Report D-18 examines false positives in automated sanctions and AML screening in the European Union and the United Kingdom. A false positive occurs when a person, company or transaction is flagged as potentially matching a risk criterion, but subsequent review does not confirm the relevant connection. A common example is a customer whose name resembles that of a sanctioned person. However, the problem extends beyond name matching: outdated sanctions information, confusion between jurisdictions, incorrect interpretation of payment context and restrictions that remain after a match has been disproved can all produce erroneous outcomes.

The report’s central distinction is between an initial alert, an established fact and a legal consequence. An automated match should initiate verification rather than automatically determine the final legal outcome. Effective identification may require dates of birth, identity documents, nationality, addresses, corporate registration information and other identifiers. At the same time, reducing screening sensitivity too aggressively creates the opposite risk: genuine sanctions matches may be missed. The Bank of Scotland enforcement case illustrates this problem, with OFSI imposing a £160,000 penalty following breaches involving weaknesses in screening and subsequent review. GOV.UK

The study also examines commercial screening databases and the allocation of responsibility between information providers and financial institutions. An error may originate in the underlying profile, the matching process or the bank’s interpretation of a technically correct result. Correcting one database therefore does not necessarily remove every downstream restriction. Under EU data-protection rules, rectification, restriction of processing and notification of recipients may all become relevant, but accurate personal data and entitlement to a particular financial service remain separate legal questions.

Automated decision-making creates an additional issue: meaningful human review and explainability. In Dun & Bradstreet Austria, the Court of Justice of the EU held that information concerning an automated decision must enable the individual to understand and challenge how the decision affecting them was reached. curia

The report concludes that screening quality cannot be measured simply by reducing the number of alerts. A robust system must distinguish genuine restrictions from erroneous matches, keep legal status and underlying data current, document how alerts are resolved and provide mechanisms for correcting both the information and the consequences of an error.