A trading platform must prevent sanctioned parties and prohibited jurisdictions from using the service. Geo-IP blocking is in place at the edge, and compliance reports that sanctioned individuals are still being onboarded. Where should the primary enforcement point be?
Show the full answer Hide the answer
The deciding property
Sanctions apply to parties, not to network locations. A sanctioned individual in a permitted country is prohibited; a permitted individual travelling through a restricted one is generally not. Geo-IP answers a question about the network path, and the obligation is about who the customer is, so the control and the requirement are not measuring the same thing.
The second deciding fact is in the symptom. Sanctioned individuals are being onboarded, which means they passed the point where identity was verified. That is the enforcement point that exists, is already collecting the right attribute, and is not being used for this.
The third is that lists change. Designations are added and removed continuously, so a control applied only at signup goes stale the moment a list is updated — which is why re-screening the existing base on every list change, not just screening new customers, is part of the answer rather than an enhancement to it.
What the design has to include
- Screening against the verified identity, with name matching that handles transliteration, aliases and dates of birth, tuned for a false-positive rate a review team can actually work.
- Re-screening on list update, as a batch over the whole customer base, with the run and its results retained as evidence.
- A hold state, not a hard reject, because name matching produces false positives at rates that make automatic rejection unacceptable and because a human decision must be recorded.
- Screening of counterparties too, not just customers: payees, beneficial owners and correspondent institutions, which is the gap audits most often find.
- Evidence retention. The obligation is to demonstrate the control operated, so screening results, list versions and dispositions are retained records, not logs to be rotated away, typically for 5 years or more depending on the regime.
The cost is worth stating plainly, because it is where these programmes fail: fuzzy name matching against sanctions lists generates false positives at rates that commonly run to a few percent of screened parties, and every one is a human review. Tuning the matching threshold trades false positives against missed designations, and the tuning decision — not the technology — is what an examiner will ask about. Lists have been updated on a near-weekly basis throughout the 2020s, so the re-screening run is continuous work rather than an annual batch.
Why the other options fail
- Stronger geo-IP with VPN detection. An arms race against the wrong target. It produces both errors at once: legitimate customers blocked while travelling, and sanctioned parties admitted through any residential connection. It is a useful supplementary signal and a poor primary control.
- Blocking at the settlement layer. Necessary and too late. The prohibition is on providing the service, not only on moving the money, and by settlement the relationship already exists — along with whatever information has been shared.
- A self-declaration of residence. Collects an attribute from the person with the strongest incentive to misstate it, and in an audit the log of the declaration is evidence that the question was asked, not that the control worked.
What would flip the decision
| If this changes | Choose | Because |
|---|---|---|
| The service is anonymous with no identity verification | Edge and payment-layer controls | With no verified party there is nothing to screen against, and the design question becomes whether the product can exist in these markets at all |
| The restriction is about content licensing rather than sanctions | Geo-IP as the primary control | Licensing obligations genuinely are about location, and best-effort geography is the accepted standard |
| Customers are institutions rather than individuals | Screening extends to beneficial ownership | The obligation looks through the entity, so the screened party is not the one who signed up |
When this is the wrong answer
For a low-risk consumer service with no financial relationship, full screening machinery is disproportionate, and the proportionate control is exactly what the regime expects: geography at the edge plus payment-layer checks. The threshold is whether you hold a verified identity and a financial relationship. Once both exist, screening against the identity is the control that matches the obligation, and everything else is supplementary.