From Onboarding to Ongoing: Building Sanctions Compliance into the Client Lifecycle

Most firms can show that every new client was screened before the account opened. Fewer can show when an existing client was last screened, against which version of the UK sanctions list, and who cleared the result. That gap is where real exposure tends to sit, because new designations keep arriving and ownership changes hands, and a client who was clean at onboarding can be controlled by a designated person three years later. This article maps sanctions screening to each stage of the client lifecycle, from first contact to exit, and shows how the purpose, depth and record of the check change at each one.

Before the Relationship: Screening Prospects and Deals

The first check runs before there is a client at all. A sales team is qualifying a prospect, a deal team is assessing an acquisition target, or procurement is shortlisting a supplier. The question is narrow: is this party, or anyone obviously behind it, designated under a regime in scope, and is there any reason to stop before commercial effort is spent.

A full customer due diligence file is not warranted for a prospect that may never convert. What is proportionate is a sanction search on the legal entity and its visible principals against the UK sanctions list, the OFAC list and the EU and UN lists, with the result and the date recorded. In a higher-risk sector or jurisdiction, a first look at ownership is reasonable before terms are discussed.

The record at this stage is deliberately light: the name searched, the lists covered, the date, the outcome and who cleared it. It becomes the earliest entry in the relationship's audit trail. If the prospect converts, the onboarding team can see that a pre-screen ran and what it found. If the prospect is declined on sanctions grounds, the record shows that the firm identified the exposure before any obligation to report arose.

The common failure here is the informal check that leaves no trace: a relationship manager searches a name, sees nothing and moves on, and six months later nobody can say which lists or which entity that search covered.

Onboarding: The Full Check and the Baseline Record

Onboarding is where the full check runs, and its output is the reference point that every later stage refers back to. Onboarding checks under a firm's KYC process resolve who the customer is, establish who owns and controls it, screen the resolved parties against sanctions lists and PEP checks, and review adverse media for anything the lists do not yet reflect.

Identity resolution comes first, because screening an unresolved name produces a list of near-misses rather than a decision. Legal name, registration number, registered address and, for individuals, date of birth narrow the field so that a list match can be confirmed or dismissed with a recorded reason. Ownership and control follow, walking corporate customers through their structure to the natural persons behind them, since a company that is not itself designated can still be controlled by someone who is.

The quality of this record determines how expensive every later review will be. A baseline that documents which entities were screened, which lists and sources were in scope, which matches were reviewed and how each was dispositioned gives the periodic review something to compare against. A file that records only "screened, no match" forces every later review to rebuild the picture from scratch, at full cost, and leaves the reviewer unable to say what has actually changed. The case for running PEP and sanctions checks together is made in why PEP and sanctions screening belong in a single workflow; the lifecycle point is that the combined result, captured once and dated, carries the rest of the relationship.

In-Life: Periodic Reviews and Trigger Events

Once the client is on the book, the purpose of screening changes. Onboarding gates a relationship. In-life screening monitors a book, in two modes.

Periodic review is the scheduled mode. Under a risk-based approach, refresh cadence is tiered by the risk rating assigned at onboarding: higher-risk relationships reviewed more often, standard relationships on a longer cycle, with the interval documented in policy. The review re-runs the screening against the current lists, revisits ownership for corporate clients, and updates the risk rating where the facts have moved. Where a documented onboarding record exists, the review is a comparison. Where it does not, the review is a second onboarding.

Trigger events are the unscheduled mode, and they are where periodic review on its own falls short. A designation is added to the UK sanctions list or the OFAC list. A corporate client changes ownership. Adverse coverage names a director in an investigation. Each of these should prompt a check between cycles, regardless of when the last scheduled review ran. In practice this depends on ongoing monitoring: list update alerts, registry change alerts and media monitoring that surface the event to the team rather than relying on an analyst to notice. Regime divergence adds to the load, since a party clear under one list may be designated under another, as how UK and EU sanctions regimes have diverged sets out.

The record for each in-life check should reference the record it was compared against, so that drift is visible and the file reads as a continuous history rather than unrelated snapshots.

Exit and Lookback: When Screening Finds a Live Match

When monitoring returns a confirmed match against an existing client, the sequence becomes procedural. The first obligation is to freeze. Funds and economic resources belonging to, owned, held or controlled by a designated person must not be dealt with, and no funds or economic resources may be made available to them, from the moment the firm knows or has reasonable cause to suspect the designation applies. The freeze sits with the operations team that controls the accounts, on instruction from compliance, with the time of the instruction recorded.

Reporting follows. Firms in scope must report to the Office of Financial Sanctions Implementation, OFSI, as soon as practicable, setting out what they know about the designated person, the funds or resources frozen, and the basis for the match. Compliance owns the report; the money laundering reporting officer typically signs it off.

The lookback comes next. The firm reviews past transactions and relationships connected to the designated person to establish whether any dealings took place after the designation date, and reports those as well. This is where the earlier lifecycle records earn their keep: a dated onboarding baseline and a continuous review history show a regulator what the firm knew at each point and why the match was not visible sooner. Exit, whether by termination or by holding a frozen relationship, is the final entry in the same audit trail.

One Lifecycle Workflow in Nexis Diligence+

Nexis Diligence+ is the same tool at every one of these stages rather than a different one for each. One entity query covers global sanctions lists, PEP data, licensed adverse media and company and ownership records together, which is why a pre-screen, an onboarding check, a periodic review and an event-driven check produce results that can be set side by side. Where a corporate structure needs to be walked to its owners, the Entity Search API extends the same environment to network and ownership mapping, as described in the article on advanced KYC workflows in Nexis Diligence+.

The thread that ties the lifecycle together is the report. Nexis Diligence+ saves each check as a dated, exportable record of what was searched, which sources were in scope and what was found, and that record becomes the baseline the next stage compares against. A periodic review opens the onboarding report and re-runs it. A trigger event opens the last review and checks what has changed. When negative news screening for compliance teams surfaces a new story, the check runs against the same entity with the same documentation, and the file gains one more dated entry. Each stage hands the next a record it can use.

Support Every Lifecycle Stage with Nexis Diligence+

Final Thoughts

Sanctions compliance holds only if every stage of the client lifecycle hands a usable record to the next. A pre-screen that leaves no trace, an onboarding file that records only an outcome, or a periodic review that cannot see what it is comparing against each break that chain, and the break shows at the worst moment: when a live match is found and OFSI asks what the firm knew and when.

One screening workflow, run from prospect to exit and documented the same way at every stage, is simpler to operate and easier to defend than a different check at each handoff. Diligence+ gives that workflow a single search and a single form of record, which is what a lifecycle needs from its tooling. The lists will keep moving. The file has to keep up.