You run a screening check on a new client, and the result comes back with a match against a politically exposed persons list, or a sanctions list. For a lot of firms new to AML/CTF, that is the moment the whole thing feels real, and a little alarming. The instinct is either to panic or to refuse the client outright.
Both instincts are usually wrong. A match is not a verdict. It is a prompt to do something, and what you do depends entirely on which kind of match it is and whether it is even the right person. Here is how to work through it calmly.
First: is it actually your client?
Most matches are false positives, and the reason is simple. Screening compares a name (and sometimes a date of birth) against very large global lists, and names are not unique. A "John Smith" or a common name shared across cultures will surface hits that have nothing to do with the person in front of you.
So the first step is never to act on the match, it is to confirm it. Compare the details you hold, full name, date of birth, nationality, against the matched record. If the date of birth is different, the nationality does not fit, or the identifiers plainly do not line up, you are looking at a false positive. You record that you reviewed it, why you concluded it was not a match, and you move on. That record is part of your evidence that your screening works.
Do not simply dismiss a match without looking. And do not refuse a client just because a common name pinged a list. Both the knee-jerk "reject" and the lazy "ignore" are failures of due diligence.
If it is a genuine PEP match
A politically exposed person is someone who holds, or has held, a prominent public position, along with their close family and associates. Think senior government officials, judges, senior military, heads of state enterprises.
The key thing to understand: being a PEP is not illegal, and a PEP match is not an accusation. It is a risk classification. Plenty of entirely legitimate clients are PEPs. What a confirmed PEP match means is that this client sits in a higher-risk category, so you apply enhanced due diligence rather than turning them away:
- Take reasonable steps to establish the source of their funds and wealth.
- Get senior sign-off to take on or continue the relationship.
- Apply closer ongoing monitoring than you would for a low-risk client.
- Document all of it, so your file shows you identified the risk and managed it.
A PEP you have assessed, documented and are monitoring is a client you can serve. A PEP you did not notice is the problem.
If it is a genuine sanctions match
A sanctions match is a different animal, and the difference matters a great deal. Sanctions are legally binding. Dealing with a sanctioned person or entity is not a "higher risk to manage", it is potentially a criminal offence, with penalties including fines and asset freezes.
So the handling is not "enhanced due diligence and proceed". If, after confirming identity, you have a true sanctions match, you do not provide the designated service, and you take advice on your obligations, which can include freezing assets and reporting. This is the one category where a confirmed match stops the transaction rather than shaping it. Given the stakes, a genuine sanctions match is a point to get proper guidance rather than work through alone.
When a match becomes a report
Screening does not just protect you at onboarding. If, at any point, a match or the surrounding circumstances give you reasonable grounds to suspect that a person is not who they claim to be, or that a matter relates to proceeds of crime or a criminal offence, that suspicion triggers a suspicious matter report (SMR) to AUSTRAC.
Two things to hold onto here. First, the trigger is suspicion on reasonable grounds, not certainty, so you do not need to have proven anything to have an obligation to report. Second, tipping-off applies: you must not tell the client, or anyone else, that you have formed a suspicion or lodged an SMR. Handle the report quietly and keep serving the client normally where you can, so as not to alert them.
The distinction that keeps you calm
The whole thing gets simpler once you hold three responses apart:
- Unclear match: review and verify the identity. Most resolve as false positives. Record the outcome.
- Confirmed PEP: not a rejection. Enhanced due diligence, source of funds, senior approval, closer monitoring, all documented.
- Confirmed sanctions: stop. Do not provide the service. Take advice. This one is a legal line, not a risk to manage.
And running underneath all three: if reasonable grounds for suspicion arise, an SMR to AUSTRAC, filed quietly, without tipping off.
Making it a process
A screening hit should not send you scrambling to remember the rules. The safe version is a defined path: screen, confirm identity against the match, classify it as false positive, PEP or sanctions, apply the right response, and record what you did and why at each step. Written down and applied the same way every time, so that a match is a routine step in your workflow rather than a crisis.
AML Mate screens your clients against the DFAT sanctions list and PEP and sanctions data, surfaces potential matches with the detail you need to assess them rather than a bare yes or no, and gives you suspicious matter report drafting for the cases where a match turns into a reportable suspicion. The judgment stays yours, which is where it has to sit, but the check, the surfacing and the paperwork do not have to be manual.