Sanctions and PEP screening is the compliance control most likely to overwhelm your team and least likely to catch a genuine bad actor on any given day. Industry systems routinely generate 90–99% false positives, and every one of those alerts consumes 30 to 60 minutes of a qualified analyst's time before it is cleared as an irrelevant homonym. As transaction and onboarding volumes grow, the alert flood grows with them — linearly, mechanically, and without adding a single unit of real risk detection.
This is not a staffing problem you can hire your way out of. It is a precision problem. The question for a Head of KYC in 2026 is no longer "how many analysts do I need to clear the queue?" but "how do I make the queue smaller and more accurate without missing a true match?"
This article is a practical guide for Heads of KYC, sanctions and screening leads at banks, External Asset Managers (EAM), and fintechs. It quantifies the false-positive problem, explains precisely why traditional screening over-alerts, and shows how AI contextual scoring brings the rate down to 20–25% while keeping every decision explainable and defensible under the emerging effectiveness regime.
1. The false-positive problem, quantified
The rate that defines the workload
A screening engine tuned for regulatory safety errs on the side of alerting. That is by design — a missed true match is a regulatory and reputational catastrophe, while a false positive is merely expensive. The result is a systematic bias toward over-alerting, and the numbers are stark: across the industry, 90% to 99% of screening alerts are false positives. In practice, an analyst can review dozens of alerts before encountering one that requires genuine escalation.
The cost per alert
Each false positive is not free. Clearing one requires an analyst to open the alert, compare the flagged name against the sanctioned or PEP record, search for corroborating or disconfirming identifiers, document the rationale, and close the case. Realistically this takes 30 to 60 minutes per alert once secondary research is included. At a loaded cost of CHF 80,000–110,000 per year for a Swiss KYC analyst, the arithmetic is unforgiving.
The scaling trap
The structural problem is that alert volume scales with business volume, not with risk. Double your onboarding throughput or your payment volume, and you roughly double your alerts — but you do not double the number of genuine sanctioned parties in your book. Growth therefore imports a proportional, permanent increase in low-value work.
| Portfolio profile | Monthly alerts | False positives (95%) | Analyst hours/month | Loaded cost/year (CHF) |
|---|---|---|---|---|
| Small EAM | 400 | 380 | ~285 | ~200,000 |
| Mid-size bank | 2,000 | 1,900 | ~1,425 | ~1,000,000 |
| Fintech at scale | 8,000 | 7,600 | ~5,700 | ~4,000,000 |
The figures assume 45 minutes per false positive and a CHF 95,000 loaded analyst cost. They illustrate the core point: at scale, the majority of a screening budget is spent confirming that people are not who the list says they might be.
2. Why traditional screening over-alerts
Legacy screening relies on fuzzy string matching: it compares the name of your client against list entries and flags anything above a similarity threshold. This approach is decades old, easy to audit, and structurally prone to noise. Four causes dominate.
Name transliteration and spelling variance
Sanctions lists aggregate names transliterated from Arabic, Cyrillic, Chinese, and other scripts, each with multiple accepted romanisations. "Mohammed", "Muhammad", "Mohamed", and "Mohammad" are the same name; a fuzzy engine tuned to catch all of them will also catch a great deal of unrelated noise. Lower the threshold to avoid missing a variant, and the alert count explodes.
Common names
A common name is a false-positive engine in its own right. A client named "Li Wei", "Maria Garcia", or "Mohammed Al-Hassan" can match dozens of list entries — nearly all unrelated homonyms. String similarity cannot distinguish a common name shared by millions from a genuine hit, because on the name field alone they are indistinguishable.
Weak use of secondary identifiers
The information that actually resolves a match — date of birth, place of birth, nationality, passport or registration number, known associates — is either absent from the client record, absent from the list entry, or simply not weighed by the matching logic. Traditional engines treat the name as the primary signal and secondary identifiers as an afterthought, so they alert on name alone and leave corroboration to the human.
No context
A string matcher has no understanding of who the client is, what they do, where they operate, or whether the match is even plausible. It cannot reason that a 25-year-old Swiss retail client is unlikely to be a 70-year-old sanctioned foreign official who happens to share a surname. Every disambiguation that a human performs instinctively must be redone, manually, alert by alert.
3. How AI changes screening
AI does not replace sanctions and PEP screening — it makes the matching layer intelligent, so that the alerts reaching a human are the ones that actually merit judgement. Six capabilities matter.
Contextual matching
Instead of scoring name similarity in isolation, AI evaluates the match in context: the client's profile, jurisdiction, age, activity, and the plausibility of the association. A name match that is contextually implausible is scored down rather than escalated, dramatically reducing noise from common names and transliteration variants.
Entity resolution
AI resolves whether two records refer to the same real-world entity rather than merely sharing characters. It reconciles aliases, name orderings, transliterations, and partial records into a single resolved entity, then compares entities — not strings. This collapses the dozens of spurious matches a common name generates into one correctly resolved (usually negative) determination.
Secondary-identifier corroboration
The model actively uses date of birth, place of birth, nationality, and identifiers to confirm or exclude a match. A shared surname with a divergent date of birth and nationality is a near-automatic exclusion; a shared name and date of birth and nationality is a strong true-positive signal that is prioritised for immediate review.
Adverse-media NLP
For PEP and reputational screening, natural-language processing reads adverse-media results and classifies them by relevance, recency, severity, and whether the article actually concerns your client versus a namesake. This filters out the historical, the trivial, and the misattributed, so analysts see genuinely material findings rather than a wall of headlines.
Risk-based scoring
Every alert receives a calibrated probability of being a true match, not a binary flag. This turns an undifferentiated queue into a ranked one, where the small number of high-probability alerts are unmistakable and the large tail of near-zero-probability homonyms can be handled with proportionate effort.
Intelligent triage by criticality
Scored alerts are routed by criticality: the highest-probability, highest-impact matches go straight to senior analysts; clear-cut low-risk homonyms are auto-dispositioned or batched for lightweight review. Human attention is concentrated on the 5–15% of alerts that genuinely require it.