AML screening and monitoring: how it works, step by step

What is AML screening?

AML screening is the check of a customer, its beneficial owners and the people who act for it against sanctions lists, politically exposed person (PEP) lists and adverse media, to find out whether any of them is someone you cannot or should not take on without more work. It runs at onboarding and then again for the life of the relationship, which is what "AML screening and monitoring" means in practice.

Most screenings find nothing. In the screenings run on Dotfile over the past year, 77.5% returned no hit at all, about 3 in 4. The work sits in the remaining quarter, and it is not where you think: sanctions, the only list that can make a payment unlawful, produce 1 hit in 8. The rest is adverse media, warnings and PEPs. This guide sets out what each list is for, the 6 steps with their legal basis today and under the AMLR and a worked example.

Which lists does AML screening cover?

An AML screening compares a name, and whatever else you hold about the person or company, with the entries of several kinds of list. Each list answers a different question, and each carries a different consequence when it matches.

Sanctions are a prohibition: under EU restrictive measures, no funds may be made available to a listed person, directly or indirectly (Article 2, Council Regulation (EU) No 269/2014, the Ukraine-related regime). PEP status raises the level of diligence. Adverse media is evidence you weigh. Treating the three alike is the most common design error in a screening programme.

What is the difference between AML screening and monitoring?

Screening is the check at a point in time; monitoring is running it again whenever the lists or the customer change. A customer who was clean on the day you onboarded them can be designated, elected or charged a year later, and the screening you ran then will never tell you.

Monitoring also has a second meaning: transaction monitoring, which watches what the customer does rather than who the customer is. This guide covers screening. Our guide to ongoing monitoring under the AMLR covers rescreening, registry monitoring and periodic reviews.

How does name matching work, and why do false positives happen?

Screening engines use fuzzy matching: they score how close a name is to a list entry, allowing for spelling variants, transliteration and aliases, so most hits are namesakes that a date of birth or a nationality rules out. We cover why name matching fails and how to cut the load in our guide to AML false positives.

What are the steps of the AML screening process?

The legal basis changes on 10 July 2027, when the EU Anti-Money Laundering Regulation applies (Article 90, Regulation (EU) 2024/1624). Until then, national laws transposing the Fourth AML Directive apply, and sanctions screening rests on the sanctions regulations themselves rather than on customer due diligence.

1. Decide who to screen

Screen the customer and every beneficial owner. From 2027, Article 20(1)(d), Regulation (EU) 2024/1624 requires you to check whether either is under targeted financial sanctions, and whether sanctioned persons control a corporate customer or hold more than 50% of it; Article 20(1)(g) adds the PEP determination. A company screening without UBO verification misses the person who matters.

2. Choose the lists and the matching

Sanctions lists are not optional. Adverse media coverage and fuzziness follow your risk assessment (Article 13(2), Directive (EU) 2015/849; Article 20(2), Regulation (EU) 2024/1624), and the calibration is written down.

3. Screen before the relationship starts

A sanctions hit found after the first payment means funds may already have reached a listed person, and the prohibition on making funds available applies from the first euro (Article 2(2), Council Regulation (EU) No 269/2014).

4. Review every hit and record why

Each hit gets a decision, true match or false positive, with the identifier that settled it. The AMLR asks for "records of the decisions taken and the relevant supporting documents and justifications" (Article 21(3), Regulation (EU) 2024/1624). A discarded hit with no reason is a finding waiting for an inspector.

5. Act on a true match

A sanctions match means freezing and reporting under the sanctions regime (Articles 2 and 8, Council Regulation (EU) No 269/2014). A PEP match means senior management approval, the source of wealth and funds and enhanced ongoing monitoring (Article 20(b), Directive (EU) 2015/849; Article 42(1), Regulation (EU) 2024/1624), for family members and close associates too (Article 46, Regulation (EU) 2024/1624; today Article 23, Directive (EU) 2015/849). Adverse media feeds the risk assessment: the AMLR lists the reputation of the customer and its beneficial owners as a risk variable (Annex I, point (a)(ii), Regulation (EU) 2024/1624).

6. Rescreen

Lists change every week. Under the AMLR, obliged entities "shall regularly verify" the sanctions position, and credit and financial institutions must also do it "upon any new designation" (Article 26(4), Regulation (EU) 2024/1624). Today, rescreening for PEP status and adverse media sits inside ongoing monitoring (Article 13(1)(d), Directive (EU) 2015/849), and sanctions rescreening follows from the asset freeze itself: a customer designated tomorrow is frozen tomorrow (Article 2, Council Regulation (EU) No 269/2014).

Worked example: one company, three people, one real hit

A fictional Dutch logistics company, Halden Freight BV, applies to open an account. You screen four subjects: the company itself, its two beneficial owners (Pieter at 60%, Anna at 40%) and its managing director, Marek.

Seven of eight hits are someone else, each cleared with the identifier that rules it out. The eighth changes the file, but not the answer: adverse media is a risk factor, not a prohibition. Marek's fine feeds the risk assessment (reputation is a risk variable under Annex I, point (a)(ii), Regulation (EU) 2024/1624), the file moves up a level and the review date comes forward. Had it been a sanctions hit, there would be nothing to weigh.

How many AML screenings return a hit? About 1 in 4

Based on AML screenings run on Dotfile over the past year; aggregates only.

• 77.5% of screenings returned no hit. Companies came back clean more often than people: 82.4% against 75.6%.
• 1 in 21 screenings with a hit was a confirmed match once a reviewer resolved it. Why the other 20 come back at all is in our guide to AML false positives.
• Adverse media and warnings each account for 36% of hits; PEP and sanctions lists for 12% each (a hit can sit on several lists).

Sort the queue by consequence, not by arrival. A programme that reads hits first in, first out spends most of its hours on the lists that carry the least weight.

Frequently asked questions

Is AML screening a legal requirement?

Yes. Sanctions screening follows from the sanctions regulations (Article 2, Council Regulation (EU) No 269/2014), which prohibit making funds available to listed persons, and from 10 July 2027 it is also a customer due diligence measure (Article 20(1)(d), Regulation (EU) 2024/1624). The PEP determination is required today (Article 20(a), Directive (EU) 2015/849) and under the AMLR (Article 20(1)(g)).

What is the difference between sanctions screening and PEP screening?

A sanctions match prohibits the relationship. A PEP match permits it with enhanced due diligence. Our PEP screening process guide covers the second in detail, and our OFAC sanctions guide the US side of the first.

What is the difference between KYC and AML screening?

KYC establishes who the customer is: identity, documents, beneficial owners. AML screening checks that identity against sanctions, PEP and adverse media lists. Screening without KYC screens a name you have not verified; KYC without screening verifies someone you may not be allowed to serve.

What happens when AML screening finds a match?

A reviewer first decides whether it is the customer. If it is, the consequence depends on the list: a sanctions match means freezing and reporting, a PEP match means enhanced due diligence and adverse media feeds the risk level (step 5 above).

How often should customers be rescreened?

Under the AMLR, the sanctions check is repeated regularly and, for banks and other financial institutions, on every new designation (Article 26(4), Regulation (EU) 2024/1624). In practice, rescreen when the lists change, not when the calendar says so: our guide to ongoing KYB monitoring covers the rest.

Where Dotfile fits

Dotfile runs AML screening on individuals and companies against sanctions, warnings, PEP, adverse media and fitness and probity lists, through ComplyAdvantage or LSEG World-Check. A template can launch it on every entity of a case: company, beneficial owners, legal representatives and shareholders. With ComplyAdvantage Mesh, you set the categories, the list coverage and the fuzziness from 0 to 100, and filter weak aliases, deceased or delisted entities and inactive PEPs. On ComplyAdvantage screenings, the AML AI assistant qualifies each hit as a true positive, a false positive or one for manual review, with its reasoning, and Autonomy can discard the false positives and validate the true ones under rules your team sets, on every list, sanctions and PEP included, with the reason written on each hit. With World-Check, hits are reviewed in World-Check One, linked from the check. Monitoring keeps screening after onboarding and sends the check back to review when a new potential match appears.