A multi-agency inquiry into sanctions screening at a payments platform

The client self-identified a gap after an internal test failed to flag a transaction involving a designated counterparty. Within a fortnight it had received requests from two authorities and expected a third.

The immediate question was not what had gone wrong but how much had gone wrong, and the client could not answer it. The screening system had been reconfigured during a platform migration nineteen months earlier, and nobody had established what the reconfiguration had changed.

We applied the firm's investigations protocol from the first day: preservation notices, a defined privilege perimeter, and a single interview record. This mattered because three authorities would eventually be asking for overlapping material on different terms.

We instructed forensic analysts to reconstruct the screening configuration as at each date since the migration, and reviewed 2.1 million transactions against the reconstructed rule sets. That exercise established the exposure was confined to a fourteen-week window and to one transaction corridor.

We recommended voluntary disclosure to the third authority before it opened an inquiry, and made it in week six, accompanied by the completed scoping analysis rather than a commitment to produce one.

No enforcement action was taken against the company by any of the three authorities. Two closed their inquiries following the remediation report; the third accepted undertakings.

The client's screening governance was rebuilt around change control, which had been the actual failure. We continue to advise on its annual testing program.