August 6, 2026

Sanctions Screening False Positives: Why 95% of Hits Are Noise

Axle Team

Key takeaways

Research cited by LexisNexis Risk Solutions puts sanctions screening false positive rates at 95% or more at many institutions — for every hundred alerts, only a handful involve a real sanctions nexus.
The noise is structural, not a tuning bug: fuzzy matching, expanding lists, common names, and thin identifying data in payment messages all inflate alert volume.
Regulators do not expect zero false positives. The Wolfsberg Group treats an alert as the start of an investigation, not a finding — what examiners expect is documented, risk-based decisions about match rules and suppression.
Threshold tuning plateaus quickly. Durable reduction comes from better reference data, governed suppression rules, and automating the adjudication evidence itself — not from loosening the net.

Sanctions screening false positives are alerts where a customer or payment matches a sanctions list entry but, on review, is not the listed party. Industry research puts false positive rates at 95% or more at many institutions. The noise comes from fuzzy matching, common names, growing lists, and thin identifying data — which means screening teams spend nearly all of their review time clearing hits that were never real risk.

Why sanctions screening false positives dominate alert queues

A sanctions filter has one job: never miss a true match. Every design choice that serves that goal — looser match thresholds, transliteration handling, screening more fields, screening more lists — buys recall and pays for it in precision. That trade is deliberate, and the industry bodies that set screening expectations are explicit about it.

The Wolfsberg Group's guidance is blunt about what an alert actually is:

"The generation of an alert as a result of the process of screening is not, by itself, an indication of sanctions risk. It is the first step towards detecting a risk of sanctions exposure, which can be confirmed or discounted with additional information to evaluate whether the similarities in the text reveal a true sanctions match."
— Wolfsberg Group, Guidance on Sanctions Screening (2019)

In practice, "the first step" is where the cost lives. Almost every alert requires a human to confirm or discount it, and almost every alert is discountable. LexisNexis Risk Solutions, citing KPMG research, describes the scale plainly:

"It is not unusual to see institutions struggling under false positive rates of 95% or more."
— LexisNexis Risk Solutions, Entity Resolution: Redefining the False Positive Problem

At that ratio, the screening program is not primarily a detection function. It is a clearing function — an operation whose main output is documented evidence that hits were not matches. That framing matters, because it changes what you should optimize.

The four root causes of screening noise

Fuzzy matching casts a wide net by design. Sanctioned names arrive transliterated from Arabic, Cyrillic, and Chinese, with aliases and spelling variants. A filter tuned to catch every rendering of a name will also catch thousands of unrelated customers who share it.
Lists keep growing and overlapping. Most institutions screen OFAC's SDN list plus EU, UN, and UK lists, and often internal watchlists on top. Every added entry multiplies the combinations that can trip a hit, and designation activity has been heavy since 2022.
The data being screened is thin. A payment message may carry little more than a name and a partial address. Without secondary identifiers, the filter cannot discount a near-match, so it alerts.
One-size-fits-all configuration. Running identical thresholds across every list, jurisdiction, product, and customer segment guarantees that the settings needed for your riskiest corridor generate noise everywhere else.

Wolfsberg makes the point about identifiers directly — the fields that distinguish a true match from a false one are often the ones missing from the screened record:

"Date of birth, for example, is relevant as a distinguishing factor to assess a true match from a false match on an individual and might be used for screening in combination with another attribute, such as name."
— Wolfsberg Group, Guidance on Sanctions Screening (2019)

How to reduce sanctions screening false positives without loosening the net

The goal is not a lower alert count for its own sake — it is fewer alerts that a human never needed to see, with a documented rationale for every alert you chose not to generate. A workable sequence:

Measure alert quality by rule, list, and segment. An aggregate false positive rate hides the handful of rules producing most of the noise. Attribute every cleared alert to the rule and list entry that fired it before changing anything.
Fix reference data before touching thresholds. Populate dates of birth, countries, and entity identifiers in customer records, and standardize name fields. Better inputs discount near-matches automatically; threshold changes just move the trade-off.
Use governed suppression. Wolfsberg explicitly recognizes the "use of suppression rules or 'Good Guys' lists to manage common false positive alerts requiring unnecessary manual review." The governance is the hard part: document the rationale, set an owner, and revalidate entries on a schedule — suppression lists decay as customers and list entries change.
Risk-tier the configuration. Which lists apply to which populations, exact versus fuzzy per list, and thresholds per product are all legitimate risk-based decisions — provided they are documented, tested, and supported by analysis.
Automate the adjudication evidence, not just the ranking. Scoring alerts by likelihood only reorders the queue. The durable win is producing the identifier comparison, the list-entry context, and a written disposition rationale for each hit — so humans review conclusions instead of assembling them.

A practitioner's note on where the time actually goes

Watch an L1 screening analyst work and a pattern shows up fast: the decision is quick, the documentation is slow. Most clears rest on two or three fields — a date-of-birth mismatch, the wrong country, an obvious entity-type mismatch — and the analyst has effectively decided within seconds of opening the alert. The next several minutes go to screenshots, copied list-entry details, and a narrative written to survive QA and an examiner. Alert prioritization tools attack the fast half of that job. If your automation does not draft the disposition evidence itself, it is not touching most of the cost.

Where AI agents fit

This is the shape of work AI agents handle well: high-volume, evidence-heavy decisions with clear discounting logic. Axle's screening agent Baley adjudicates sanctions and watchlist hits the way an analyst does — comparing identifiers, weighing list-entry context, and writing a documented disposition for every alert — while escalating genuine matches to your team. If you want to size what clearing your queue is costing you today, run the numbers in the ROI calculator, or start with the AI readiness playbook to see where agents fit your screening stack.

FAQ

What is an acceptable false positive rate in sanctions screening?

No regulator publishes a target rate. Examiners assess whether you understand your alert volumes, can explain your configuration choices, test the filter regularly, and clear alerts with documented rationale. An unusually low rate deserves scrutiny too — it can signal over-suppression or thresholds set past your risk appetite rather than a well-tuned filter.

Can we just raise match thresholds to cut alert volume?

Thresholds are a legitimate risk-based lever, but they carry real miss risk and must be defended with analysis and testing. Wolfsberg's guidance notes that "sanctions screening can never detect every possible sanctions risk due to the wide range of variables in which a string of text could be altered and still convey the same meaning" — the question examiners ask is whether your settings reflect a documented risk decision, not whether they are strict.

Do false positives themselves create regulatory risk?

Not directly — the backlog they create does. Aged alerts, inconsistent dispositions, and pressure to clear quickly are what surface in exams and enforcement actions. A queue that is 95% noise makes all three more likely, which is why false positive reduction is a control issue and not just a cost issue.

If your team is spending its days proving hits are not matches, see how Baley handles sanctions and watchlist adjudication end to end.

Sanctions Screening False Positives: Why 95% of Hits Are Noise

More from the blog