AML Screening Best Practices:
Sanctions, PEP, and Adverse Media

The Compliance Landscape in 2026

Anti-Money Laundering screening is no longer a back-office checkbox. Regulators across the EU (6AMLD), the United States (FinCEN's CDD Rule), and the Asia-Pacific region (FATF Travel Rule) now mandate continuous, risk-based screening against sanctions lists, Politically Exposed Persons (PEP) databases, and adverse media sources. Financial institutions that fall short face nine-figure fines. In 2025 alone, cumulative global AML penalties exceeded $4.7 billion, with enforcement actions increasingly targeting technology gaps rather than procedural ones. The message is clear: compliance teams need both better data and better cryptographic infrastructure.

This article covers the three pillars of modern AML screening — sanctions, PEP, and adverse media — and explains how fully homomorphic encryption (FHE) and post-quantum cryptography can make each pillar faster, more private, and more resilient to regulatory change.

1. Sanctions Screening: The Mandatory Baseline

Sanctions screening checks customers against lists maintained by OFAC (the U.S. Office of Foreign Assets Control), the European Union Consolidated List, the United Nations Security Council list, and HM Treasury's sanctions list. Matching is legally mandatory: processing a transaction for a sanctioned entity can trigger strict liability, meaning intent is irrelevant.

The challenge is false positives. Name-matching algorithms based on Levenshtein distance or Jaro-Winkler similarity routinely flag legitimate customers whose names partially overlap with sanctioned entities. A well-tuned system targets a false-positive rate below 2%, but many institutions still operate at 5–10%, burying analysts in manual review queues.

Reducing False Positives with Contextual Matching

The most effective approach layers multiple signals: name similarity, date of birth, nationality, document number, and transactional context. Rather than relying on a single fuzzy match, a weighted scoring model assigns each field a confidence coefficient and triggers review only when the composite score exceeds a calibrated threshold.

2. PEP Screening: Risk Beyond Sanctions

Politically Exposed Persons are individuals who hold or have held prominent public functions — heads of state, senior government officials, board members of state-owned enterprises, senior military officers, and their immediate family members or close associates. PEP status does not make someone a criminal, but it elevates the money-laundering risk profile and triggers enhanced due diligence (EDD) obligations under FATF Recommendations 12 and 22.

Unlike sanctions screening, PEP databases are not standardized. Commercial providers such as Dow Jones, Refinitiv World-Check, and Bureau van Dijk maintain proprietary PEP lists with varying coverage, update frequency, and classification taxonomies. Institutions should cross-reference at least two independent PEP sources and maintain a clear audit trail showing which sources were checked, when, and what disposition was reached.

"The most dangerous PEP screening failure is not a false negative — it is a stale positive that was never resolved. An unreviewed alert sitting in a queue for 90 days is a compliance violation waiting to become an enforcement action."

3. Adverse Media Screening: The Unstructured Challenge

Adverse media (also called negative news) screening searches public information sources — news articles, court filings, regulatory enforcement databases — for derogatory information about a customer. FATF explicitly names adverse media as a component of customer due diligence. The difficulty is that media data is unstructured, multilingual, and noisy. Natural language processing pipelines must disambiguate entities, handle transliteration, and filter out irrelevant results.

Best practice calls for a tiered approach: automated NLP-based classification for initial triage, followed by analyst review for high-risk matches. Institutions should define explicit risk categories (fraud, corruption, terrorism financing, tax evasion, environmental crime) and map each media hit to the relevant category before escalating.

4. The Privacy Problem: Why Encryption Matters

Every AML check requires sharing sensitive personal data — names, dates of birth, document numbers, biometric identifiers — with screening providers or internal matching engines. Under GDPR Article 5(1)(f) and CCPA Section 1798.150, this data must be protected both in transit and at rest. But traditional screening operates on plaintext: the matching engine must see the data to compare it. This creates a structural tension between compliance obligations (screen everyone) and privacy obligations (expose no one).

This eliminates the plaintext exposure window entirely. H33's production pipeline processes a 32-user FHE batch in approximately 1,109 microseconds, yielding a per-authentication cost of roughly 42 microseconds. On a single AWS Graviton4 instance (c8g.metal-48xl, 96 vCPUs), the sustained throughput reaches 1.595 million authentications per second — more than sufficient for real-time sanctions screening at any transaction volume.

Post-Quantum Attestation

Every screening result must be auditable. H33 signs each batch attestation with Dilithium (ML-DSA, FIPS 204), producing a post-quantum digital signature that proves the screening was performed, by whom, and at what time. Combined with a zero-knowledge proof lookup cached via an in-process DashMap at 0.085 microseconds per query, the full attestation chain adds less than 250 microseconds per batch.

// Pseudocode: encrypted AML screening call via H33
let encrypted_record = h33::fhe::encrypt(&customer_pii, &public_key);
let screening_result = h33::aml::screen_encrypted(
    &encrypted_record,
    &encrypted_watchlist,
    ScreeningConfig {
        sanctions: true,     // OFAC, EU, UN
        pep: true,           // Dow Jones + Refinitiv
        adverse_media: true, // NLP-classified
        threshold: 0.85,
    },
);
// Result is still encrypted — decrypt client-side
let plaintext_result = h33::fhe::decrypt(&screening_result, &secret_key);
// Dilithium-signed attestation included in response
assert!(plaintext_result.attestation.verify(&h33_public_key));

5. Implementation Checklist

Whether you are building a screening pipeline from scratch or upgrading an existing one, the following practices represent the current regulatory and technical consensus:

• Screen in real time. Batch overnight screening is a regulatory liability. Target sub-millisecond latency per check.
• Layer multiple signals. Name matching alone produces unacceptable false-positive rates. Add DOB, nationality, document ID, and transactional context.
• Cross-reference PEP sources. No single PEP database has complete coverage. Use at least two independent providers and document your methodology.
• Classify adverse media. Do not treat all negative news equally. Map hits to specific risk categories and escalate accordingly.
• Encrypt everything. FHE enables screening on encrypted data with zero plaintext exposure. H33's BFV pipeline delivers this at ~42 microseconds per identity.
• Attest every result. Use post-quantum signatures (Dilithium / ML-DSA) to create tamper-proof audit trails that will survive the quantum transition.
• Cache ZKP lookups. For repeated screening of known entities, a DashMap-backed ZKP cache at 0.085 microseconds per lookup eliminates redundant cryptographic work.
• Automate disposition tracking. Every alert must have a documented resolution. Unreviewed alerts older than 72 hours should trigger escalation.

Building Toward Quantum-Safe Compliance

AML screening infrastructure built today will still be in production when cryptographically relevant quantum computers arrive. Institutions that screen on plaintext and sign audit logs with RSA or ECDSA are accumulating technical debt that will force an expensive migration later. By contrast, a pipeline built on BFV FHE, Dilithium attestation, and ZKP-backed proof caching is already post-quantum secure. H33's stack delivers this at 1.595 million authentications per second on commodity cloud hardware — proving that quantum-safe compliance does not require sacrificing performance.

The regulatory direction is clear: continuous screening, encrypted processing, and cryptographically provable audit trails. The technology to meet that standard exists today.