Flagged by a Private Risk Database? What It Means

What a private risk database is

Banks, payment processors and other regulated firms screen customers against lists of sanctioned persons, politically exposed persons (PEPs) and negative news. Some firms build that screening on commercial databases such as World-Check. A commercial database is a product that a company compiles and sells. A government does not run it.

LSEG describes World-Check as “a risk intelligence database that supports Know Your Customer (KYC)” and anti-money-laundering screening. It says the database “brings together structured records from reputable public-domain sources.” Adverse media, sanctions, PEPs and law and regulatory enforcement are among the risk topics it covers.

No bank must use one particular database. The AML program rule for banks requires a system of internal controls, independent testing, a responsible officer, training and risk-based procedures for ongoing customer due diligence. It does not name or require a specific vendor (31 CFR 1020.210(a)(2)).

Why a name can appear

A record can come from public sources such as news, court or regulatory material. A person can also be matched by name to someone else. OFAC tells people who are mistaken for a listed person to contact its Compliance Hotline, which shows that mistaken identity is a known problem.

A listing is a screening flag, not a finding. LSEG says on its World-Check page that inclusion “does not mean that a person or organisation poses a risk” and that customers “review possible matches and make their own decisions.” A closed account or a delayed payment therefore comes from the customer’s own risk decision.

For PEPs, the federal banking agencies and FinCEN said in a joint statement of 21 August 2020 that PEP relationships present varying levels of money-laundering risk. They also said there is no supervisory expectation for banks to have unique, additional due-diligence steps for PEP customers.

How to ask whether you are listed

These steps use LSEG’s World-Check process. Other operators publish their own request processes.

1. Find out which product the bank or firm used. Ask in writing. The firm may not tell you.
2. Send a data subject access request to the operator. LSEG provides an online form on its “Am I on LSEG World-Check?” page, verifies your identity by e-mail and says it usually answers within 10 business days.
3. If you are listed, ask the operator to update, correct, restrict or remove the record, and send supporting documents. LSEG says it may ask for supporting information, aims to respond within 10 working days and gives reasons for its decisions. It also says there are limits to these rights and that it makes no charge for these requests.
4. Keep every response. Tell the bank or firm that you have asked the operator to correct the record.

Private database or government list?

A government sanctions list is a different matter. OFAC publishes the SDN List and other sanctions lists and offers a Sanctions List Search tool to check a name.

If a person is on an OFAC list, the person can petition OFAC for reconsideration under 31 CFR 501.807, through the OFAC Reconsideration Portal. The petition must rest on one of two grounds: a change in circumstances, or an insufficient basis for the original listing, such as mistaken identity.

That process is only for persons or property on an OFAC list. It does not remove a record from a private database. See OFAC and sanctions.

What to prepare

A bank may not tell you which database or which result it relied on, so ask in writing and keep the answer. For account closures in general and what can be corrected, see Bank closures and AML records. Gather these items before you contact the operator or the bank:

• Your full legal name with spelling variants and your date of birth.
• Identity documents and proof of address.
• Records that explain the matter behind the entry, such as a dismissed court case, a correction of a news report or company records.
• Letters from the bank about the closure or delay, with dates.