It has to show the inputs, the list data at the time, the research consulted, the decision, and who made it. Some had found their tool kept match records for weeks, not years. Others could not find a record by transaction at all, only by hunting through dates. What an auditor tests is set out in what auditors actually look for.

What practitioners told us

More than half of the programmes in our research had a live connection between the screening tool and the ERP and/or CRM. The connection was often partial: partner data flowed into the tool, but results had to be typed back into the ERP as a status. In some programmes the master data was connected and the orders and deliveries were not. Every manual step was a chance for an error, and practitioners named the one they feared most: the result never gets written back at all. The screening was done, but the ERP still shows the partner as open or as cleared, and nobody notices until an audit, or a shipment.

Where a connection existed, the next question was what a block does. In many programmes the block was an email to a person, asking them to stop a process by hand. Practitioners wanted the opposite: a confirmed match blocks the document, the order, the payment and the delivery in the system itself, until a named person releases it with a reason.

The connection carries whatever the ERP holds. Duplicate partners, names in several languages, legal forms written five ways, and country fields typed by hand all arrive in the tool as they are. Practitioners were clear that clean master data is their job before it is the vendor's. They were equally clear that the tool has to say what it could not read, instead of screening it anyway.

What practitioners told us

Vendor dependency was the complaint about system settings we heard most. Practitioners described tools where every change to a threshold, a list or an exclusion word went through the vendor. Sometimes that meant an edit to a large background spreadsheet they never saw. Sometimes it meant a billed change request.

Tuning the matching logic in ERP-embedded modules needed specialists that only large groups employ. Practitioners saw threshold tuning as one of the biggest ways to cut match volume, and many were not able to change it themselves.

What practitioners wanted was not freedom to set anything. It was guidance they could defend. A recommended starting threshold for their industry, with the reasoning and a worked example. This threshold still catches this obvious listed person, and here is what it does to your volume.

They wanted to run a handful of their own business partners through the tool before adjusting anything. Then they wanted to keep adjusting, using the tool's own numbers to see which lists and which words produced the most noise.

The settings also have to fit the organisation. Practitioners asked for thresholds per list, list sets per team, and matches routed to the colleague with the regional knowledge, or landing in a shared pool. Some described previous tools that made the person pick the matching method, fuzzy or phonetic or exact, on every search. They preferred all methods to run at once, with the tool explaining which one was used.

What practitioners told us

Support decided whether practitioners stayed with a vendor. Several had left one, or wanted to, because nobody answered while a screening decision waited. Some waited weeks for a reply. Some never got one. It did not matter what the question was: a contract change, a new user licence, training, a bug, how the matching logic works, or how to end the contract.

What they wanted was simple. A reply within one day, from a person who knows their setup, and a vendor that behaves like a partner rather than a ticket queue. Several named that as the deciding factor in their last selection.

What practitioners told us

Views on automation ranged wider than on any other topic. Some experienced practitioners did not want to see any match below their threshold, and said so without hesitation. Others wanted a person to look at every match. The difference was not experience or company size. It was who carries the liability, and how much trust the practitioner had in the tool's reasoning.

The recurring question was accountability. If software clears a match, who is responsible when it was wrong? Practitioners noted that authorities have not said how far a programme may rely on automated decisions, and that they must still be able to show how they interpreted the rules. Their answer was consistent: the tool proposes, the person decides, and the record shows both.

Practitioners who had built their own filters on top of a screening tool described the same setup. The matching stays deterministic and reproducible. A model then explains and ranks the matches, and cuts the obvious noise. A person makes the final call.

Two warnings came with the enthusiasm. First, automation can be gamed, from outside by parties that vary their names, and from inside by users who learn what slips past the threshold. Second, a tool that flags concern everywhere can push a junior colleague to block too much, which costs time from repetitive escalations. Practitioners wanted the decision to proceed to be as well supported and documented as the decision to block.

Trust in models had a practical side. Practitioners asked which models the tool uses, where they run, whether company data leaves the region, and whether a compliance policy uploaded to tailor the output stays private to them. Large groups with strict AI governance treated these as procurement gates.

What practitioners told us

Practitioners looking at newer vendors asked one question early: what happens if I need to switch, and how do I get my records out, in what format? The harder version of that question comes later. Records in one tool rarely move cleanly into another, so an audit question about an old case can depend on a licence you no longer hold.

Leaving is the last contract question. Price is the first. It came up in every interview and decided less than expected. Practitioners who had chosen on price alone described tools that matched adequately and supported nothing after the match. Practitioners on the most expensive setups still described the same manual research after the match. The real difference in cost between tools was the time the team spent after each match.

Compare the total cost of ownership, not just the licence fee. Four questions to surface that number. How much does your team have to change the way it works? How much training do people need? What will it cost in later years, and how many people do you still need to run it?

Hosting mattered to some practitioners more than others. Those in defence, dual-use and semiconductors treated the location of data and of any AI models as a hard requirement. Others called it a tiebreaker at equal price.

Every serious tool does all of the following. Ask for a yes, see it once in the demo, and move on. A no on any item is a reason to stop.

• Lists and thresholds per team

  Each team, business unit or country can run its own list set and thresholds, and the group still sees the whole picture.

• Ongoing monitoring

  Every active business partner stays under monitoring after onboarding and is re-screened automatically when lists change, daily must be possible. A partner can be removed when the relationship ends, with the change recorded.

• Sanctioned ownership and control

  The tool checks whether a business partner is owned by a listed party (the 50% rule) or controlled by one. It does not stop at whether the partner itself is listed.

• Entity types

  Companies, people, vessels and aircraft, with the type used in matching so a ship does not match a company. For people, date of birth and nationality are match fields.

• Your own lists

  A good-guy list that auto-clears approved business partners, a block list that stops a partner even if it's not listed, and custom lists you create yourself.

• Noise and weight words

  Legal forms and generic words the matching should ignore, and words that should count more, managed by your admin.

• Batch and single-name screening

  A file of thousands of partners, and one name checked on the spot, under the same rules. Matches from a batch are assigned by rules you can see, for example by region: Asian matches to the Asia team, EU matches to the EU team.

• Address fields count

  Street, city, region, postcode and country are matched, not only the name.

• Country checks

  Embargoed and high-risk countries are flagged on the partner and on the delivery address, separate from list matches.

• Non-Latin scripts

  Chinese characters, Cyrillic and Arabic are screened, and the tool shows how it transliterated.

• Identifiers

  Registration numbers, tax IDs and LEI-type numbers can be used to match, and to settle a match.

• Roles and data separation

  Permissions per user and per team, and screening groups that must stay apart (employees, for example) are invisible to other teams.

• Four-eyes and escalation

  A confirmed match or a release can require a second person, and any match can be escalated to another team, with the handover recorded.

• Notifications per group

  Who is told what, by email or in the tool, is set per team.

• Bulk actions

  Clear, assign or escalate many matches at once, with one note applied to all, instead of one click per match.

• One partner, one history

  The same partner screened from two systems is recognised as one, and its past decisions appear on the next screening.

• Reporting

  A PDF per case, an export for the whole programme, and a view of volumes, outcomes, open matches by age, and which lists make the noise.

Day one: 5 of your own cases, then a batch

Pick 5 past cases from your own records. The test is stronger if you can include some of these, but do not go looking for cases you do not have:

• a false positive your team cleared on a common or generic name
• a partner whose name was originally written in another script, such as Cyrillic or Arabic
• a partner whose name has changed at some point
• a partner with an incomplete record, such as a missing legal form or country
• one true match, if you have ever had one
• one partner whose delivery address changed after the order

Run them through the tool yourself, not the vendor. For each case, note three things. Detection: did the tool find what you expected, and did it show the listing date and the source? Explanation: could you see why it scored what it scored without asking anyone? Resolution time: how many minutes from opening the match to a decision you could defend, and how many of those minutes were spent outside the tool?

Then take one list update from the last week and ask when it reached the tool. That number is your detection time.

Then upload a batch of a few hundred existing partners and look at the false positive rate. That is the volume your team will live with every day, and no demo shows it.

Day two: change it, break it, leave it

Change a threshold, switch a list off, and add an exclusion word. If any of these needs the vendor, note it.

Open one of yesterday's cases as an auditor would. Start from the order or the partner record, not from the tool's case list, and time how long it takes to reach the full record. Then read the record with the tool closed. Could a stranger tell what was decided and why?

Ask for the exit export of your 5 cases. Open the file and review for clarity.

How to score it

Three numbers decide it. Detection time: the hours from a list change to the match on your screen. Resolution time: the minutes from that match to a documented decision, measured with a clock, not estimated. And a count: of the test case decisions, how many could you defend from the record alone. A tool that scores well on the first and poorly on the second has sold you matching and left you the work.

The demos practitioners saw follow one script: a name, a list, a score, a clean screen. The audits they faced ask a different question: what did you decide about this business partner three years ago, why, on what evidence, and who approved it. Everything between those two moments is resolution: the research, the decision and the record. Practitioners said that is where their hours go, and it is where the cost and the audit risk sit.

So measure one number across every vendor: the time from a list update to a documented decision on the matches it produced. Detection time plus resolution time. A vendor can sell you list coverage, matching logic and run frequency. Ask each one what their tool does for the second half, and ask to see it on a real match.

The demo shows you the match. The audit asks for the decision.

Every question from sections 2 to 11, grouped by topic. Take this list into the demo.