Sanctions Screening Evidence: Reviewable Decision Records

Why evidence matters

Regulators and auditors do not ask "Did you screen?" They ask what was checked, which list version was active, and why you cleared this entity. When its evidence state reports available, a Verifex Evidence Capsule can preserve the recorded decision context as structured data rather than memory.

In OFAC enforcement actions, the ability to produce documented evidence of screening has been a key part of an internal control record. Whether and how a regulator evaluates a record depends on the applicable legal framework and facts. The Evidence Capsule is designed to provide exactly this documentation.

What regulators ask for during audits

Based on published examination manuals from OFAC, FinCEN, and the EBA, auditors typically request:

• A complete list of screening policies and procedures, including risk thresholds and escalation paths
• Timestamped records of every screening query, including the name screened, lists checked, and results returned
• Documentation of which sanctions list versions were active at the time of each screening
• Records of reviewer decisions (clear, review, escalate) with reviewer identity, timestamp, and rationale
• Evidence of periodic re-screening, including schedule, scope, and results
• Training records showing that compliance staff understand screening policies and procedures

Why list versions matter

Sanctions lists change daily. A name that was not on a list yesterday may be added today. If a regulator asks why you cleared an entity on a given date, you need to prove that the entity was not on any relevant list as of that date. Without version tracking, you cannot prove a negative.

The Evidence Capsule captures the exact list versions checked at screening time. If OFAC published an update at 2:00 PM and you screened at 1:30 PM, the capsule records that the screening used the pre-update version. This is critical for audit defense.

Evidence checklist

• Store request_id from every screening response in your case management system
• Capture evidence_capsule_id and evidence_capsule_url only when evidence_persistence reports available
• Record the deciding engine, policy context, and screening contract supplied by the response
• Record sources checked, plan exclusions, unavailable sources, and coverage status
• Record list versions checked at the time of screening, since they change over time
• Preserve the full match rationale including confidence score, match type, and source severity
• Document reviewer action (clear, review, escalate) with timestamp and user ID
• Export Evidence Capsules quarterly for external audit review
• Confirm the current retention policy and any contractual recordkeeping terms before relying on a retention period

Building your audit trail

An audit trail is more than a log file. It is a reviewable record of each screening decision your business keeps. A robust audit trail includes a query record (the exact name, type, and optional data submitted), a response record (all matches found, confidence scores, match types, and source lists), a decision record (the action taken, who made it, when, and why), a list-version record, and the matching-engine version that produced the results.

When evidence_persistence reports available, the Verifex Evidence Capsule records this context in a structured JSON document. A pending or unavailable evidence state is not a retrievable durable record.

Compliance caveat: Evidence Capsules are decision-support records. They preserve screening context to support audit review but do not guarantee regulatory outcomes, certify counterparties, or replace a regulated business's risk-based compliance program.

Frequently asked questions