Every time someone opens an account, sends a payment, or completes an onboarding form, a bank is quietly making a bet. The bet is that the person on the other side of the transaction isn’t on a sanction list, isn’t a politically exposed person hiding in plain sight, and isn’t a name that will show up in a regulator’s audit six months from now.
For a long time, banks placed that bet in batches — overnight jobs, next-day reviews, compliance teams working through queues. In a world of instant payments and fully digital onboarding, that model has quietly stopped working. The decision now has to be made in the moment the customer clicks “confirm.” And that changes everything about how screening technology has to be built.
Why this matters more than it used to
Sanction lists are official databases of individuals, entities, countries, and groups flagged by governments and international bodies for involvement in terrorism, money laundering, arms trafficking, or violations of international law. Screening against them isn’t a nice-to-have. It’s the mechanism that keeps a bank from financing prohibited activity, from doing business indirectly through sanctioned entities, and from waking up to a headline it can’t walk back.
There is no single global rulebook. Banks operate against a patchwork: EU Council Regulations and the Common Foreign and Security Policy, FATF recommendations, national legislation in each member state, UN Security Council Resolutions, and — for anyone touching USD-based transactions — US OFAC sanctions. The obligations overlap, evolve, and rarely wait for your next release cycle.
The cost of getting it wrong has teeth. In Europe, fines can run to a meaningful percentage of worldwide turnover or land as large fixed penalties. Beyond the numbers, non-compliance can bring criminal exposure for executives and compliance officers, frozen or seized assets, revoked licenses, restricted access to financial services, and the kind of reputational damage that outlasts any settlement. In banking, trust is the product — and sanction exposure attacks it directly.
The real tension: speed versus accuracy
Here’s the trap most compliance teams know well. Tighten the matching and you catch more true risks, but you drown analysts in false positives, every common surname, every near-miss. Loosen it and the queue shrinks, but you start missing the people you were supposed to catch. Meanwhile, the customer is sitting at a loading screen deciding whether your bank is worth the wait.
Modern screening has to resolve that tension rather than trade one problem for another. That means matching that is tolerant of misspellings and transliteration without collapsing into noise, and it means doing all of it fast enough that the customer never notices.
What “fast enough” actually looks like
This is where engineering gets interesting. eSourcings Abee Digital ID approaches sanction screening as a real-time problem from the ground up rather than a batch process wearing a real-time costume.
It runs three lookup modes so teams can tune the balance themselves:
- exact matching (fastest, but intolerant of any variation),
- narrow fuzzy matching (ultra-fast and tolerant of non-exact names),
- broad fuzzy matching (built to absorb heavier misspellings).
Sensitivity is configurable, so the same engine can serve a low-friction retail flow and a high-scrutiny correspondent-banking check.
The performance numbers are what make it viable at the point of decision. In a realistic scenario screening against 11 lists totalling roughly 700,000 records, the most advanced model returns results in around 20 milliseconds on average. An on-demand scan over an HTTP endpoint responds in up to 350 milliseconds — fast enough to sit inside a live onboarding or payment flow without the customer ever feeling the pause.
Three ways to put it to work
Different banking workflows need different integration points, and a single API rarely fits all of them:
- On-demand scan. A screening call over an HTTP endpoint, callable from any application, returning a result immediately. This is the natural fit for onboarding forms and payment confirmation screens where a synchronous yes/no is needed before the action completes.
- Kong-based API gateway plugin. Installed directly in the Kong API Gateway, it runs the screening model and attaches the result to the request header — so the server handling the request can act on it inline, without a separate call.
- Automatic run with raised events. The default mode, where every event configured as model input is scanned continuously. When there’s a match against a list, a new event is raised and sent to output streams for further asynchronous processing. This is the backbone of ongoing transaction monitoring rather than one-time checks.
Coverage that reflects real obligations
Out of the box, Abee DI supports the lists banks are actually accountable to: PEP data from Open Sanctions, plus United Nations, European Union, and United States sanction lists — covering individual names, entity names, and document IDs for both individuals and entities across multiple variants.
Just as importantly, banks can import their own or acquired lists and run them alongside the built-in ones. Internal watchlists, industry-specific feeds, region-specific requirements — they all fold into a single comprehensive filter. That flexibility matters because no two institutions carry exactly the same risk appetite or regulatory footprint.
Where it fits in a real onboarding
Picture a customer registering or placing an order. The application invokes Abee DI through one of the methods above. The model runs and calculates the probability that the customer matches a sanctioned entity. From there the result can flow onward — for example into SAS for further processing — and the application makes its decision: let the action through, block it, or route it to a human for manual verification. The customer experiences a single smooth step. The compliance obligation is satisfied behind the glass.
The broader picture
Sanction screening rarely lives alone. It sits inside a wider fraud-and-AML posture: continuous transaction monitoring, behavioural analytics, device fingerprinting, and consolidated risk profiles that cross-reference customer data with behavioural patterns. Abee DI is built as a data-capture and screening layer across digital channels — web, mobile, and hybrid apps — with GDPR-aligned data handling and a management interface for tuning rules and models as regulations shift.
That last point deserves emphasis. Regulations don’t hold still, and neither do the lists. Screening infrastructure that can’t scale or adapt without disrupting operations becomes a liability the moment the rules change — which, in this domain, they always do.
The takeaway
Banking has crossed a threshold. Compliance can no longer be the slow lane running quietly in the background; it has to keep pace with instant, digital, always-on customer journeys. The institutions that get this right won’t treat sanction screening as a tax on speed. They’ll treat it as something that can be both rigorous and invisible — accurate enough to satisfy the regulator, fast enough that the customer never knows it happened.
Twenty milliseconds is a strange place to find a competitive advantage. But in modern banking, that’s exactly where it lives