False positives in sanctions screening: how to handle a match

Why false positives happen

• Common names: many people and companies share names or very common words such as Trading, Global or International.
• Transliteration: names from Arabic, Cyrillic or Chinese scripts can be written in Latin letters in several ways.
• Partial data: your CRM may hold only a short name, without country or registration number.
• Fuzzy matching: tools look for similar names on purpose, to catch spelling variants used to avoid detection.

Lowering the similarity threshold reduces alerts but increases the risk of missing a real match. A better approach is to keep the threshold sensible and make the review faster.

How to review a match

1. Read the listed entry in full. Official entries often include aliases, addresses, dates of birth, nationalities, registration numbers and the sanctions programme.
2. Compare the identifying data. Check country, address, registration or tax number, date of incorporation and, for people, date of birth and nationality.
3. Check owners and directors. A company with a different name may still be linked to the listed party through its owners.
4. Decide. If key data clearly differ, clear the alert as a false positive. If they agree, treat it as a possible true match. If the data are missing, collect them before deciding.
5. Escalate when in doubt. A possible true match goes to compliance or legal advisers, and pending payments or deliveries wait.

Keep the review proportionate. Most alerts can be cleared in a few minutes when the CRM holds country and registration number. The ones that need time are the cases where your own data are thin, which is a good reason to improve the data rather than to skip the review.

Which data carry most weight

Not all data are equally strong. A registration number or a date of birth that differs is a strong reason to clear an alert. A different city is weaker, because companies move and listed parties use several addresses. A similar name with the same country and sector deserves more attention than a similar name in an unrelated country and business.

Be careful with clearing an alert only because the name is spelled slightly differently. Spelling variants are one of the most common ways listed parties appear in transactions.

For individuals, such as owners and directors, the date of birth and the nationality are usually the most useful data. For companies, the registration number and the country of incorporation come first. When the listed entry itself has few identifying data, which happens, you may need extra information from the counterparty before deciding.

Keep a decision log

Every review should leave a record with:

• the name screened and the listed entry it matched;
• the similarity score or the reason for the alert;
• the data compared and their sources;
• the decision, the reason and the name of the person who decided;
• the date of the decision.

A good log has two benefits. It shows auditors, banks and authorities that each alert was examined. And it avoids reviewing the same namesake every time the list is updated: if nothing in the listed entry or in your counterparty has changed, the earlier decision still applies. If either changes, the alert should be reviewed again.

Reducing false positives without missing true matches

• Collect country and registration number at onboarding, so every alert can be checked quickly.
• Screen legal names rather than abbreviations or internal nicknames.
• Use matching that understands transliteration, word order and common company words.
• Remember decisions, so a cleared namesake does not come back unless something changes.

When a match is real

If the review confirms that the counterparty is listed, or owned or controlled by a listed party, the steps change: freeze, report and stop payments. Our guide on what to do if a customer is added to a sanctions list explains them.

Where Unicorn Intelligence fits

Unicorn Intelligence explains each possible match with a score and reasons and keeps every decision in an audit log; new accounts receive a $50 credit.

Frequently asked questions

What is a false positive in sanctions screening?

An alert on a name that is similar to a listed person or company but, after review, turns out to be a different party.

How do I clear a false positive?

Compare identifying data such as country, address, registration number, date of birth and owners with the listed entry, then record the decision and the reason.

Should I lower the matching threshold to get fewer alerts?

Be careful. A lower sensitivity reduces alerts but increases the risk of missing a real match. Better data and a decision log reduce the workload more safely.

Do I need to review the same namesake again?

Not if nothing has changed in the listed entry or in your counterparty. If either changes, review it again and update the record.

Who should decide on a possible true match?

A person with training in sanctions, usually in compliance or legal, and with the authority to stop payments or deliveries while the case is reviewed.