Employee screening: internal controls and periodic renewal

Employee screening involves checking active staff and job candidates against sanctions lists, politically exposed person (PEP) records, adverse media, and internal watchlists. For obliged parties, this check is not a one-time onboarding step: it is an ongoing control repeated as lists change.

Who performs employee screening?

In practice, three distinct drivers converge on the same individual: the organization's obligation to comply with sanctions regimes, internal fraud risk, and reputational risk. A single screening must address all three, as they all focus on the same person.

In obliged parties, appointments within the compliance unit are bound by written procedures and principles. Knowing the organization's own personnel and performing checks during role changes are integral parts of these procedures. In banking, electronic money, payment, and capital markets institutions, employee reliability is also subject to internal control and internal audit regulations.

Which lists are screened against?

Organizations can build their own lists through official source definitions, feed streams, or document uploads. Details are available on the custom screening lists page.

How is a match confirmed?

Name similarity alone is not a sufficient basis for a decision. Whether a match is genuine is tested against secondary information stored in the record.

The cost of a false positive is different for employees than for customers: it does not just delay a transaction, it directly impacts an individual's job and reputation. Therefore, in employee screening, a match is not a conclusion, but the beginning of an investigation.

How are lists kept up to date?

A screening is only as good as the freshness of the underlying data. Three methods work in tandem.

The official source itself is monitored. Some countries' PEP and sanctions data are not available in pre-packaged lists. In such cases, the source itself is defined: a parliamentary member list, a cabinet page, or a national sanctions announcement. The page is read at defined intervals, sub-links are crawled, and the resulting records enter screening along with their source link. The type of source also determines the classification: a record from a parliamentary list is flagged as a PEP, while a record from a sanctions announcement is flagged as sanctions.

Adverse media feeds are polled. Keywords, languages, and countries are defined; news feeds are regularly polled, and relevant publications are queued for review. Records are not created automatically: a human decides which news item is converted into a record.

Regulatory bulletins are parsed. A bulletin, decision text, or PDF list can be uploaded directly; the text is parsed, and the individuals and entities within it are converted into structured records. Capital markets bulletins are processed this way.

Every record is stored with its source link. When asked why a match exists, the answer traces back to the exact page the record originated from. The entire screening infrastructure is detailed on the sanctions, PEP, and adverse media screening page.

Screening is not a one-time event

As lists change, re-screening is performed, and any new match generates a new alert. A person who clears screening today might match a decision published three months later; what catches that decision is not the screening at the time of hiring, but continuous screening. The customer-side equivalent of this logic is detailed on the ongoing monitoring page.

Records, authorization, and privacy

Every screening is recorded: who was screened, when, against which list, and what the outcome was can be audited later. A match initiates a decision chain; the decision is recorded with its justification, and access is restricted by authorization. Who accessed employee data is stored in an immutable audit trail. The details of this mechanism are on the maker-checker, authorization, and audit trail page.

Employee data is personal data, and the relationship between the employee and the organization establishes a different legal basis for data processing than a customer relationship. This distinction is addressed on the KVKK and GDPR pages. With an on-premise deployment, all data remains within the organization's own infrastructure: for a matter like employee screening, where data resides is not a technical preference, but a legal requirement.

The decision remains with humans

The decision is linked to the case with its justification and evidence; information on who decided, with what authority, and when is written to the immutable audit trail. The entire case workflow is detailed on the alert and case management page.