Screening the counterparty, not just the box

A different question from the one lessons 1 to 3 asked

Everything so far has been about the goods. What is in them. Where it came from. What a border may do about it. Sanctions and restricted-party rules ask something else. They ask who you are dealing with.

That is a change of unit, and it catches people out. Your compliance file is organised by supplier. Your exposure is organised by transaction. You can buy a completely ordinary garment, made of completely ordinary cotton, and still have a problem. It depends on who owns the mill, who is named as the notify party, and whose bank account the money lands in.

Three properties of these rules matter in practice. None of them requires knowing which names are on any list today.

• They attach to parties and to people, not only to companies: owners, directors, and the entities those people control.
• A party that is not itself named can still be caught through ownership or control. Where the line sits — what share, what kind of control — differs between regimes, and it moves. Do not carry a threshold in your head. Look it up for the regime you are actually subject to, on the day.
• They are dated. A list is a document with a version. So screening a name is an event that happened at a moment. It is not a status the counterparty now holds forever.

Define the population before you buy the tool

Most screening programmes fail at the first step, which is deciding who is in scope. Tolbury's population, once somebody sat down and wrote it out, was bigger than anyone expected:

The two groups nobody had counted were the last two. Consignees and notify parties get typed onto transport documents by whoever prepares them. That is often the forwarder, often from a template, and it is rarely anybody's responsibility. Payment beneficiaries live in the finance system, and they are not on the sourcing team's map at all.

The mistake nobody made

Mirsal Textiles was screened on 14 January at onboarding, and cleared: the company, its two shareholders and its managing director, against the lists as they stood that day, with the result printed and filed.

On 12 May, while the container sat, Mirsal's finance office emailed new remittance details. The payee was not Mirsal. It was a receivables financier in a third country. That is an ordinary and lawful arrangement: a mill short of cash sells its invoices.

Tolbury's finance team did exactly what its own procedure required, and the procedure was a good one. It treated a change of bank details as a fraud risk. It telephoned the number written on the original signed contract, not any number in the email. It spoke to a person it had dealt with for years, and confirmed the change. It paid on 26 May.

Every step was correct. The screening record still said Mirsal Textiles, cleared 14 January, and that was still true. The party that received USD 82,176 was never screened at all. The payment file is keyed to the supplier record, and the beneficiary is a field inside it.

Nobody was careless. The procedure protected against the risk it was written for, and said nothing about a different one. The fix is not a new procedure. It is one line in the existing one: a change of beneficiary is a new counterparty, and a new counterparty is screened before the first payment.

Five triggers, and a calendar

A screen is worth what it covers. These are the moments at which a name genuinely changes, or a new one appears:

1. Onboarding — before the first contract, covering the entity, its owners and its directors.
2. Before each contract or purchase order — because ownership changes, and lists change, between orders.
3. On any change of legal entity name, ownership, bank details or beneficiary — this is the one that caught Tolbury.
4. Before shipment, covering the parties actually named on the transport documents: consignee, notify party, carrier, and any party the forwarder has added.
5. Before payment, against the beneficiary as it appears in the payment instruction, not as it appears in the supplier master.

Then a periodic sweep of the whole population, on a calendar. The reason a name becomes restricted has nothing to do with your order cycle, and it will not announce itself.

Hits are normal, and clearing one is a written act

Screening produces matches. Most of them are wrong. Treat a hit as an accusation and the programme gets quietly switched off.

Tolbury's last full sweep of 214 names returned 26 possible matches, a hit rate of 12.1%. Twenty-four were cleared in an average of seven minutes each. Two needed escalation and a written note.

A false positive is cleared with identifiers, not intuition: a date of birth, a registration number, a registered address, a passport country, a full legal name against a trading name. It is probably not them is not a clearance. What goes on the file is the name screened, the list and version consulted, the date, the identifiers used, the decision, and who made it. That record is the only thing that will still exist in two years. It is what turns "we screen our suppliers" from a claim into evidence — the same distinction lesson 1 drew about the goods.

Set that against the arithmetic in lesson 3. It is not a budget question. It is a habit question.