Investment exclusion lists: when the data feed and the filing disagree

An investment exclusion list is the set of issuers a fund or account may not buy: names a client's side letter rules out, companies a prospectus promises to avoid, sanctioned entities, and issuers on the firm's own restricted list. Many exclusions are written as criteria rather than names, "more than 10% of revenue from thermal coal", "any involvement in tobacco", so whether a given issuer is excluded depends on a fact about it, and that fact usually comes from a data vendor. An exclusion check can therefore pass and still be wrong, when the vendor's figure is stale, incomplete or defined differently from the clause. Botminds' Pre-Trade Compliance Checks tests client and prospectus exclusions before the order and, where an exclusion turns on a fact about the issuer, reads the issuer's latest filing, cites the page, and uses the filing when it differs from the vendor by more than a set tolerance.

The worked case below uses the solution's sample data, on fictional issuers, funds and clients. The enforcement history and research are cited from the SEC, Norway's central bank and a peer-reviewed study.

What is an investment exclusion list?

An investment exclusion list is a binding restriction on what a portfolio may hold, kept as names, criteria or both. It differs from a watch list or a preference: a security on it may not be bought at all, and buying it is a breach the moment the trade is made. For a pre-trade check, that makes exclusions the purest case: there is no passive version of buying an excluded issuer, and no size at which it becomes acceptable.

Exclusions come from four places, and each has a different owner. A client writes them into a side letter or investment guidelines. A fund promises them in its prospectus. Governments impose them through sanctions. And the firm adds its own, from controversial weapons policies to a restricted list kept behind the information barrier. Only the firm's own exclusions are the firm's to change.

Exclusion list criteria: what each kind of exclusion depends on

Every exclusion criterion depends on a fact, and the quality of the check is the quality of that fact. Named exclusions depend only on identifiers. Criteria-based exclusions depend on revenue, ownership or activity, which must be read from somewhere and kept current.

The sanctions row shows why a name list is never enough. OFAC's guidance treats any entity owned 50 percent or more, directly or indirectly and in the aggregate, by blocked persons as blocked itself, "regardless of whether the entity itself is listed" (OFAC, Revised Guidance on Entities Owned by Persons Whose Property and Interests in Property Are Blocked, August 13, 2014; the 50 percent rule explained). The excluded issuer may not be on any list; its owners are.

The Paris-aligned row shows how low a revenue threshold can go. Funds that use sustainability-related terms in their names in the EU are expected to exclude, among others, "companies that derive 1 % or more of their revenues from exploration, mining, extraction, distribution or refining of hard coal and lignite" (ESMA Final Report, quoting CDR (EU) 2020/1818). At 1%, a diversified miner or a utility with a small coal segment is in or out on a single line of its segment note.

What did the SEC find about negative screens?

The SEC's examiners found that client exclusions were among the weakest controls they saw. In its 2021 review of ESG investing, the staff reported that "advisers did not have adequate controls around implementation and monitoring of clients' negative screens (e.g., prohibitions on investments in certain industries, such as alcohol, tobacco, or firearms), especially if the directives were ill-defined, vague, or inconsistent. Nor did advisers have adequate systems to consistently and reasonably track and update clients' negative screens leading to the risk that prohibited securities could be included in client portfolios" (SEC Division of Examinations, Review of ESG Investing, April 9, 2021).

Two failures are named there, and they need different fixes. Ill-defined directives are a reading problem: "tobacco" without a definition does not tell a rules engine whether a convenience store chain is excluded. Tracking and updating is a data problem: a screen set up correctly in 2022 drifts as issuers change and as side letters are amended. Both happen before the order.

What if the data vendor is wrong? The WisdomTree order

Then the fund breaks its own promise, and the SEC treats that as the adviser's failure, not the vendor's. In October 2024 the SEC found that from March 2020 until November 2022 WisdomTree "represented in prospectuses for three ESG-marketed exchange-traded funds, and to the board of trustees overseeing the funds, that the funds would not invest in companies involved in certain products or activities, including fossil fuels and tobacco" (SEC Press Release 2024-173). The adviser agreed to a cease-and-desist order, censure and a $4 million civil penalty, without admitting or denying the findings.

"the data WisdomTree purchased from a third-party vendor ("Vendor A") only identified a subset of companies involved in fossil fuels, and WisdomTree failed to purchase supplemental data that would have identified additional such companies."

SEC order, In the Matter of WisdomTree Asset Management, Inc., Release No. IA-6753

The order is a catalogue of how vendor data fails an exclusion. The prospectuses said fossil fuel and tobacco companies "are excluded regardless of revenue measures", but the vendor's tobacco data, the order says, "had not captured certain retailers who derived less than 10% of their revenues from retail sales of tobacco products": a threshold the prospectus never had. Where the vendor gave no answer at all, the order found, "WisdomTree did not conduct further research to make this determination", and the model "deemed those securities as eligible for inclusion" unless a second vendor's energy-sector data flagged them. Missing data defaulted to yes.

The lesson for a pre-trade check is precise. Compare the clause's definition with the data set's definition before relying on it; know what the data set does not cover; and never let an unknown fact resolve to "may buy". In the press release, the SEC's acting enforcement director put the standard in one line: "investment advisers must do what they say and say what they do."

When the vendor and the filing disagree: a worked case

When a vendor figure and the issuer's filing disagree near a threshold, the filing is the better evidence, because it is the issuer's own statement for a named period and it can be quoted. In the solution's sample run, a public pension's side letter excluded any issuer with more than 10% of annual revenue from thermal coal. The vendor showed the issuer at 8.9%, from fiscal 2023. The issuer's fiscal 2025 annual report showed thermal coal revenue of $612 million on total revenue of $4,310 million: 14.2%.

The third issuer is the honest limit of the method. Norway's central bank, which applies a revenue-based coal criterion to the Government Pension Fund Global, wrote in 2017 that "the information reported by the companies themselves is not normally detailed enough for the analyses required", and that "While the average level of different suppliers' data points is comparable, the individual data points can vary substantially. Reporting across different time periods and metrics is a particular challenge" (Norges Bank, letter to the Ministry of Finance, 31 January 2017). It also noted that mining companies often report thermal and metallurgical coal separately, which is what makes a revenue test workable for them.

Research on ESG data points the same way. A peer-reviewed study of six major ESG rating providers found that measurement, the same attribute measured differently, contributes 56% of the divergence between their ratings, and called for "greater attention to how the data underlying ESG ratings are generated" (Berg, Kölbel and Rigobon, Review of Finance, 2022). An exclusion that depends on one vendor's measurement inherits that vendor's method.

Exclusion lists, and the vendor's figures tested against each issuer's filing

How are investment exclusion lists enforced?

In three layers, and most failures come from the first. The criteria are turned into rules: names into identifiers, thresholds into fields and comparisons. The rules are tested before the order, in the order system's compliance module, and after it, in post-trade monitoring. And exceptions are resolved: an issuer near a threshold, a missing data point, a disagreement between sources. A screen that is well coded but fed a stale figure enforces the wrong list with great reliability.

US law gives an unusual hint about the evidence standard. Section 13(c) of the Investment Company Act protects a fund from suits based solely on divesting from, or avoiding, issuers that it "determines, using credible information available to the public", conduct certain business in Sudan or Iran (15 U.S.C. 80a-13(c)), provided it makes the disclosures the SEC requires. Credible public information, an issuer's own filing above all, is what a defensible exclusion decision rests on.

How often should an exclusion list be refreshed?

On two clocks: whenever the source document changes, and whenever the facts behind a criterion change. A side letter amendment, as in the sample firm where a client tightened its coal threshold from 25% to 10%, must reach the rules engine the day it takes effect. Revenue-based criteria should be re-tested when each issuer files its annual report, because that is when the fact changes. Sanctions designations can be added on any business day, which is why the solution's sample firm loads the OFAC and EU lists each morning.

The SEC's 2021 finding about tracking and updating screens, and the CSSF's finding, in its review of 2025 breaches, that systems were not updated after fund documents changed, describe the same gap: the list is right on the day it was built. A pre-trade check that reads the current document and the current filing at the time of the question closes most of it.

Who owns a client's exclusion list, and can a side letter add an exclusion?

The client owns it, and yes, a side letter is a common place for one. An exclusion in a side letter or investment management agreement is a contractual term: the manager may not override it, and only the client can waive it, in writing. In the solution, client limits carry no override button at all; the answer to the sample pension's question was no, with the side-letter clause, the filing figure and the agreement article saying only the client may waive it. In model and separately managed account programs the client's right to impose such exclusions is written into the safe harbor itself: Rule 3a-4's reasonable restrictions.

That ownership has a practical consequence for data. When the client defines the criterion, "most recent annual report", "any involvement", "including subsidiaries", the manager's data must match the client's definition, not the vendor's. A pre-trade compliance solution that knows which limits can never be overridden treats a client exclusion accordingly.

The page behind the exclusion, one click from the verdict

Exclusion lists look like the simplest restriction a fund has, a list of names. In practice they are a set of facts about issuers, each with a date and a source, and the failure the SEC keeps finding is a fact nobody checked. To see an exclusion answered with the filing page attached, start from Pre-Trade Compliance Checks; the guide to Rule 12d3-1 securities shows the same reading discipline applied to a regulatory limit.

Questions people ask

What is the difference between an exclusion list and a restricted list?

An exclusion list states what a fund or account may not hold, usually because of a client's, a prospectus's or the firm's investment policy. A firm restricted list blocks trading in issuers for compliance reasons, often because the firm holds inside information, and its reasons are kept behind the information barrier.

Is a fund liable if its data vendor misses an excluded company?

The SEC treated it as the adviser's failure in the WisdomTree order: the vendor data identified only a subset of fossil fuel companies, the adviser did not buy supplemental data or research gaps, and it agreed to a $4 million penalty. The adviser chose the data and made the promise.

How do you screen for companies owned by sanctioned persons?

Check ownership, not just names. Under OFAC's 2014 guidance, an entity owned 50% or more in aggregate, directly or indirectly, by blocked persons is itself blocked even if it is not listed, so the check needs ownership chains for every issuer.

Can a manager override a client's exclusion?

No. A client exclusion is a contractual term in a side letter or management agreement, and only the client can waive it, in writing. A firm can override only its own house rules, with a documented reason and a second approval.

Which fiscal year should a revenue-based exclusion use?

Whatever the client's or prospectus's clause says, often the most recent annual report. In the sample case the vendor's figure was from fiscal 2023 and the issuer had since filed for fiscal 2025, and the two sat on opposite sides of a 10% threshold.