A screening report with no matches says one of two things. Either none of your customers is designated, or your screening did not look where the designated customer sits. The report reads the same either way.
Most sanctions programs can show that screening ran. Far fewer can show that it covered everyone it should have, against the current list, with settings someone chose on purpose, and that every potential match was worked to a decision. That second set of facts is what makes a program defensible.
The clock is 24 hours
Kenya’s targeted financial sanctions regulations define “without delay” precisely: within 24 hours of a designation. That turns a vague duty into a measurable one.
This guide’s position: the test of a sanctions program is whether the institution can show, for any designation, that it re-screened its whole relevant population within 24 hours, worked every potential match to a decision, and froze and reported where it had to. A program that cannot produce that evidence for a recent designation is not proven, whatever its match rate.
| Source | What it requires |
|---|---|
| Prevention of Terrorism (Implementation of UNSC Resolutions on Suppression of Terrorism) Regulations 2024, reg 2 | “Without delay” means within 24 hours of a UN Security Council or Sanctions Committee designation, or of a designation by the Counter Financing of Terrorism Inter-Ministerial Committee |
| Same, regs 6(2) and 7(1) | Freeze without prior notice all funds or other assets owned or controlled by the designated person, wholly or jointly, directly or indirectly, including assets derived from them and those of persons acting on their behalf; make no funds or services available |
| Same, reg 9 | Report the freeze or action taken to the Committee within 24 hours, including attempted transactions |
| Prevention of Terrorism (Implementation of UNSC Resolutions on Prevention, Suppression and Disruption of Proliferation Financing) Regulations | Same 24-hour definition for proliferation financing designations; report frozen assets or action taken within 24 hours |
| Both sets, penalties | Fine up to KES 3 million or up to seven years’ imprisonment on conviction; the Financial Reporting Centre or the supervisory body may also impose administrative sanctions |
| FATF, June 2026 | Kenya’s action plan item 6: bring the TFS framework into compliance with Recommendation 6 and implement it effectively |
The reach of regulation 7 matters most for screening design. A freeze covers assets owned or controlled indirectly and jointly, and those of anyone acting on a designated person’s behalf. A program that screens only account holders cannot meet that standard.
Draw the perimeter first
Screening is only as complete as the population fed into it. List every population, then check each one is actually reaching the screening engine.
| Population | Screen at onboarding | Re-screen on every list change | Where it is usually missed |
|---|---|---|---|
| Customers, new and existing | Yes | Yes | Dormant and closed-with-balance accounts left out of the batch |
| Beneficial owners, directors, signatories, guarantors | Yes | Yes | Held in documents or a separate system, never loaded as screenable records |
| Payment counterparties (originators, beneficiaries) | Per transaction | Not applicable | Free-text fields not screened; incoming payments screened less strictly than outgoing |
| Agents, merchants, correspondents | Yes | Yes | Onboarded by business teams outside the compliance workflow |
| Vendors and other payees | Yes | Yes | Procurement and payroll never connected to screening |
Five records that prove it
- Population reconciliation. The count of records screened agrees with the count in the source systems, for each population, on each run. Differences are explained.
- List log. For every list update: when it was received, when it was loaded, and when the full re-screen finished. This is the record that shows the 24-hour clock.
- Configuration record. The matching settings in use, why they were chosen, who approved them and when they were last tested. A setting nobody can explain is a setting nobody chose.
- Disposition log. Every potential match, who reviewed it, the evidence used to discount or escalate it, and the time taken.
- Freeze and report log. Every true match: the time of the freeze, what was frozen, the report to the Committee and its time.
If any one of these cannot be produced for the last designation, the program cannot prove it met the deadline.
Test that it finds what it should
The records show the process ran. Only a test shows it works. Run a seeded test at least once a year and after every configuration change:
- Build a test file of names from the current lists, with realistic variations: spelling variants, transliterations, reversed name order, missing middle names, initials, and entity names with and without legal suffixes.
- Run it through the production configuration for each channel: onboarding, batch re-screening and payments.
- Record which names generated an alert and which did not. Every miss is a finding with an owner and a fix.
- Repeat the test on the populations that sit outside the core system, such as beneficial owners, agents and vendors.
A program that finds 100% of exact names and misses common transliterations is tuned for a test, not for the customers it serves.
The questions I keep asking
A clean screening report is not, on its own, evidence that sanctions exposure is controlled. Overseeing AML/CFT/CPF compliance, I have returned to the same questions again and again. Was every customer, connected party and transaction in scope screened? Was the customer and ownership data good enough to match against? Were list updates loaded in time? Was matching sensitivity set deliberately? Was every potential match worked to a decision? A system that generates alerts has not proved its coverage, and few or no matches prove nothing if completeness was never tested. The programs I would defend can show the population screened, the lists and configuration applied, the screening dates, the alert investigations, the escalation decisions and any restriction imposed. The test is whether the institution can show it screened the right exposures, found the relevant matches and acted on them.
Start with the last designation
Pick the most recent UN or domestic designation and try to reconstruct the 24 hours that followed it, using only records you already hold. Where the trail breaks, you have found the gap to fix first.
Riskill’s Sanctions & TFS Review Pack includes a screening perimeter checklist, an alert quality review, a list governance matrix and an escalation playbook: riskilled.com/toolkits. For an independent sanctions and TFS program review, including a seeded test, talk to the advisory desk: riskilled.com/engage.