How to Handle PEP and Adverse Media Screening When Data is Limited

One of the most common challenges in AML screening is dealing with PEP and adverse media hits where the underlying data is incomplete. Government lists often have missing dates of birth, incomplete addresses, and limited identifying information - especially for lower-profile entries like family members of PEPs or former political figures.

This creates a real problem: your screening tool flags a name match, but there isnt enough data on either side to confidently confirm or deny the hit. You end up with a pile of alerts that are too weak to escalate but too risky to just close without documentation.

A few specific scenarios that come up regularly:

• Your client shares a common name with a PEP entry that only has a name and country listed. No DOB, no address, no additional identifiers.
• A family member PEP has almost no public information available. You cant find anything online to confirm or deny whether your client is related.
• Adverse media hits on a partial name match where the article is about someone in a different country or industry but the name is close enough that your tool flagged it.
• Your internal data on the client is solid (full PII from credit bureau) but the list data is sparse, so theres nothing meaningful to compare against.

How do you handle these in practice? Is it reasonable to set a minimum number of matching criteria before treating something as a true hit, or is that too rigid? Where do you draw the line between reasonable caution and speculation?

Looking for practical approaches to triaging these alerts efficiently without either over-escalating everything or closing genuine risks.

This is one of those areas where theres no perfect solution, but there are practical approaches that work well enough to satisfy regulators without drowning your team in false positives.

The core issue is that PEP and adverse media lists are inherently incomplete. List providers compile data from public sources and government records, and for a lot of entries especially family members, former officials, and entities in countries with limited public records, the available information is just a name and maybe a country. That's not going to change anytime soon, so the question is how to work with it.

Setting a fixed minimum matching criteria (like "3 or more fields must match") sounds appealing but it creates blind spots. A lot of PEP entries only have one or two identifiers available. If you require three matching fields to treat something as a potential hit, you're effectively excluding a big chunk of your list from ever being flagged. A regulator will not look kindly on that.

What works better is a weighted approach to alert triage. Not all matches are equal and your process should reflect that.

Strong matches: full name plus DOB, or full name plus address, or full name plus a known association (same company, same industry, same jurisdiction as the listed entity). These get a full investigation.

Medium matches: full name plus country or nationality, but no other identifiers. These get a quick investigation. Check whether the listed entitys profile (role, industry, age range if estimated from career timeline) is consistent with your client. If nothing connects them beyond the name, document what you checked and close it.

Weak matches: partial name match, common name, no other identifiers on either side. These get a documented review but not a full investigation. Look at what information is available, note what isn;t, and if there's nothing to connect the two beyond a partial name similarity, close it with your rationale written down.

For family member PEPs with almost no public information, the practical approach is:

• Check if your clients declared occupation, industry, or location has any connection to the PEPs country or sphere of influence
• Check the age range. A 25 year old client matching a PEP family member who would be in their 60s based on the PEPs career timeline is probably not the same person
• Check whether the surname is common in the relevant country. A name like "Smith" or "Kim" matching a PEP family member is far less meaningful than an unusual surname
• If after these checks you cant find any connection, document your reasoning and close it

For adverse media specifically, context matters more than name similarity. An article about a fraud case in Brazil involving someone named "Carlos Silva" shouldn't keep you up at night if your client is a Carlos Silva who lives in Canada and works in accounting. Check the article, check your client, if the facts clearly don't align then close it. The risk isn't in closing false positives, its in closing them without documenting why.

On the "reasonable measures" standard: regulators want to see three things. First, that you're using a reputable screening tool with up to date lists. Second, that you have a documented, consistent process for reviewing and dispositioning alerts. Third, that you keep records of your decisions and rationale. If you have all three, you're meeting the standard even if some of your individual calls turn out to be wrong in hindsight.

One more thing worth mentioning: the quality of your screening tool matters a lot here. Tools that support phonetic matching, transliteration handling, and configurable thresholds generate fewer garbage alerts in the first place. If you're spending most of your time on obviously irrelevant hits, the problem might be upstream in your tool configuration rather than in your triage process. Adjusting your fuzzy matching sensitivity or adding secondary filters (country, DOB range) at the screening stage can cut your false positive volume significantly without increasing your risk.