Sanctions Screening Gap at Caspian Trade Bank
Caspian Trade Bank is a mid-sized UK bank with 40,000 corporate clients. Its sanctions screening system was configured in 2019 and has not been recalibrated. An internal audit in March found that 1,200 client records had no screening evidence, 300 of which were opened in the last 12 months. The bank's MLRO says the system screens at onboarding but not on an ongoing basis, and that a name-matching threshold of 95% was set to reduce false positives. A client in the shipping sector was recently matched to a designated entity at 92% similarity and was not flagged. The FCA has not yet visited. The board asks the company secretary to coordinate the response and advise on regulatory obligations.
1. Assess the bank's compliance with its sanctions obligations and identify the breaches.
Read the worked answer
The bank is likely in breach of its obligations under the Sanctions and Anti-Money Laundering Act 2018 and the FCA's SYSC and MLR 2017 requirements. Key failures: (1) No ongoing screening - sanctions obligations require screening at onboarding and on an ongoing basis against updated lists; a one-time check is inadequate, particularly for a shipping client with higher risk. (2) Recalibration failure - a 95% threshold set in 2019 and never reviewed is not risk-based; the 92% match that was missed shows the threshold is too high for a high-risk sector. (3) Missing evidence - 1,200 records without screening evidence, including 300 recent clients, indicates a control breakdown and possible breach of record-keeping duties. (4) Governance - the MLRO appears to have known of the design gap without escalating to the board, which is a failure of the SMF17 (money laundering reporting) function and the board's oversight. The company secretary should advise that the bank may need to make a suspicious activity report to the NCA for the missed match and consider a voluntary disclosure to the FCA. The board should treat this as a regulatory breach with potential unlimited fines and possible business restrictions.
2. Set out the remediation plan and the governance reporting the board should require.
Read the worked answer
Remediation: (1) immediate retrospective screening of all 40,000 clients against current lists, prioritising the 1,200 unscreened records and the shipping portfolio; (2) recalibrate the matching threshold to a risk-based level (e.g., 85% for high-risk sectors, with manual review of near matches); (3) implement ongoing screening with daily list updates and documented alert disposition; (4) appoint a remediation programme director reporting to the board risk committee; (5) commission an independent review of the MLRO function and consider whether the SMF17 holder remains fit and proper. Governance reporting: the board should receive weekly dashboards on screening coverage, alert backlog, and matches cleared; the audit committee should oversee the independent review; the board should approve a customer risk assessment refresh and a training programme. The company secretary should ensure the board minutes record the breach, the decision to self-report, and the resourcing approved. The board should also consider whether to notify its prudential regulator if the remediation affects capital or operational resilience.