How to conduct adverse media screening, as a repeatable method

To conduct adverse media screening, a bank decides in advance who is screened, when, for which crimes, in which sources and how far back; then, on each review, it searches every form of the customer's name in every language tied to the customer, groups the copies of each story, rules out namesakes, classifies what remains by crime and stage, and writes down what it found and why it kept or set aside each story. The method matters more than any single search, because no US rule prescribes one: the FFIEC asks each bank to decide, on the basis of risk, when a negative media search is appropriate, and then examines whether the bank did what it decided. Done by hand, the steps blur into one long reading session. Botminds' Adverse Media Screening splits them between agents that search, group, translate and challenge, and two named people who decide, so each step leaves its own evidence.

The examples on this page come from a fictional sample bank as it runs through the solution, Corvane National Bank, and one of its reviews: an enhanced due diligence (EDD) refresh for a director of a high-risk commercial client. The bank, its customers and the articles are invented; the guidance is real and linked.

“it is important that a clearly defined end-to-end operating model and framework is in place to ensure the alerts are investigated and concluded in a timely and consistent manner.”

Wolfsberg Group, Negative News Screening FAQs (2022), guidance from a banking standards body

What are the steps of adverse media screening?

There are ten steps, in three groups: five decisions made once, in policy, and revisited each year; three steps of reading on every review; and two of deciding and recording. The table sets out each step, the decision it embodies and the evidence it should leave, which is what an examiner or a second analyst needs to repeat it.

The evidence column is the test of a method. A search done from memory leaves a screenshot and a sentence; the steps above leave enough for a second analyst, months later, to see what was searched, what came back, and why each story was kept or set aside. The rest of this guide takes the decisions in turn.

Who is screened, when, and how far back

Decide the population, the occasions and the look-back in policy, by customer risk, before anyone types a search. Wolfsberg lists the scope choice as "who should be screened (e.g., customers, UBOs, related parties or non-customers)", and the answer for a high-risk legal entity customer usually includes its beneficial owners and directors, because the stories are about people, not companies.

The occasions are onboarding, the periodic refresh of an EDD file, trigger events and ongoing monitoring. The FFIEC manual counts negative media results, unexplained changes in activity, changes in ownership and law enforcement requests among the events that can open a review. Each occasion needs a clock: at the sample bank, an onboarding review is due in 2 business days, an EDD refresh in 5, a trigger event in 1.

The look-back sets how much history each search reads. Wolfsberg suggests "A multi-year look-back threshold may be appropriate, either for all media or higher or lower periods based on the crime/offence types", and adds that after an initial review "it may only be necessary to screen against new media events." The sample bank looks back 10 years on a first review and then watches for new stories; its other settings are 5 and 7 years.

Which crime categories should I screen for?

Screen for the predicate offences your risk assessment says your customers could be exposed to, and write them down with the terms that find them. Wolfsberg's examples are nine: money laundering, terrorism and its financing, bribery and corruption, organised crime, drug trafficking, human trafficking, wildlife trafficking, proliferation and its financing, and tax evasion. The sample bank screens eleven categories, adding fraud, sanctions evasion and regulatory action to the crimes on that list.

Each category needs its own terms in each language searched: "bribery, kickback, bid rigging" in English is "propina, licitação, direcionamento" in the sample bank's Portuguese list and "soborno, licitación amañada" in its Spanish one. The terms should name the crime rather than the stage; words like "arrested" or "investigation" return everything from murder trials to business news. How those terms combine with the names into a search string, and why one English string misses stories, is covered on its own.

Exclusions are part of the category list. Wolfsberg allows civil matters with no financial-crime link to be left out and says the line is drawn "at the discretion, and in line with the risk appetite of each FI." A traffic offence by a corporate customer's director is not a financial crime; an environmental permit violation at its plant may be a regulatory matter the bank still wants to know about.

Allegation or conviction: when should an alert fire?

A bank that wants to act before a case is closed needs to know at the allegation or investigation stage, and must then weigh what it finds by its stage. Wolfsberg describes the stages as an allegation "which then likely becomes an investigation which may lead to charges ending with a conviction", and warns that "alert volumes at the allegation stage will be higher than receiving an alert at conviction stage once the alleged crime has been investigated and may have less AML/CTF value." Waiting for convictions is cheap and late: a prosecution can take years, and the money moves in the meantime.

The answer is to alert early and grade by stage. The sample bank's rating model weights corruption at 23 points and multiplies by 0.7 for a story at the investigation stage, adding 16 to the director's rating. When a story moves the other way, as when a court acquits, the agents propose lowering the weight and a person decides. The European Banking Authority's guidelines make the same point from the other side: a missing conviction is not, on its own, a reason to dismiss an allegation.

Stage also changes over time, and the method has to follow it. The sample review ends with ongoing monitoring watching the story for a charging decision; a later article that reports charges joins the same story and moves its stage, rather than opening a new alert about an event the bank already knows.

Which sources are credible, and what do I exclude?

Use sources you can name and defend: licensed news and wire services, court and enforcement notices, regulator releases, with credibility judged in writing. The EBA asks firms to judge allegations "on the basis of the quality and independence of the source of the data and the persistence of reporting of these allegations, among other considerations" (EBA/GL/2021/02). Wolfsberg lists six marks of a reputable source.

Where a vendor supplies the content, the credibility work does not transfer with it. Wolfsberg recommends that the bank "understands the evaluation of reliability performed by the vendor and the controls they have in place to mitigate the risk of unreliable sources influencing the screening process." In practice that means an approved-source list the compliance manager owns, and a search that cannot wander outside it; in the sample bank, the agents search five approved sources and never anything else.

How to read the pile: copies first, then identity

Group the copies before judging anything, then test identity story by story. A search returns articles; the decision is about events. Syndicated wire copies, rewrites and translations of one report are one event, and reading them as separate hits wastes time and invites inconsistency, two analysts reaching different views of the same story because they read different copies.

37 articles, 4 stories: copies grouped under the earliest original

Then test identity on each story, not each article: name, age, occupation, employer, role and city against the customer file, with the age worked out on the day the article was published. On the sample review that left one story about the customer that was adverse, one about the customer that was harmless, and two about other men. What an adverse media hit means, and how to work the identifiers, has its own guide.

How often should adverse media be rerun?

Rerun it at every due diligence event the customer's risk calls for, and monitor the highest-risk customers continuously for new stories only. Frequency is a risk-based choice that Wolfsberg lists alongside scope and sources, and the EBA's banking guidance sets one floor for the riskiest: "Where the risk associated with the relationship is particularly high, banks should review the business relationship annually."

Continuous monitoring is where a method either holds or drowns. Wolfsberg describes screening "only the data that has changed since the last screening (the delta)", and the equivalent for news is to ask, each night, whether a story is new or whether an old one has moved. The sample bank searches 6,240 high-risk customers every night. On the night shown below, 51 new articles joined stories already on file without opening an alert, and 18 new stories reached the agents, each challenged before it reached a person.

Monitoring that alerts on new stories and moved stages, not on old news

How do I document the result?

Document the search as well as the answer: what was searched, in which sources and languages, on what date, what came back, and the reason each story was kept or set aside, with the decision signed by name. Wolfsberg asks for procedures that require the rationale for "all alerts (including true and false positive matches)", and a search engine screenshot is weak evidence: Wolfsberg also notes that results can change from one day to the next and from one user to another, so the page an analyst saw may never be seen again.

A defensible note answers six questions. What forms of the name, in which languages, against which sources and over which years? How many results, grouped into how many stories? Which stories were set aside, and on what identifier or ground? For the story that matters, what does it allege, at what stage, and which sentence says so, in the original language? Who decided, with what reason code, and who checked? What follows: a rating change, a referral, monitoring? The Bank Secrecy Act's general rule keeps the records it requires for five years (31 CFR 1010.430), and the sample bank keeps every search, proposal and decision for the same period.

Quality control: the second look

A method needs a check before the decision and a test after it. Wolfsberg treats quality control as preventative, before an alert is closed, and quality assurance as detective, sampling closed alerts afterwards. Both are easier when every step left evidence, because the reviewer is checking reasoning rather than repeating the search.

In the solution, the check is built into the flow: an analyst confirms a story with a reason code, and a different person must accept it into the customer file. Reviews where every story was another person or not adverse can be confirmed in bulk, but a random 5% go to a second analyst first. How to measure whether two analysts would reach the same finding, and what to do where they do not, is the subject of adverse media findings two analysts would both sign.

One review, run through Adverse Media Screening

On the sample review, the method ran from the first search to an approved rating in under four hours of elapsed time, most of it the review waiting for a person. The agents searched, translated, grouped, matched and challenged between 6:41 and 6:43 AM. The analyst confirmed the one relevant story at 9:16 AM; the EDD reviewer accepted it at 10:05 and proposed the rating change at 10:07; the compliance manager approved it at 10:31.

Every step left its evidence: the search plan with six name forms, three languages and their reasons; the 37 articles grouped into 4 stories with no copy dropped; the identity tests that set two stories aside; the Portuguese sentence that ties the third to the customer, beside its translation; the reason code AM-05, "relevant, under investigation, no charge"; and three signatures. To see that review end to end, start from Adverse Media Screening.

Questions people ask

What is the adverse media screening process?

It is the sequence above: decide scope, occasions, categories, sources and look-back in policy; on each review, search every name form in each relevant language, group copies into stories, test identity, classify relevance and stage, decide, and route. The process is defensible when each step leaves evidence a second analyst could follow.

How do I do a negative news search by hand?

Write down the name forms and languages first, then run the same risk terms against each, using the same search settings every time. Record the date, the settings and the number of results, read each distinct story rather than each result, and note why each one was set aside. Wolfsberg advises keeping search engine settings consistent "to avoid inconsistencies in results".

Should adverse media screening cover beneficial owners?

For higher-risk legal entity customers, usually yes. Wolfsberg includes UBOs and related parties in the scope choices, and the stories that change a company's risk are mostly about the people who own or run it. The sample review on this page is an EDD refresh of a company, run on its 30% owner and director.

What should I do when an adverse media story mentions sanctions?

Route it to the sanctions team the same day, whatever its stage. A news report that a customer or owner is designated, or is evading sanctions, raises a legal question that an adverse media review cannot close. The routing should be written into the procedure rather than left to the analyst's judgement.

How long should an adverse media review take?

No standard exists, and it depends on the customer's public profile. Botminds estimates about 75 minutes of analyst time by hand for a review that turns up a relevant story; the solution's design target for the same review is 6 minutes, with the agents doing the searching, grouping and translation.