Banking · payments and financial crime
Held payment: clear and send Payment 7730, €18,500
A European bank screens 8 million outgoing cross-border payments a year against sanctions lists. About 3% stop on a possible match, and the great majority of those are false positives. An agent reviews the held payments and, within a mandate owned by the Head of Financial Crime Operations, clears the hits that fall in a false-positive category approved in the bank’s screening policy; the payment engine sends them.
Follow it through the essentials (part two)Turn the map to this firm (part four)Walk its pathway on the explorer
Today, with a person
A trained analyst compares the hit with the list entry, clears it or escalates it, and writes down why; higher-exposure hits are reviewed by two people. A possible true match goes to level two, and the funds of a confirmed match are frozen and reported to the national sanctions authority. Quality sampling decides who may clear what.
The question for the room
Would you let this agent send a held €18,500 payment without individual human approval?
The day, in the record
- 09:12 Payment 7730 held · €18,500 to B-311, a ship-supply company banking outside the EU · partial name match to list entry EU-2291, a different company
- 09:13 Identifiers compared with the entry: registration number, address, and country rule it out
- 09:14 Clearance proposed · false positive in approved category FP-2 · declared basis: list as consolidated 07.10, 17:30 · operation P7730-C1
The mandate FC-11 · version 11.3 · since 01.07.2026
| Owner | Head of Financial Crime Operations |
| Agent | screening-agent-02, acting for Financial Crime Operations |
| Action | clear hits in the false-positive categories approved in the bank’s screening policy, and request sending through the payment engine |
| Level | decide for approved false-positive categories at lower exposure; every other hit goes to a trained analyst, and higher exposure to two |
| Limit | €25,000 per payment · €5m per day across the deployment |
| Conditions | approved category (partial name match only) · at least two identifiers that rule the entry out · the list in force on the day of sending, as known at the moment of sending · no high-risk jurisdiction on the route · no freeze on the account · 5% of clearances sampled by an analyst |
| Review trigger | three referrals for one reason in one day (R-07); a confirmed match on a stale list narrows at once (R-07S) |
| Revocation | the owner, the second line, or a revocation rule |
| Challenger | Head of Financial Crime Compliance, the second line |
| Restore | after 30 clean clearances from a test chosen for the cause, on two signatures, the owner’s and the second line’s; the second line may hold it |
| Expiry | 31.12.2026, or the next release of the agent, whichever comes first; renewed on the evidence of the quarter |
| Deputy | the Head of Payment Operations signs in the owner’s absence, within the same limits |
The knowledge that applies
Which list applies? a public authority’s sanctions list; fixed by the day of sending, as known at the moment of sending; owned by the screening data team.
- consolidated 07.10, 17:30 the list in force on 08.10 · B-311 not listed
- act of 09.10 designates B-311 as entry EU-2318 · in force on 09.10 · published 11:00 · in the bank’s list service 11:15
What applies: sent on 08.10 → the list of 07.10 applies · sent on 09.10 → B-311 is designated, and from 11:15 the bank knows it
The agent’s screening copy refreshes every six hours. At 11:22 on 09.10 it still holds the list of 07.10, sees only the partial match to EU-2291, and clears the hit in good faith. Only the check against the bank’s list service catches the new entry before the money leaves.
The check, at the act
| Identity | screening-agent-02, acting for Financial Crime Operations |
| Release | v3.1 · approved and validated for this workflow |
| Applicable basis | the list as consolidated 07.10, 17:30, in force on 08.10 |
| Mandate | FC-11.3 active · €18,500 within €25,000 · approved category FP-2 |
| Exact action | send P7730 · €18,500 to B-311, unchanged since held |
| Current state | not sent before · no freeze on the account · before the 15:00 cut-off · €5m daily limit not reached, permits in flight counted |
Outcome: permit · sent once
The act, and the customer
The payment engine executes the act: the payment leaves the bank. The agent may not say why. It cannot send the payment: the payment engine holds the credential.
The agent can say the payment is under review and when the client will hear back. The customer asks: “Why hasn’t my payment arrived?”
The loop: One serious mistake
Rule R-07S, at once. Restored after 30.
- 09.10 11:22 Payment 7738 referred: the agent declared the list of 07.10; in the list service, B-311 has been designated since that morning. Level two confirms the match; the funds are frozen and reported to the national sanctions authority REFER · 1
One referral, and a true match. The funds are frozen before they leave. - 09.10 11:31 A confirmed match on a stale list is a serious defect. R-07S narrows FC-11 to recommend at once, without waiting for further referrals NARROW
A confirmed match on a stale list is a serious defect: the mandate narrows at once, without waiting for two more. - 09.10 12:30 Look-back: the designation applies from the start of 09.10, so every payment the agent cleared that day is re-screened against the act. None went to B-311 LOOK-BACK
The look-back covers the whole day, because a designation applies from the day of publication. - 09.10 14:10 Review FR-031: the agent’s copy refreshes every six hours, and a new act triggers nothing. The screening data team moves the refresh to the moment the list service takes in an act, and verifies 15 lookups CAUSE: SOURCE DATA
The cause is fixed at the source, by the team that owns the list copy. - 10.10 After 30 clean clearances from a test chosen for the cause, the owner and the second line sign the restored mandate, and R-07 and R-07S are re-armed. The referral remains in the record RESTORE
Thirty clean clearances from a test chosen for the cause, and two signatures, restore it. The mandate changed twice; the release never did.
One record, every reader
| Who | Asks | Reads |
|---|---|---|
| CISO security and resilience | Who acted, and was it contained? | Its own identity. One gated call, nothing sent. |
| CTO architecture | Which model, and which release? | Release v3.1, two model tiers. |
| CFO finance | What did this payment cost? | €0.27 in tokens, €6.00 in review. |
| Business owner Head of Financial Crime Operations | Who decided, and under which mandate? | Referred, then frozen by a trained analyst. |
| Second line Head of Financial Crime Compliance | Can we show why it was not sent? | Every version, on every line. |
| CRO risk appetite and the board | Did the controls hold within appetite? | Nothing sent, and the mandate narrowed within minutes. |
The record of the two acts, field by field
The fields of the record line, as part three gives them, filled for the clean act and for the referral. A field with two lines gives the agent’s line and the person’s, marked C1 and L2.
| Field | Payment 7730 · the clean act 08.10.2026 · held 09:12, cleared 09:14, sent in the 09:30 batch | Payment 7738 · the referral 09.10.2026 · held 11:20, referred 11:22, frozen by level two at 11:31 |
|---|---|---|
| Before the act · what the check read | ||
| whenthe second the check decided, and the second the act committed | decided 08.10.2026 09:14:02 · committed 09:14:30 at the payment engine · left in the 09:30 batch to the correspondent | C1 referred 09.10.2026 11:22:05L2 decided 09.10.2026 11:31:00 · the freeze at once · reported 12:05 |
| the agent and its identitywhich agent, acting for whom, under its own identity, and how long its credential lived | screening-agent-02, acting for Financial Crime Operations · its own identity · token issued 09:12:10, valid 15 minutes | C1 screening-agent-02, acting for Financial Crime Operations · its own identity · token valid 15 minutesL2 analyst A-204, level two, Financial Crime Operations · her own login · trained in sanctions screening |
| the releasethe release id, each model by version and hash, the prompt set, the validation report | v3.1 · tier-1 model 2026.06.1 (7c41e0) · tier-2 model 2026.05.2 (e9a3b7) · prompt set screening-clear 3.1 · validated by model risk, MRV-044, 28.06.2026 | C1 v3.1 · tier-1 model 2026.06.1 (7c41e0) · tier-2 model 2026.05.2 (e9a3b7) · prompt set screening-clear 3.1L2 none · a person’s decision in the screening system |
| the basiseach claim the act relied on, its version, and its standing at that second on both axes: evidential warrant, and authority | B-311 is not a designated party · the consolidated list of 07.10, 17:30 · in force on 08.10 · warrant validated · current on 08.10 · uncontradicted · authority: the authority’s list, as the bank’s list service holds it · the screening data teamThe hit on EU-2291 is a partial name match, ruled out on registration number, address, and country · the FP-2 criteria · screening policy SP-9 §6 · the client record · warrant validated · two identifiers compared · authority: Financial Crime Compliance, the policy ownerA hit in FP-2 may be cleared by the agent at or below €25,000 · screening policy SP-9 §6, v9 · warrant foundational · in force · authority: Financial Crime Compliance | B-311 is not a designated party · declared: the list of 07.10, 17:30 · superseded by the act of 09.10, in the list service since 11:15 · warrant fails on currency · contradicted by the list service · authority: the authority’s list · the screening data teamB-311 is a designated party, entry EU-2318 · applicable: the act of 09.10, in force from 00:00 · in the list service from 11:15 · confirmed by A-204 at 11:31 · warrant validated · current · authority: the act of the authority · the screening data teamFunds of a designated party are frozen and the freeze is reported · the sanctions regulations as the bank reads them · screening policy SP-9 §9 · warrant foundational · in force · authority: Financial Crime Compliance |
| the mandate versionthe mandate in force at that second, with its level and its limit | FC-11.3 · since 01.07.2026 · decide · €25,000 a payment · approved categories FP-1 to FP-3 · €5m a day across the deployment | C1 FC-11.3 · decide · €25,000 · approved categoriesL2 the analyst’s level-two authority · clear and freeze · the screening procedure |
| the control standardthe control standard version and the rule set the check applied | CS-7 v2026.3 · rule set RS-FC-11 r9 | CS-7 v2026.3 · rule set RS-FC-11 r9 |
| the consequence tierthe tier the act was classified into, and the version of the taxonomy that classified it | material · taxonomy CT-2026.1 · to €25,000, a payment that leaves the bank and cannot be recalled, across a border, under the sanctions regulations | material · taxonomy CT-2026.1 · a confirmed match is critical, and the agent never decides one |
| At the act · what the check decided | ||
| the check’s decisionpermit, refer, or block, how many of the six inputs held, and the reason code | PERMIT · six of six · reason code OK | C1 REFER · five of six · reason code BASIS-01: declared list 07.10, list service 09.10 11:15, entry EU-2318 · owner: level twoL2 FREEZE · the analyst’s decision · the match confirmed on two identifiers |
| the exact actwhat was done, to whom, for how much, under which id, once | clear and send payment 7730 · €18,500 to B-311 · P7730-C1 · once | C1 proposed: clear and send €21,300 to B-311 · P7738-C1 · not executedL2 freeze payment 7738 · €21,300 · P7738-L2 · report to the national sanctions authority · once |
| the permitits id and what it was bound to: the mandate version, the release, the basis version, the exact act; and how long it held | PR-7730-1 · bound to FC-11.3, release v3.1, the list of 07.10 17:30 and category FP-2, €18,500 to B-311 · valid for the next batch | C1 none · the proposal went to level two with the reasonL2 none needed for a freeze · the engine holds the payment on the analyst’s instruction |
| After the act · what came back | ||
| the receiptwhat the receiving system returned, and the reconciliation against it: one permit, one act, one receipt | S-7730 · €18,500 · accepted by the payment engine 09:14:30 · in the 09:30 batch to the correspondent · reconciled against the engine’s ledger: one permit, one payment, one receipt | C1 noneL2 the engine’s hold confirmation 11:31:20 · report filed 12:05, reference R-2318-09 · reconciled: one payment held, one report |
| the human decisionwhere a person decided: who, under which authority, what they confirmed, and when | none needed | C1 none yet · referred to a person with the reasonL2 analyst A-204 confirmed entry EU-2318 on registration number and address, and froze the funds at 11:31 |
| the costwhat the decision cost in tokens, and in a person’s time where one was needed | €0.27 in tokens · no analyst time | C1 €0.27 in tokensL2 €6.00 of an analyst’s time |
| retentionhow long the record, the manifest, and the permits are kept, and personal data inside them by its purpose | the record, the manifest, and the permits: ten years from the act, the period the bank sets for screening decisions of this tier (illustrative) · personal data by purpose and retention rule · a corrected fact is a new, linked entry | the record, the manifest, and the permits: ten years from the act, the period the bank sets for screening decisions of this tier (illustrative) · personal data by purpose and retention rule · a corrected fact is a new, linked entry |
control standard CS-7, version 2026.3 · rule set RS-FC-11 r9: refer any hit outside FP-1 to FP-3, any route through a high-risk jurisdiction, any mismatch of basis · CT-2026.1 · the bank’s consequence taxonomy · proposed by the CRO with financial crime compliance and Financial Crime Operations, set by the board, 06.2026 · ids, dates, and figures invented.
The business case
240,000 held payments a year, 70% eligible and 80% adopted; 15 minutes saved on each at €60 an hour, 65% realised. Run cost €550,000 a year; set-up €800,000. Breaches avoided, value dates kept, and analyst time moved to true matches are not yet included.
The people, on the day the mandate narrows
The analysts do this work today. The person who receives a referral holds at least the authority of the mandate the agent acted under, its limit included. Analyst A-204, at level two, clears and freezes; the agent only clears approved false-positive categories up to €25,000, and never a possible match. On the day a sanctions list changes, a new designation in the Official Journal re-screens the queue, and the hits triple
What the law asks here
| Duty | Why here | Evidence | Boxes |
|---|---|---|---|
| EU sanctions regulations the firm holds or moves funds: freeze the funds of designated persons, and make none available to them | every payment the bank sends; the list in force at the minute of release decides | the list in force at the minute of release; a confirmed match frozen and reported; the list copy refreshed after every act in the Official Journal | w2 w4 w5 |
| EBA guidelines on restrictive measures the firm screens for sanctions | the bank screens for sanctions; automated clearance of approved false-positive categories is the bank's own reading of the guidelines | trained staff analyse alerts, two people above an exposure; automated clearance only where the bank’s policy approves it, which is the bank’s own reading | w3 w4 w5 |
| AML law (Directive 2015/849 as transposed; the AML Regulation 2024/1624 from 10 July 2027) the firm is an obliged entity | the bank is an obliged entity; from 10 July 2027 the check of customers against the sanctions lists is also a due-diligence duty | policies and controls for screening; records of alerts and their outcomes kept for the statutory period | e2 e4 w5 |
| GDPR, Article 22 (to be tested) a decision is solely automated and has a legal or similarly significant effect: a test the firm applies per type of decision | to be tested per category: a clearance releases the payer's own payment; a freeze is never the agent's decision, so the test is the bank's to apply per category | a route to a person on request, with a time; reasons that explain the procedure and principles actually applied (CJEU C-203/22) | w4 w5 w6 |
| GDPR, Articles 15, 16, 17 personal data is processed | the payment carries personal data of the payer and the payee | access to the data on request; a corrected fact as a linked entry; retention by purpose, the storage-limitation principle | w5 p5 |
| EU AI Act, high-risk (classified: not high-risk) the use is on Annex III, among them the creditworthiness of natural persons (5(b)), life and health pricing (5(c)), and essential public benefits (5(a)), and Article 6(3) does not take it out | not as built: sanctions screening is not on the list | the classification, with its reasoning, in the agent portfolio; if high-risk, human oversight and logs | e1 w1 w4 |
| EU AI Act, Articles 4 and 50 any provider or deployer; Article 50 when an AI system talks to people, since 2 August 2026 | Article 50: the agent tells the client the payment is under review, so it says it is an AI system; Article 4 for the analysts who decide referrals | measures to support the AI literacy of the people who decide referrals (Article 4 as reworded by the 2026 omnibus: the duty stays, no guaranteed level); telling the person she is talking to an AI system | e4 w4 |
| DORA the firm’s ICT, and its ICT third parties | the bank is a financial entity under DORA | identity and access control, under the ICT risk framework; incident classification and reporting; the register of ICT third-party arrangements; testing | p1 p3 p5 p6 e1 e4 |
| Instant Payments Regulation | payment 7730 goes to a bank outside the EU and is screened as it leaves; the daily customer check of Regulation 2024/886 covers instant euro payments | ||
| Consumer Credit Directive II | not consumer credit | ||
| EIOPA opinion on AI governance (6 August 2025) | not an insurer | ||
Dated 11 October 2026; from the shared duty table; not legal advice.
Notes on the case
- Figures are illustrative. Vendors cite false-positive rates around 99% for rules-based screening; the 3% hold rate, 15 minutes per hit, and an average cleared payment of €3,500 are assumptions to check with a bank’s financial crime team.
- EBA/GL/2024/15 (paragraphs 32 and 33) asks for trained staff to analyse alerts and two people for higher exposure. The mandate therefore covers only a false-positive category the bank’s screening policy approves for automated clearance, at lower exposure, with analysts sampling 5%; everything else stays with analysts.
- The beneficiary is a new designation on 09.10 (entry EU-2318). On 08.10 the hit on EU-2291 was a genuine false positive, so the valid scenario pays a party that was not listed. Three timestamps are kept apart: in force (09.10, the day of publication), published (11:00), taken into the bank’s list service (11:15).
- The loop shows the serious-defect rule: a confirmed match on a stale list narrows at once. The other cases keep the recurring rule of three referrals. Breaching a listing can also be a criminal offence under Directive (EU) 2024/1226.
- The case uses an outgoing payment to a bank outside the EU, where each payment is screened. For instant euro payments the Instant Payments Regulation moves EU-list screening to the bank’s own customers.
- “It may not say why” is written as the bank’s disclosure rule. Tipping-off law strictly covers reports and investigations; a compliance reader should confirm the wording.
- The challenger is named Head of Financial Crime Compliance. MLRO is the UK title and centres on suspicious-activity reports; the AMLR speaks of a compliance officer.