Sanctions screening and ongoing monitoring, explained
Sanctions screening compares a name with sanctions records to find candidates for review. Ongoing monitoring repeats that check as stored data changes, helping your team follow up after the first search.
Reliance Risk Registry brings supported sanctions sources, name matching, subscriptions, and notifications into one workspace. This guide explains how those pieces work together and what a result can tell you.
What is the difference between screening and monitoring?
A one-time search answers a question about the data available at that moment. A subscription keeps a name in an ongoing monitoring workflow, including a name that has no match today.
- Search or subscribe. Search stored names and aliases in the dashboard, or create a subscription from your backend.
- Screen against stored records. Newly created API subscriptions are queued for initial screening. Creation does not wait for a final result.
- Recheck after imports. The daily import pipeline queues subscription screening after source import attempts complete.
- Review and follow up. Inspect candidate details, screening status, timestamps, and configured notification deliveries.
Administrators can trigger the full import pipeline or run subscription screening separately. A screening-only run uses the sanctions data already stored; it does not refresh source feeds.
Which sanctions sources are supported?
Supported sanctions source formats include the European Union, United Kingdom, United States OFAC SDN and non-SDN lists, Canada, Ukraine NSDC, and United Nations. Actual coverage depends on which sources are configured and successfully imported. Ukraine NSDC individuals use an administrator-provided XLSX upload rather than a default automated feed. See the sources and freshness reference.
Daily imports are scheduled, not live feeds
The default full import schedule is 00:00 UTC daily and is configurable. A failed source import can leave older stored records available for screening. Check import outcomes and screening timestamps when assessing freshness; a successful screening does not mean every feed refreshed successfully.
Sanctions regimes differ in scope and legal effect. For official source context, consult the EU Sanctions Map, UK sanctions guidance, OFAC Sanctions List Service, Canadian sanctions guidance, Ukraine NSDC sanctions resources, and UN Security Council Consolidated List. These links are references, not claims of endorsement or a guarantee of complete coverage.
How does name matching work?
Subscription screening uses normalized names and aliases, name-part matching, and bounded approximate spelling comparisons. It preserves Unicode letters and digits, normalizes case, and treats punctuation and whitespace as separators.
All supplied name parts can match distinct stored parts in a different order, with additional stored parts allowed. This helps when a source includes a patronymic or middle name that the subscribed name omits.
Minor spelling variations can also produce candidates: eligible name parts must contain 5–64 characters, begin with the same character, and differ by at most one insertion, deletion, substitution, or adjacent transposition. Approximate matching requires at least two supplied name parts and a similarity score of at least 0.85 after the extra-part penalty. Single-part names match exactly.
These rules do not automatically transliterate between scripts. Source-provided transliterated aliases can match. Country and registration numbers provide review context; they do not currently filter name-match candidates.
A similarity score is not an identity probability
A name match identifies a candidate to investigate. It does not establish that your customer is the listed person. The dashboard name search and subscription screening are separate workflows; dropdown suggestions are not a complete screening result.
How do API subscriptions and webhooks fit together?
An organization member can create integration keys and configure a webhook on the API integrations page. Keep the integration key in your backend, then call POST /api/v1/subscriptions with X-Api-Key and an Idempotency-Key. The request body requires a name and can include aliases, supporting identifiers, and your external reference.
The creation response starts with a pending screening status. Retrieve the subscription to inspect its current results, or receive the initial screening outcome and later changes through its configured webhook. An external reference links the subscription to your records; an idempotency key makes retries of the same creation request safe.
Webhook calls include an HMAC-SHA256 signature in X-Webhook-Secret. Compute it from the exact request body using your signing secret and compare signatures in constant time before accepting the event. Use HTTPS and deduplicate event IDs. See the developer guide for an example. The API integrations page provides delivery history and request/response information so you can investigate failures and retry eligible deliveries.
Screening and delivery are separate: a failed webhook call does not by itself mean screening failed. Notification timing depends on background processing and destination availability. Email notifications are also supported through configured channels.
What should your team review?
- Candidate identity: compare names, aliases, countries, identifiers, and source references before deciding whether records concern the same person.
- Data freshness: inspect the screening timestamp and relevant source import outcomes.
- Result status: pending and failed screening states need follow-up; retained results after a failure may be stale.
- Delivery status: confirm that your receiving system accepted notifications, and investigate failed attempts.
“No identified match” describes the stored data and matching rules used for that run. It is not proof of clearance, complete regulatory coverage, or the absence of risk. Your review process should reflect the jurisdictions and obligations that apply to your organization.
Common questions
Can I monitor a name that is not found today?
Yes. Create a subscription for the name. Future screening runs can identify candidates after the stored sanctions data changes.
Are results returned immediately when I create an API subscription?
The API creates the subscription first and queues background screening. The initial response is pending; retrieve its status or wait for a configured webhook to receive the outcome.
Does screening run if a source import fails?
Completed source import attempts trigger screening against the data currently stored, even if some feeds failed. Interrupted imports can skip screening. Review both import and screening statuses.
Can name matching replace an identity review?
No. Matching produces candidates and similarity information. A reviewer should consider identifiers, source information, and the applicable sanctions rules.