Sanctions screening and transaction monitoring: what is the difference?

	Sanctions screening	Transaction monitoring
The question it answers	Is this person, entity or payment party on a sanctions list, or owned or controlled by someone who is?	Is this customer's activity unusual compared with what we expect, or does it fit a known suspicious pattern?
What it compares	Names and identifying data against lists of designated parties	Transactions and behavior against expected activity, scenarios and typologies
When it runs	At onboarding, when customer data or lists change, and on payments as they are made	Continuously or in batches after activity takes place
What a hit looks like	A possible name match that must be confirmed or discounted	An alert that must be investigated, and may lead to a suspicious transaction report
Consequence of a miss	Dealing with a designated party, which can be a serious breach	Missing laundering or terrorist financing that should have been reported
Typical weakness	Poor name matching, slow list updates, missing owners and controllers	Thresholds that no one can justify, poor data, no testing below the line

Where they overlap

Both depend on good customer data. Weak beneficial ownership information undermines both.
Both create alerts that need trained reviewers, quality assurance and clear escalation routes.
Both can generate large numbers of false positives, which cost money and can hide real risk.
Payment screening and payment monitoring often sit in the same workflow, which is why the two get confused.

How to test each

Screening

Which lists are covered, and how fast are changes applied?
Does matching find variations of known names, and is that tested with sample names?
Does it cover owners, controllers and payment parties as well as customers?
Can analysts show why each alert was cleared?

Monitoring

Does every high risk in the risk assessment map to at least one scenario, or a documented accepted gap?
Does the data feeding it reconcile to the source systems?
Has the threshold logic been tested both above and below the line?
Is the quality of alert decisions sampled and reported?

Want to see what each one costs you? Try the free transaction monitoring and sanctions screening cost calculators.

Common mistakes

Assuming that one system covers both.
Accepting vendor defaults without tuning and testing.
Measuring success by alert closure speed instead of by what was found.
Treating tuning as a one-off project.

Related terms

Sources

Sources last checked: 5 October 2026. General information, not legal, regulatory or professional advice. Requirements change, so confirm the current text before relying on any point. Spotted an error? Tell us.