Adverse Media Screening: A Practical Guide
Adverse media screening is the control most likely to be bought as a subscription and least likely to be operated as a process. A firm switches on a provider, alerts begin arriving, and within weeks the output is being cleared in bulk because nobody has defined what a relevant hit actually looks like.
This guide covers what the obligation is, how to scope screening so it produces usable output, and how to handle the hits that matter.
Where the Obligation Comes From
There is no standalone rule that says “perform adverse media screening”. The obligation is implied by the requirement to apply risk-sensitive customer due diligence, to understand the purpose and nature of a relationship, and to apply enhanced measures where risk is higher under the Money Laundering Regulations 2017.
Our KYC guide covers onboarding and the risk-based approach more broadly; this page deals with adverse media as a control in its own right.
In practice, a firm that has not looked for publicly available negative information about a higher-risk customer will struggle to say it understood who it was dealing with. That is why screening is effectively expected even though it is not separately mandated, and why its scope is a judgement rather than a prescribed list.
Scoping: Who Gets Screened, and Against What
The two scoping decisions determine whether the control works.
Who. At minimum, customers assessed as higher risk, politically exposed persons and their associates, and beneficial owners. Many firms extend to all customers at onboarding with a lighter standard. Screening everyone against everything produces volume without insight; screening nobody produces nothing. The scope should follow the firm’s risk assessment and be written down.
Against what. This is where firms are vaguest. Relevant categories usually include financial crime allegations, fraud, corruption, sanctions-adjacent reporting, regulatory enforcement and serious criminality. Categories that are not relevant to money laundering risk — civil disputes, employment claims, general negative commentary — produce noise unless the firm has a specific reason to care.
A firm that cannot state which categories it screens for has not scoped the control; it has subscribed to one.
The False Positive Problem
Adverse media generates far more false positives than sanctions screening, for a structural reason: name matching against unstructured news is inherently loose, and common names generate hits constantly.
Three measures reduce it. Match on more than a name — date of birth, nationality, place of residence or business, where available. Tune the categories so irrelevant subject matter never reaches the queue. And set a defensible relevance threshold, recorded in policy, rather than leaving each reviewer to decide what counts.
The failure mode worth guarding against is volume-driven desensitisation. A queue of hundreds of hits, nearly all irrelevant, trains reviewers to clear quickly — and the one that mattered gets cleared with the rest. If your discounting rate is near total, the problem is the configuration, not the reviewers.
Assessing a Hit
When something relevant surfaces, the assessment needs to answer four questions in order.
Is it the same person? Identity confirmation comes first, and a hit that cannot be attributed with confidence should be recorded as unresolved rather than silently discounted.
What is actually alleged, and by whom? There is a meaningful difference between a regulatory enforcement outcome, a criminal conviction, a charge, an allegation in a reputable publication and an anonymous blog post. The weight given should reflect the source.
How old is it, and what happened since? An allegation from fifteen years ago that went nowhere carries different weight from a recent one, and the firm should look for the outcome rather than stopping at the headline.
Does it change the risk assessment? This is the question that matters and the one most often skipped. A hit that is confirmed, serious and recent should feed the customer risk rating and may trigger enhanced due diligence or escalation.
Recording the Decision
The single most common weakness in file reviews is a cleared alert with no reasoning.
A usable record states what the hit was, whether it was the customer, what the firm concluded, and why. Two sentences is often enough. What is not enough is a status field changed from “open” to “closed” by a named reviewer with no narrative, because that records that someone looked without recording what they thought.
This matters disproportionately because adverse media decisions are judgement calls. Where the firm decides a confirmed allegation does not change its position, that is a legitimate conclusion — but it needs to be visibly a conclusion rather than an omission.
Choosing and Testing a Provider
Providers differ more than their marketing suggests, and the differences matter for specific firms.
Coverage is the first question: which languages, which jurisdictions, which source types, and how far back does the archive run. A firm with customers concentrated in a particular region needs to know whether local-language sources are covered, because an English-only database will look clean for reasons that have nothing to do with the customer.
Structure is the second. Some providers deliver curated, categorised profiles; others return raw article matches. Curated data reduces review time and introduces a dependency on someone else’s categorisation judgement. Neither is wrong, but the firm should know which it is buying.
The useful test before signing is to run a small set of known cases through it — including, if possible, a customer the firm already knows has adverse history. A provider that misses a case you already know about has told you something important.
What a Reviewer Will Ask
When adverse media comes up in a file review or supervisory conversation, the questions are consistent.
Who is in scope and how did you decide? What categories do you screen for? Show me your discount rate and explain it. Here is a cleared alert — walk me through why. When did this customer last get rescreened, and what triggers an off-cycle review?
The discount rate question is the sharpest. A firm clearing ninety-nine per cent of alerts is not necessarily wrong — that can be a realistic ratio — but it should be able to explain why that number is what it is, and show that the remaining one per cent received genuine attention.
Ongoing Screening
Screening at onboarding only captures what existed then. Risk changes, and so does the news.
Most firms operate periodic rescreening tied to the customer risk rating, with higher-risk relationships screened more often, plus event-driven rescreening when something changes — a new beneficial owner, a change in the customer’s business, a transaction that does not fit the expected pattern.
Continuous monitoring is available from most providers and shifts the burden from scheduling to alert handling. It is a better control where the firm has capacity to handle the flow, and a worse one where it does not, because an unworked continuous queue is more damaging than a periodic review that actually happens.
Where It Fits Alongside Other Screening
Adverse media sits beside sanctions and PEP screening and does a different job. Sanctions screening tests against a definitive list with a binary answer. PEP screening identifies a status. Adverse media is open-ended and evaluative.
Firms sometimes run all three through one tool and treat the output as one queue, which obscures the fact that a sanctions match is a hard stop while an adverse media hit is the start of an assessment. Our guide to sanctions screening covers the first; the distinction is worth preserving in both policy and workflow.
Who Owns It
The framework sits with the MLRO, with alert handling usually performed by financial crime or onboarding staff under that oversight.
The resourcing point is that alert review is genuinely time-consuming and scales with customer numbers rather than with revenue. Firms that size a financial crime function without allowing for it find that the queue becomes the work, and that the periodic rescreening cycle is the first thing to slip.
Frequently Asked Questions
Do we have to screen every customer?
Not necessarily. Scope should follow the firm’s risk assessment, with higher-risk customers, PEPs and beneficial owners as the minimum.
How far back should we look?
There is no fixed period. Older material carries less weight unless it is serious or unresolved, and the firm should look for what happened subsequently rather than stopping at the original report.
Is a single negative article enough to decline a customer?
It may be, depending on what is alleged, by whom and how recently. The firm should reach a documented view rather than treating any hit as automatically disqualifying or automatically irrelevant.
Can we rely entirely on a screening provider?
No. The provider supplies data; the assessment, the scoping and the decision remain the firm’s responsibility.
Hiring an MLRO?
We place the people who own this function
MLROs and deputy MLROs on a permanent, fractional and interim basis across payments, lending, wealth and cryptoasset firms. Tell us about the volumes and the risk profile.
Related guides and services
Practice area
Wider compliance
About the author
Adrian Lawrence FCA
Adrian is the founder and Managing Director of FD Capital. A Chartered Accountant and ICAEW Fellow, he became a finance director at 28 and has spent more than 25 years at C-suite level, including as finance director of a listed company and of a private equity backed management buy-out. Every search is run by our specialist team, with Adrian overseeing each mandate.
Start a search
Tell us about your finance hire
Share a few details about your business and the role. A member of our team will review your brief and come back to you to talk it through.
- Reply within one working day, from a consultant who places finance leaders every day
- Confidential from the first conversation, with no obligation to go ahead
- Shortlists typically within three to seven days, faster for urgent interim cover
Your details are used only to respond to your enquiry.