List currency and change control
Where each list comes from, how quickly updates reach your systems, and the evidence that every update was loaded and applied. The exact failure behind the June 2026 penalties, tested directly.
Sanctions Screening Review in Malaysia
Sanctions screening is where Bank Negara Malaysia keeps finding failures, and they are rarely about the law. They are about a list that was not updated, a customer screened a day late, or a match nobody froze. We test your programme the way an examiner would, and fix what we find before they do.
Sanctions Screening Review
What it is
An independent review and remediation service for sanctions screening programmes at reporting institutions. We test whether your lists are current and applied, whether you screen the right parties at the right time, whether your matching and alert handling hold up, and whether a true match would be frozen, rejected and reported correctly, then help you close the gaps.
Why organisations need it
Across 2025 and 2026, Bank Negara Malaysia has penalised banks, insurers and takaful operators, e-money issuers, money services businesses and a corporate services provider for sanctions screening failures: databases not kept current, customers not screened in time, and matches not rejected, frozen or reported. On 10 June 2026, Standard Chartered Bank Malaysia Berhad and Standard Chartered Saadiq Berhad were each penalised RM132,000 for failing to keep up with updates to the Domestic List. Every institution believes its screening works. Few have tested the evidence behind it.
What the engagement covers
Scoped to your institution type and screening set-up. A money services business with one system and a bank with several need very different reviews.
Screening coverage and timing
Who is screened, including beneficial owners, directors and payment counterparties, and when: at onboarding, on every list change and at transaction time. The gaps between those points are where most failures sit.
Name matching and tuning
Testing matching against Malay, Arabic, Chinese and Tamil name variants, aliases and identifiers, and checking that thresholds were set on evidence rather than to cut alert volume.
Alert handling and adjudication
A sample of closed alerts re-performed: were the reasons documented, reviewed and defensible, and were service levels met.
Freeze, reject and report
Walking a true match through your procedures and systems to confirm that funds would be frozen without delay, the relationship or transaction rejected, and the report made correctly.
Governance and management information
Ownership, independent testing, board reporting and the metrics senior management should see, so the programme is overseen rather than assumed.
What the business gets out of it
You find it before BNM does
The failures in BNM's published actions are testable. Testing them first turns a potential enforcement finding into an internal remediation item.
Evidence, not assurance
An examiner asks for proof that each list update was applied. The review builds that evidence trail so the answer is a document, not a reassurance.
Fewer false positives without more risk
Tuning based on tested data can reduce alert volume without weakening coverage, and records why each threshold was set.
A vendor-neutral view
We do not sell or implement screening systems, so the recommendation is what your programme needs, whether that is configuration, process or a different tool.
The board sees the real position
Clear management information on list currency, alert backlog and testing results gives directors something to oversee, which is what supervisors expect of them.
Your team learns the method
Our two-day sanctions screening course is HRD Corp claimable and follows the same structure, so operations and compliance staff can sustain the improvements.
How it works
How the engagement runs
01
Scoping
Your institution type, systems, lists, screening points and recent audit or examination findings.
02
Walkthrough
Tracing the end-to-end screening process with operations, compliance and IT, from list source to report.
03
Testing
List update sampling, coverage and timing tests, matching tests with name variants, and re-performance of closed alerts.
04
True match scenario
A simulated match through freeze, reject and report, to prove the procedure works in practice.
05
Findings and remediation
Findings ranked by enforcement risk, with owners, actions and timelines, and support closing them.
06
Board reporting
A summary for senior management and the board, and the metrics to track from then on.
Deliverables
What you receive
Screening process map
End-to-end view of lists, systems, screening points and hand-offs.
Test results
List currency sampling, coverage and timing tests, matching tests and alert re-performance, with evidence.
True match walkthrough
The result of the simulated match through freeze, reject and report.
Findings report
Gaps ranked by enforcement risk, with remediation actions, owners and timelines.
Tuning recommendations
Evidence-based threshold and rule changes, with the rationale recorded.
Board summary and MI pack
Position statement for directors and the ongoing metrics to monitor.
Who it is for
Who this is built for
Industries
Company sizes
Departments
FAQ
FAQ
Reporting institutions in Malaysia screen against the United Nations Security Council lists and the Domestic List declared by the Minister of Home Affairs, and must address proliferation financing under the Strategic Trade Act 2010. Foreign regimes such as OFAC, EU and UK sanctions are usually a matter of risk appetite and correspondent relationships rather than Malaysian law.
The system is only as good as the lists loaded into it, the parties sent to it, the thresholds set and the people handling alerts. The failures in BNM's enforcement actions were mostly in those areas, not in the software itself.
On 10 June 2026, Standard Chartered Bank Malaysia Berhad and Standard Chartered Saadiq Berhad were each penalised RM132,000 for failing to keep up with updates to the Domestic List. List currency is the first thing our review tests.
Often, yes, but only with evidence. We test matching against real name variants and your own alert history before recommending changes, and record why each threshold is set, so tuning does not become the next finding.
No. The review is vendor-neutral. If your system needs reconfiguring we specify what, and if it genuinely needs replacing we say so and help you set requirements.
No. BNM's actions have covered insurers, takaful operators, e-money issuers, money services businesses and a corporate services provider. The review is scaled to your institution and your screening set-up.