Sanctions and PEP screening is the compliance control most likely to overwhelm your team and least likely to catch a genuine bad actor on any given day. Industry systems routinely generate 90–99% false positives, and every one of those alerts consumes 30 to 60 minutes of a qualified analyst's time before it is cleared as an irrelevant homonym. As transaction and onboarding volumes grow, the alert flood grows with them — linearly, mechanically, and without adding a single unit of real risk detection.
This is not a staffing problem you can hire your way out of. It is a precision problem. The question for a Head of KYC in 2026 is no longer "how many analysts do I need to clear the queue?" but "how do I make the queue smaller and more accurate without missing a true match?"
This article is a practical guide for Heads of KYC, sanctions and screening leads at banks, External Asset Managers (EAM), and fintechs. It quantifies the false-positive problem, explains precisely why traditional screening over-alerts, and shows how AI contextual scoring brings the rate down to 20–25% while keeping every decision explainable and defensible under the emerging effectiveness regime.
1. The false-positive problem, quantified
The rate that defines the workload
A screening engine tuned for regulatory safety errs on the side of alerting. That is by design — a missed true match is a regulatory and reputational catastrophe, while a false positive is merely expensive. The result is a systematic bias toward over-alerting, and the numbers are stark: across the industry, 90% to 99% of screening alerts are false positives. In practice, an analyst can review dozens of alerts before encountering one that requires genuine escalation.
The cost per alert
Each false positive is not free. Clearing one requires an analyst to open the alert, compare the flagged name against the sanctioned or PEP record, search for corroborating or disconfirming identifiers, document the rationale, and close the case. Realistically this takes 30 to 60 minutes per alert once secondary research is included. At a loaded cost of CHF 80,000–110,000 per year for a Swiss KYC analyst, the arithmetic is unforgiving.
The scaling trap
The structural problem is that alert volume scales with business volume, not with risk. Double your onboarding throughput or your payment volume, and you roughly double your alerts — but you do not double the number of genuine sanctioned parties in your book. Growth therefore imports a proportional, permanent increase in low-value work.
| Portfolio profile | Monthly alerts | False positives (95%) | Analyst hours/month | Loaded cost/year (CHF) |
|---|---|---|---|---|
| Small EAM | 400 | 380 | ~285 | ~200,000 |
| Mid-size bank | 2,000 | 1,900 | ~1,425 | ~1,000,000 |
| Fintech at scale | 8,000 | 7,600 | ~5,700 | ~4,000,000 |
The figures assume 45 minutes per false positive and a CHF 95,000 loaded analyst cost. They illustrate the core point: at scale, the majority of a screening budget is spent confirming that people are not who the list says they might be.
2. Why traditional screening over-alerts
Legacy screening relies on fuzzy string matching: it compares the name of your client against list entries and flags anything above a similarity threshold. This approach is decades old, easy to audit, and structurally prone to noise. Four causes dominate.
Name transliteration and spelling variance
Sanctions lists aggregate names transliterated from Arabic, Cyrillic, Chinese, and other scripts, each with multiple accepted romanisations. "Mohammed", "Muhammad", "Mohamed", and "Mohammad" are the same name; a fuzzy engine tuned to catch all of them will also catch a great deal of unrelated noise. Lower the threshold to avoid missing a variant, and the alert count explodes.
Common names
A common name is a false-positive engine in its own right. A client named "Li Wei", "Maria Garcia", or "Mohammed Al-Hassan" can match dozens of list entries — nearly all unrelated homonyms. String similarity cannot distinguish a common name shared by millions from a genuine hit, because on the name field alone they are indistinguishable.
Weak use of secondary identifiers
The information that actually resolves a match — date of birth, place of birth, nationality, passport or registration number, known associates — is either absent from the client record, absent from the list entry, or simply not weighed by the matching logic. Traditional engines treat the name as the primary signal and secondary identifiers as an afterthought, so they alert on name alone and leave corroboration to the human.
No context
A string matcher has no understanding of who the client is, what they do, where they operate, or whether the match is even plausible. It cannot reason that a 25-year-old Swiss retail client is unlikely to be a 70-year-old sanctioned foreign official who happens to share a surname. Every disambiguation that a human performs instinctively must be redone, manually, alert by alert.
3. How AI changes screening
AI does not replace sanctions and PEP screening — it makes the matching layer intelligent, so that the alerts reaching a human are the ones that actually merit judgement. Six capabilities matter.
Contextual matching
Instead of scoring name similarity in isolation, AI evaluates the match in context: the client's profile, jurisdiction, age, activity, and the plausibility of the association. A name match that is contextually implausible is scored down rather than escalated, dramatically reducing noise from common names and transliteration variants.
Entity resolution
AI resolves whether two records refer to the same real-world entity rather than merely sharing characters. It reconciles aliases, name orderings, transliterations, and partial records into a single resolved entity, then compares entities — not strings. This collapses the dozens of spurious matches a common name generates into one correctly resolved (usually negative) determination.
Secondary-identifier corroboration
The model actively uses date of birth, place of birth, nationality, and identifiers to confirm or exclude a match. A shared surname with a divergent date of birth and nationality is a near-automatic exclusion; a shared name and date of birth and nationality is a strong true-positive signal that is prioritised for immediate review.
Adverse-media NLP
For PEP and reputational screening, natural-language processing reads adverse-media results and classifies them by relevance, recency, severity, and whether the article actually concerns your client versus a namesake. This filters out the historical, the trivial, and the misattributed, so analysts see genuinely material findings rather than a wall of headlines.
Risk-based scoring
Every alert receives a calibrated probability of being a true match, not a binary flag. This turns an undifferentiated queue into a ranked one, where the small number of high-probability alerts are unmistakable and the large tail of near-zero-probability homonyms can be handled with proportionate effort.
Intelligent triage by criticality
Scored alerts are routed by criticality: the highest-probability, highest-impact matches go straight to senior analysts; clear-cut low-risk homonyms are auto-dispositioned or batched for lightweight review. Human attention is concentrated on the 5–15% of alerts that genuinely require it.
4. Before and after: the numbers
The combined effect of these capabilities is a step-change in precision. The false-positive rate falls from the industry's 90–99% to roughly 20–25% — a reduction of about 75 percentage points — with a corresponding collapse in analyst hours spent on noise.
| Metric | Manual / legacy screening | AI-assisted (Wecan) | Improvement |
|---|---|---|---|
| False-positive rate | 90–99% | 20–25% | ≈ −75 pts |
| Time per alert reviewed | 30–60 minutes | 5–10 minutes | −80% |
| Alerts requiring human review | 100% of hits | 5–15% of hits | −85 to −95% |
| Analyst hours/month (2,000 alerts) | ~1,425 hours | ~180–280 hours | −80 to −87% |
| Adverse-media items surfaced per name | 20–50 raw | 2–5 material | −85 to −90% |
| True matches missed (false negatives) | Baseline | No increase (target) | Maintained or improved |
The final row is the one that governs everything else: precision gains are only acceptable if detection of genuine matches is preserved or improved. A false-positive reduction achieved by simply raising thresholds would be a compliance failure, not a win. The entire value of AI here rests on cutting noise without cutting sensitivity.
5. Governance and auditability
The precision story only counts if it is defensible. The 2026 regulatory direction — visible across the revised AMLO-FINMA framework, the incoming Legal Entities Transparency Act (LETA) and revised AMLA in Switzerland, and the EU AML package with its new central authority — is a decisive shift from presence of controls to demonstrable effectiveness of controls. Regulators increasingly ask not "do you screen?" but "can you show that your screening produces timely, traceable, evidence-based decisions?"
Explainability is non-negotiable
Every AI-influenced disposition must carry a human-readable rationale: which identifiers matched, which diverged, what contextual factors lowered or raised the score, and what evidence supported the conclusion. A score without an explanation is not auditable, and an unauditable control is a liability regardless of how accurate it is.
AI augments, it does not replace, the analyst
The model proposes; the analyst disposes. Every true-match escalation and every consequential clearance remains a documented human decision, with the AI serving as a corroboration and prioritisation layer. This preserves accountability, satisfies the four-eyes expectations of Swiss and EU supervisors, and keeps the institution in control of its risk appetite.
A defensible audit trail
Each decision should be logged with its inputs, the model's score and reasons, the analyst's action, and a timestamp — a complete, reconstructable record. Under an effectiveness regime, the audit trail is not paperwork; it is the evidence that your control works.
6. Implementation: getting precision right
Tune thresholds deliberately
Scoring thresholds define the boundary between auto-disposition, lightweight review, and escalation. Set them with data, not intuition, and calibrate against a labelled sample of historical alerts so you can measure the precision-recall trade-off explicitly before going live.
Build feedback loops
Every analyst decision is training signal. When a homonym is cleared for the fiftieth time, the system should learn to score it down; when a genuine match is escalated, the pattern should reinforce sensitivity. A screening model without a feedback loop stagnates; one with a disciplined loop compounds in accuracy over time.
Guard against under-alerting
The cardinal risk of tuning for fewer false positives is creating false negatives — missing a genuine match. This is far more dangerous than an over-full queue. Three safeguards are essential: never auto-clear high-impact categories (direct sanctions hits, high-risk jurisdictions) without human review; monitor recall continuously against known-positive test cases; and run periodic back-testing to confirm that suppressed alerts were genuinely irrelevant.
| Control lever | Purpose | Failure if neglected |
|---|---|---|
| Threshold calibration | Balance precision and recall | Over-alerting or missed matches |
| Feedback loop | Improve accuracy over time | Model stagnation, repeated noise |
| False-negative monitoring | Preserve detection | Undetected true matches |
| Explainability logging | Regulatory defensibility | Unauditable, indefensible control |
| Human-in-the-loop escalation | Accountability | Ungoverned automated decisions |
Precision and safety are not in tension when the control is engineered correctly — they are achieved by the same disciplined design.
7. How Wecan approaches screening and triage
Wecan Comply treats screening as a precision problem, not a volume problem. Its screening and triage layer applies contextual matching and entity resolution to collapse spurious homonyms, corroborates every candidate match against secondary identifiers, and classifies adverse-media findings by materiality rather than surfacing raw headlines. Each alert receives a calibrated risk score, and intelligent triage routes only the genuinely material minority to human analysts — with the long tail of low-probability homonyms dispositioned efficiently.
Crucially, Wecan keeps the analyst in command. Every disposition carries an explanation and a full audit trail, so decisions are timely, traceable, and evidence-based — exactly the standard the 2026 effectiveness shift demands. Analyst feedback continuously sharpens the model, and safeguards on recall ensure that a lower false-positive rate never comes at the cost of a missed match. The result is a screening function that scales with your business without importing a proportional flood of noise — and that you can defend, line by line, to any regulator.