Data serves as the backbone of information systems, providing essential support for compliance and risk management. Just as a strong backbone ensures stability, maintaining the integrity of data is crucial for effective operations. Data integration flow testing verifies the accuracy, completeness, and timeliness of the information exchanged between an organization’s core systems and its screening system.

The core systems typically generate or store data used to screen for sanctions risks, such as customer onboarding and relationship management systems (CRM), payment processing platforms, and other data sources containing information about the supply chain, intermediaries, counterparties, commercial and financial documents, and transactions. This information is utilized in the watchlist screening process to prevent violations. Data integration flow testing ensures that the data transfer process between the core and screening systems is clean, complete, and properly formatted. It also verifies that the screening system can accurately and efficiently process the data, which is crucial for effective sanctions compliance.

The information used for screening may include the following elements at onboarding, periodic reviews, and when processing customer transactions:

When conducting data integration flow testing, it is imperative to review fields that can be a source of friction given the free format nature of the information (e.g., free format names and addresses) or potential mismatches between data types (e.g., address information matching against names).

Understanding the type and nature of the fields flowing between the core and the watchlist screening systems is also crucial to determine what type of screening logic can be applied to these data elements:

• Fuzzy matching for all free format information
• Exact matching for structured identifiers (e.g., ISO country codes, BICs, LEIs)

This screening logic should equally focus on matching names of listed persons AND prohibited locations (e.g., countries or geographic regions subject to trade-based restrictions or embargoes). Similarly, data integration flow testing should be performed to verify the accuracy, completeness, and timeliness of the information flowing from the watchlists to the screening system. This testing should cover the following types of data:

Alert Processing Workflow

In case of one or several hits returned by the screening system, data integration flow testing should ensure that the information contained in the response message is fresh, complete, and unaltered. For each hit, the response may include the following information:

This information is essential to understand the nature of a hit to help operations distinguish a true match from a false match, and maintain an audit trail of all screening activities.

After receiving a response from the screening system (hit or no hit), ensure that the alert processing workflow is well integrated with the organization’s core systems and messaging queues. Testing that the workflow functions properly from end-to-end is crucial to guarantee seamless business operations.

Every step of the alert processing workflow should be thoroughly tested based on all possible business scenarios. Investigators can simulate both true and false alerts to verify that the workflow is functioning properly.

In the case of a false alert: investigators can deliberately input data that will trigger an alert, then verify that the alert is flagged and properly dismissed after further investigation. Additionally, investigators can input again the same data to test the whitelisting functions of the screening system. This test ensures that the system correctly identifies false positives and minimizes unnecessary alerts.

In the case of a true alert: investigators can input data that will trigger an alert, then follow the workflow to verify that the alert is properly escalated and investigated until a resolution is reached. This test ensures that the system correctly identifies true positives and that alerts are promptly and effectively addressed.

By performing both types of tests, investigators ensure that the alert processing workflow is working as expected and that the screening system is effectively identifying potential risks. Ultimately, based on their decisions, investigators can verify that the outcomes of the workflow are properly transferred to the organization’s core systems and that any pending message is moved to the right queue.

High-Level Screening Flow

The diagram below provides an overview of the flow of a screening request

Unlike effectiveness testing, which aims to reduce the risk of false negatives, efficiency testing focuses on minimizing the risk of false positives. This section provides guidelines for evaluating the efficiency of a screening system.

Data Preparation
To conduct efficient testing, it is necessary to use representative data that accurately reflects live screening environment The data used should be significant enough to end up with a representative hit rate, and the larger the data volume, the more accurate the hit rate will be. It is recommended to use data that is representative of production data on one or several typical days of operations or during a peak period. Additionally, the data should cover a broad range of scenarios and include potential false positive cases.

Hit Rate Estimation
The hit rate is the metric used to evaluate the system’s efficiency. A low hit rate is desirable as it means that fewer false positives are generated while maintaining an acceptable level of effectiveness. A high hit rate may generate too many false positives, leading to unnecessary work for analysts and delays in processing. The objective of efficiency testing is to evaluate whether the screening configuration can produce a low hit rate. To achieve this, it is necessary to estimate the hit rate using the representative data prepared in the first step. The hit rate estimation process should be rigorous and comprehensive as it forms the basis for evaluating the efficiency of the screening configuration.

Identifying Big Hitters
Once the hit rate has been estimated, the next step is to identify the significant variables, known as “big hitters,” that contribute the most to the hit rate. These big hitters can be identified using statistical techniques like correlation analysis. Identifying the big hitters makes it possible to determine which variables and screening rules significantly impact the hit rate and make targeted adjustments to the screening configuration.

Iterating through A/B Testing
To achieve the appropriate balance between efficiency and effectiveness, it is necessary to fine-tune the screening configuration through iterative A/B testing. In the context of testing the efficiency of sanctions screening systems, A/B testing involves making adjustments to the screening configuration and comparing the performance of the adjusted configuration to the original configuration. It is essential to review the system’s effectiveness and efficiency together following any changes to the screening configuration. The objective is to achieve a low hit rate while maintaining an acceptable level of effectiveness and minimizing the risk of false positives.

Optimizing Effectiveness and Efficiency
Size the hit rate according to the available resources for analyzing the alerts produced by the system. The hit rate should be set in a way that ensures the compliance team can manage and review the flagged cases within the given timeframe and with the available resources. To obtain the desired outcome, a flexible technology with a high level of configurability and control is fundamental. This means that the screening system should offer a wide range of granular options, rules, and algorithms that can be customized to the specific needs and risk appetite of the organization.

Technology should be complemented by human expertise to optimize the accuracy and effectiveness of the screening system. Technology partner assistance should be readily available to organizations, particularly when faced with complex screening implementations that require specialized skills to fully utilize the potential of the technology.

The primary focus of performance testing is to evaluate the system’s ability to perform under expected workload conditions. By conducting performance testing, we can ensure that the screening system can handle a high volume of transactions in real-time, without experiencing latency or throughput issues that could negatively impact its stability or efficiency.

Defining Performance Criteria
Defining performance criteria should be completed during the business requirement definition phase of the project. The customer and the vendor can collaborate to establish exact performance criteria, such as P99 latency (the amount of time it takes for 99% of requests to be processed successfully), that the screening system must meet. This alignment between performance expectations and technical optimizations ensures that the screening system delivers the required performance.

Data Preparation
Using representative data to simulate the expected workload ensures that the screening system is tested under realistic conditions. To achieve this, it is important to use data that is based on the expected peak period for the system, as this is when it will be most heavily utilized.

Latency and Throughput Testing
During performance testing, two key metrics to evaluate are latency and throughput. Latency measures the time it takes for the system to complete a transaction, from initiation to final processing. In contrast, throughput tracks the volume of transactions the system can handle within a specific time frame. Together, these metrics provide a clear picture of how efficiently the system performs, both in terms of response time and its ability to process large volumes of transactions.

Performance Optimizations
Once performance testing is complete, adjusting the screening engine infrastructure may be necessary to meet the required performance criteria. This can involve either vertical or horizontal scaling. Vertical scaling increases the resources of a single server, while horizontal scaling adds more servers to the existing infrastructure.

In addition to adjusting the infrastructure, there are several technical optimizations that can be implemented to improve the performance of the screening system. One such optimization is thread usage. Threads are a fundamental concept in computer programming and refer to the smallest sequence of instructions that a scheduler can manage independently.

Optimizing thread usage is typically done on the screening system, as it involves managing the number of threads the screening engine uses to process incoming messages. However, optimizing performance may also involve adjustments to the core system that exchanges messages with the screening system.

Other potential optimizations include adjusting the number of messages sent and processed in parallel and utilizing caching mechanisms to alleviate the system’s workload. These optimizations should be refined through load testing and capacity planning exercises to ensure that the screening system can handle the anticipated workload with optimal performance.

Additionally, network latency can significantly impact the overall system performance, and therefore site reliability engineers and technical experts should collaborate to identify and implement appropriate optimizations when needed.

By thoroughly testing the system’s latency and throughput using representative data and adjusting infrastructure resources and performance optimizations as necessary, the system can be optimized to meet defined performance criteria.

To maintain the effectiveness of a sanctions screening system, it is important to conduct continuous testing. This involves regularly reviewing all testing areas covered in the previous sections and reassessing the testing and auditing framework as the organization’s risk exposure evolves over time. The following recommendations provide practical guidance for continuous testing.

Regression Testing
Regression testing involves regularly conducting tests in a pre-production environment, particularly when your screening vendor releases a new version of the software. This ensures that the system continues to function correctly after any changes are made. Adopting a zero-trust approach to test the impact of any change affecting your screening environment. Once initial tests are satisfactory, take a snapshot of the configuration and reuse all test plans to create a baseline for regression testing.

Adaptability
It is important to have all the necessary tools and resources to adapt to rapidly changing circumstances in the sanctions landscape. Maintain active and continuous contacts with partners, vendors, industry peers, and interest groups to reduce vulnerabilities and understand current threats. Learn from public enforcement actions to identify any weaknesses and deficiencies, then enrich, update and amend your testing and auditing framework to close any loopholes.

Risk Reassessment
The baseline of your testing and auditing framework should be reassessed as your organization’s risk exposure evolves over time. This reassessment should consider factors such as new products and services, new client segments, or new geographies of operations. The risk assessment should also consider any changes in the regulatory environment, such as new sanctions programs or changes to existing programs.

Documentation
Documentation of all test results and maintenance of a record of all changes made to the screening system is important. This documentation can be used to demonstrate history of all changes made, compliance with regulatory requirements and provide evidence of due diligence. The documentation should be regularly reviewed and updated to reflect any testing and auditing framework changes.

Executive Summary
Travelex is the world’s largest exchange business specialist, with a presence in more than 20 countries. In Brazil, the Group consists of the brokerage Travelex Confidence and Travelex Bank, the first exclusive bank for foreign exchange transactions regulated by the Banco Central do Brasil (Bacen). Travelex Bank offers a range of international money transfer products including import/export, remittances, and mass payments.

Project Scope
In a highly regulated country like Brazil, assessing money laundering risks is a serious concern for money-transfer companies. The day-to-day business involvement of the central bank requires Travelex to check and pre-check all clients, and all transactions, to meet increasingly stringent regulations.

Travelex sought support with the detection of suspected money laundering and watchlist screening and sanctions risk violations.

Client Objectives
Travelex was seeking to deploy a robust AI solution delivering effective and efficient watchlist screening.

Travelex’s main concerns included:

• Finding a more efficient and technologically advanced solution to support a risk-based approach to anti money laundering (AML).
• Enabling and protecting a large and growing volume of transactions with an AI transaction monitoring solution that was robust enough to run at high speed and ensure seamless customer service.
• Deployment of a reliable and efficient sanction screening software able to handle all data and scale of global operations.
• Introduction of a low impact solution that would not cause friction to customers – and ensure ease of integration with existing AML programs.
• Integration with a system that would automate and alert on all sanction flags to ensure compliance with continuously changing global sanctions lists in all jurisdictions of operations.

Results

30,000 clients per minute

Proof of Concept (POC)
The POC was completed in only 3 days and Travelex was able to process 30,000 clients per minute.

Fast implementation
The full implementation was completed in 3 weeks, compared to eight months for other solutions.

False positives decline by 10x
Alerts plummeted from a high of 3,000 to 4,000 to mere hundreds of high quality alerts.

Alert quality
Travelex noted that the quality of the alerts was far superior and the compliance team was empowered with increased capacity to support growing transactions.

A comprehensive screening system that effectively manages risks and maintains compliance is critical for organizations operating in today’s global landscape. Organizations can ensure that their screening system is reliable, accurate, and efficient through the various testing methodologies outlined in this white paper, such as data integration flow testing, unit testing, effectiveness testing, efficiency testing, performance testing, and continuous testing.

The importance of having a robust screening system cannot be overstated, as failure to detect sanctioned entities can lead to severe consequences such as legal and financial repercussions, reputational damage, and loss of trust from customers and stakeholders.

Therefore, it is essential to approach customer and transaction screening as ongoing processes that call for continuous improvement, regular testing, and adapting to changing circumstances. By following the recommendations provided in this white paper, organizations can enhance their screening system’s capabilities, reduce their exposure to risk, and ensure compliance with regulatory requirements.