Sanctions Screening Best Practices for AIFMs

Why AIFMs Are Under Scrutiny

Sanctions enforcement has shifted from banking to the broader financial sector. Since 2022, EU regulators have explicitly extended enhanced scrutiny to alternative investment fund managers. The European Banking Authority's 2023 peer review of AML/CFT supervision flagged several NCAs for weak oversight of AIFM sanctions controls — and NCAs took note.

For AIFMs, the exposure points are different from a retail bank. You are not processing thousands of daily transactions. Instead, your risk concentrates at three moments: investor onboarding, capital calls, and secondary transfers. A limited partner subscribing with a €50 million ticket who was added to the SDN List last week is exactly the scenario your process must catch.

The legal basis is layered. EU Regulation 2580/2001 (anti-terrorism financing), EU Regulation 269/2014 (Russia/Ukraine measures), and dozens of asset-freeze regulations require AIFMs to freeze funds and report without delay. Non-compliance is a strict-liability criminal offence in most EU member states — no intent required.

The Four Lists You Must Screen Against

There is no single global sanctions list. Effective screening requires checking all of the following, because coverage overlaps are smaller than most compliance teams assume:

When to Screen — The Three Mandatory Moments

Most AIFMs screen at onboarding and then forget about it. That is the single most common finding in NCA inspections. Sanctions exposure is not static: a clean investor today may be designated tomorrow.

The ongoing re-screening requirement surprises many fund managers. If you have 200 LPs and lists update daily, that is 200 checks every day — 73,000 checks per year. This is not a manual process. It requires automated batch screening with exception-based review.

Beneficial Ownership: The Gap Most Funds Miss

Screening the named LP entity is not enough. The beneficial owner — the natural person who ultimately owns or controls the LP — must also be screened. EU AML Directive 5 sets a 25% ownership threshold as the standard; for higher-risk scenarios, most compliance frameworks recommend screening at 10%.

The practical challenge: beneficial ownership chains can be deep. A Delaware LLC owned by a BVI holding company owned by a trust with a discretionary beneficiary — unravelling that structure to identify the natural persons behind it is exactly the work that eats compliance team capacity. FATF's guidance on beneficial ownership transparency (updated 2023) makes clear that "we could not identify the UBO" is not a defence.

Best practice: collect UBO declarations at subscription, require updates on material ownership changes, and store structured data (not just PDF scans) so your screening system can match against it programmatically.

False Positives: The Hidden Cost of Bad Matching

A common misconception: the more alerts your screening system generates, the more thorough it is. In reality, a false positive rate above 30% is a red flag — it signals misconfigured fuzzy matching that creates analyst fatigue, not genuine risk coverage.

Common sources of false positives:

• Name transliteration variance: "Mohammed Al-Rashid" vs "Muhammad Al-Rasheed" — same person, 12 spelling variants in circulation. Good screening engines use phonetic matching (Soundex, Metaphone) and name normalisation, not raw string comparison.
• Common name collisions: "Wang Wei" is among the most common names in China. Matching on name alone without date of birth or nationality context will produce dozens of false hits per query.
• Threshold misconfiguration: A 70% fuzzy match threshold on a 4-character name will catch legitimate hits but also flood your queue. Calibrate thresholds per name length and jurisdiction.
• Stale data: Screening a delisted entity that was removed from the sanctions list six months ago because your local copy has not updated. Always use live or daily-refreshed lists.

Document your matching configuration. If an NCA inspector asks why a potential hit was cleared, "our analyst decided" is not sufficient. You need a defensible, documented rationale: name match score, discriminating attributes checked (DOB, nationality, address), and the clearing decision maker.

PEP Screening Is Not the Same as Sanctions Screening

Politically Exposed Persons (PEPs) are frequently conflated with sanctioned parties, but they are distinct categories with different obligations.

Many AIFMs run both checks simultaneously, which is efficient. But ensure your workflow routes them differently: a sanctions hit must trigger an immediate freeze process; a PEP match triggers an EDD workflow that can take days. Mixing them leads to both over-reaction (delaying non-sanctions PEP relationships) and under-reaction (treating sanctions hits as routine EDD cases).

For a complete glossary of AML/CFT terms — including PEP categories, UBO definitions, and EDD thresholds — see the Caelith Compliance Glossary.

Automating Sanctions Screening: What to Look For

Manual screening is not defensible at scale. For any AIFM with more than 50 investors, an automated screening platform is a practical necessity. Key capabilities to evaluate:

When evaluating vendors, ask for their list update frequency SLA, their false positive benchmarks on AIFM-type name data, and whether their matching engine handles non-Latin scripts (Cyrillic, Arabic, Chinese). Many EU-focused platforms still fail on non-Latin names.

What Regulators Check in an Inspection

Based on published NCA inspection findings and ESMA peer review reports, the most common sanctions-related deficiencies found in AIFM inspections are:

• No ongoing monitoring — screening only at onboarding
• Beneficial ownership not screened or only screened at entity level
• Outdated local list copies (not updated daily)
• No documented clearing rationale for dismissed alerts
• OFAC screening absent despite USD transactions or US investors
• PEP and sanctions workflows merged, leading to procedural confusion
• No testing or validation that the screening system is actually working

The last point is underappreciated. How do you know your screening system would catch a real hit? Run a controlled test: add a known-sanctioned entity (one that has been publicly delisted, for a clean test) and verify the system flags it. Document the test. Regulators increasingly ask for evidence of system testing, not just the system itself.

For a broader look at how NCAs approach compliance inspections, compare approaches in our BaFin vs CSSF guide or check filing requirements for your specific jurisdiction on the NCA Profiles page.