Stop Screening Third Parties by Hand

Ultimate Beneficial Ownership (UBO) compliance is no longer a periodic task. It's an ongoing requirement, and if you're still manually checking sanctions lists, you're already behind.

The OFAC 50 Percent Rule presents a challenge: any entity owned 50% or more by blocked persons is itself blocked, even if not named on the Specially Designated Nationals and Blocked Persons List. You can't just check company names; you need to trace ownership structures, identify beneficial owners, and screen them against updated sanctions lists. Doing this manually for a global supplier base is a recipe for oversight.

Preparing for Automation

Before setting up an automated UBO screening system, ensure you have these components ready:

Data Infrastructure:

• A centralized repository for third-party records, not scattered across various departments.
• Structured fields for ownership data: percentage ownership, individual names, and entity relationships.
• API access or integration capability with your existing vendor management or ERP system.

Regulatory Clarity:

• A written policy defining when UBO verification is required.
• Documentation of applicable sanctions regimes: OFAC lists, Bureau of Industry and Security controls, and jurisdiction-specific restrictions.
• Clear ownership threshold definitions, possibly lower than 50% based on your risk tolerance.

Team Roles:

• A designated owner for UBO data quality, typically in third-party risk or compliance.
• A technical resource to configure screening rules and manage vendor integrations.
• An escalation path for hits: who reviews, approves exceptions, and documents decisions.

Vendor Evaluation Criteria:

• Does the solution update sanctions lists automatically?
• Can it handle complex ownership chains?
• Does it provide audit trails showing when records were screened and what lists were checked?

You don't need a finished Third-Party Risk Management (TPRM) program to start. You need clean data fields and a vendor that can work with what you have.

Implementing Automation

Step 1: Map Your Onboarding Workflow

Document every point where you collect counterparty information. Identify where UBO questions currently appear and where they should be added. Insert UBO data collection at onboarding, not after contract signature. Your vendor intake form should request:

• Full legal names of individuals owning 25% or more.
• Percentage ownership for each individual.
• Citizenship and residency for each beneficial owner.
• Corporate structure diagram for entities with complex ownership.

Step 2: Configure Automated Screening Rules

Work with your compliance technology vendor to set up screening parameters:

• Define which sanctions lists to check.
• Set match sensitivity thresholds.
• Configure screening triggers: new vendor onboarding, ownership change notification, scheduled re-screening intervals.

Step 3: Integrate UBO Screening into Your System

If you use a vendor management platform, configure it to block progression through onboarding stages until UBO screening clears. A typical integration workflow:

• Vendor submits ownership data through intake form.
• System sends UBO names to screening vendor via API.
• Screening results return quickly.
• Clear results allow vendor record to advance; hits trigger a review queue.

If you don't have vendor management software, build a lightweight workflow in your existing tools.

Step 4: Build Your Hit Resolution Process

Not every sanctions list match is a true positive. Document your process for investigating and resolving hits:

• Tier 1 review: Compliance analyst checks for obvious false positives.
• Tier 2 review: If uncertain, escalate to senior compliance or legal counsel.
• Document every decision: why you cleared a potential match or rejected a vendor.
• Maintain a hit log showing date of screening, result, reviewer name, and resolution.

Step 5: Establish Re-Screening Cadence

Sanctions lists change constantly. Set automatic re-screening intervals based on vendor risk tier:

• High-risk vendors: weekly or monthly.
• Medium-risk vendors: quarterly.
• Low-risk vendors: annually, or triggered by ownership change notifications.

Configure your system to flag when vendor ownership data hasn't been updated in 12 months.

Validation: Ensuring It Works

Run these tests after implementation:

Test 1: Known Entity Check Manually input a known sanctioned entity in a test environment. Verify the system flags it and routes it to your review queue.

Test 2: Ownership Chain Test Create a hypothetical vendor with a multi-tiered ownership structure involving a sanctioned individual. Your system should aggregate that ownership and flag the indirect relationship under the OFAC 50 Percent Rule.

Test 3: Update Latency Test Check when your vendor's sanctions list data was last updated. It should show a recent timestamp.

Test 4: Audit Trail Review Pull a random sample of vendor records. Verify you can see:

• Date and time UBO screening was performed.
• Which lists were checked.
• Match results.
• If hit: resolution notes and approver name.

Maintenance and Ongoing Tasks

Automation requires ongoing attention. Schedule these activities:

Monthly:

• Review hit resolution log for patterns.
• Check vendor performance metrics: what percentage of new vendors have incomplete UBO data?

Quarterly:

• Audit a sample of cleared vendors to verify screening.
• Review re-screening intervals.
• Update your sanctions list coverage as new regulatory requirements emerge.

Annually:

• Reassess vendor risk tiers.
• Review and update your UBO policy.
• Conduct a gap analysis: are there third-party categories you're not screening?

As-needed:

• Trigger immediate re-screening when sanctions lists are updated with significant additions.
• Re-screen when a vendor notifies you of an ownership change.

Your compliance technology vendor should provide dashboards showing screening coverage, hit rates, and resolution times. If you lack visibility into these metrics, you can't demonstrate due diligence to regulators.

Manual UBO screening doesn't scale and can't keep up with regulatory changes. Automation isn't about eliminating human judgment. It's about focusing that judgment on genuine risks instead of repetitive data checks that software handles better.