Crypto Watchlist and PEP Screening Explained
Sanctions screening is only one list. PEP, adverse media and entity screening carry different obligations and different false-positive problems — here is how each works in crypto.
Most teams say "screening" and mean sanctions. Sanctions is the hard legal prohibition, so it gets the attention. But a compliance programme is assessed on several distinct screening obligations, each with its own list, its own risk treatment and its own failure mode.
Confusing them is common and expensive — usually in the form of a false-positive rate nobody can work through.
The four types
1. Sanctions screening
Binary and absolute. If a party is designated, you may not transact. There is no risk-based override and no commercial judgement to exercise. Lists come from OFAC, the EU, the UN and national regimes.
Failure here is a legal breach, not a control weakness. Covered in depth in best sanctions screening software.
2. PEP screening
Politically exposed persons — senior public officials, their close associates and family members. Being a PEP is not a prohibition. It triggers enhanced due diligence: source of wealth, source of funds, senior sign-off, more frequent review.
This is where teams most often go wrong in both directions. Some block PEPs outright, which is over-compliance that loses legitimate customers. Others flag and ignore, which is under-compliance. The correct answer is a documented EDD process with a named approver.
PEP status is also tiered — a head of state and a municipal official carry different risk — and it persists for a period after leaving office. Any tool that returns a flat yes/no is too blunt.
3. Adverse media
Negative news screening for financial crime, fraud, corruption or organised crime. It is the fuzziest category and generates the worst noise: common names, stale articles, and stories where your customer is the victim rather than the perpetrator.
Look for structured classification by allegation type and recency, not a keyword search over a news index.
4. Entity and UBO screening
When onboarding a business you screen the company, its directors, and its ultimate beneficial owners. The chain matters — a clean company owned through two holding structures by a sanctioned individual is a sanctioned exposure.
This is the hardest to automate because ownership data quality varies enormously by jurisdiction. Covered in KYB compliance requirements and best KYB software for crypto.
Why crypto makes this harder
Traditional finance screens names against lists. Crypto has to screen names and addresses, and the two rarely reconcile.
- Address screening tells you about on-chain exposure — whether funds passed through a mixer or a designated wallet
- Name screening tells you about the customer's identity and status
A customer can clear name screening perfectly and still deposit from an address with direct sanctioned exposure. Both checks are mandatory, and they need to feed the same risk score — otherwise you get two systems with two answers and no reconciliation.
The false-positive problem
The commercial risk in PEP and adverse media screening is not missing a match. It is generating so many that the queue stops being worked.
Practical mitigations:
- Tune thresholds by customer risk. A retail user depositing EUR 200 does not need the same match sensitivity as a corporate onboarding EUR 2m.
- Use secondary identifiers. Date of birth and nationality collapse most name collisions instantly.
- Whitelist resolved matches. Once a false positive is cleared with a written rationale, it should not resurface every cycle.
- Measure the rate. If more than roughly 95% of alerts are false, the configuration is wrong, not the analysts.
What auditors ask for
- Which lists you screen, from which provider, refreshed how often
- Your match threshold and the rationale for it
- Evidence of periodic re-screening, not just at onboarding
- Written disposition for every alert — including cleared ones
- Your EDD process for confirmed PEPs, with the approver named
- How address screening and name screening reconcile into one customer risk score
That last point is the one most often missing.
Where it fits
Screening is the gate. Behavioural monitoring is what runs afterwards — see crypto transaction monitoring software. Identity verification comes first, in best crypto KYC providers. And if you are starting with no budget, free crypto sanctions screening sets out what that does and does not cover.
The full programme is in our crypto AML compliance guide. If you are building toward authorisation, the cost of all this together is broken down in CASP licence cost in 2026.
