The Hit That Wasn't, and the One That Was
Orion Bank in Singapore screens 9,000 corporate customers. The tool generates about 2,400 alerts a month; 98.6% are closed as false positives, with an average handling time of four minutes. Last week a new analyst escalated an alert on Sunrise Metals Pte Ltd, a two-year-old customer. The company name matched a listed name at 88% and had previously been cleared. The analyst noticed that Sunrise's sole director, V. Kuznetsov, matched a designated individual at 91% - same year of birth, same city of birth. Kuznetsov holds 60% of Sunrise directly; the other 40% is held by an unrelated Singapore family. Sunrise's last three receipts, totalling USD 1.4 million, came from a Hong Kong entity that is not a customer of the bank.
1. Is Sunrise blocked? Set out the determination and the immediate obligations.
Read the worked answer
Determination: Sunrise is blocked property by operation of law, subject to confirming the identity match.
Kuznetsov is a designated person and holds 60% of Sunrise directly. Under the 50 percent rule, an entity owned 50% or more by one or more blocked persons is itself blocked, with no designation action and no listing required. Sunrise's absence from any list is irrelevant, and the previous clearance of the company-name match does not address the ownership question at all.
The 91% match is strong but not dispositive - confirm with secondary identifiers before acting: date of birth, place of birth, nationality, identification numbers, and the corporate register itself. The 88% name match on the company is a separate and weaker signal; the escalation rests on the director, not the name.
Immediate obligations once confirmed:
- Treat the USD 1.4 million in the account as blocked property. Do not return it to the sender, do not offset it, do not release it.
- File a blocked property report with OFAC within 10 business days, and make any MAS report required locally.
- Stop all activity on the account and screen the Hong Kong remitter and its ownership chain.
- Preserve records and consult counsel before communicating with the customer.
- Review the two-year relationship history for earlier receipts from the same remitter - the bank may have processed blocked-property transactions before.
2. What does the four-minute average handling time tell you, and what would you change?
Read the worked answer
A four-minute average tells you alerts are being dispositioned, not investigated. That is the root cause of this miss, not a side issue.
The 98.6% false positive rate is not itself alarming - name-screening tools produce high volumes. What is alarming is the combination of volume, speed and a previously cleared 88% name match on a company whose director is a designated person. Fix the process, not just the headcount:
- Configure on identifiers, not names. Weight date of birth, nationality, identification numbers and address. A name-only configuration guarantees both noise and misses.
- Mandatory secondary-identifier verification before any closure, with a documented rationale in a structured field - not free text saying 'not a match'.
- Risk-based thresholds. Lower tolerance for high-risk jurisdictions, PEPs and complex ownership; higher for low-risk domestic retail.
- Quality assurance on closures. Independent sampling of closed alerts, with the QA result reported upward. Measure quality, not speed; remove handling time as a productivity target.
- Surface ownership data at the point of alert. The analyst had to think of the 50 percent rule unprompted. The workflow should require ownership-chain review whenever an individual associated with a customer matches.
- List management. Daily refresh across all applicable regimes, with documented list-of-lists governance.
Escalate the design flaw as a governance finding with a remediation plan and owner.
3. What do you do about the USD 1.4 million from the Hong Kong entity, and how do sanctions reporting and AML reporting interact here?
Read the worked answer
On the funds: once credited to a blocked account, the funds are blocked property. Do not return them to the remitter to unblock the situation - returning blocked property is itself a prohibited transfer, and it is the most common error in this scenario. Hold, report and preserve.
On the remitter: a non-customer third party paying a blocked entity is a red flag for attempted evasion. Establish whether Kuznetsov owns or controls the Hong Kong entity - if he holds 50% or more, that entity is also blocked and the analysis extends to its other counterparties. Ask why a Hong Kong entity is paying a Singapore metals trader, and whether the payments match any underlying trade documentation.
On reporting: sanctions reporting and suspicious transaction reporting are separate obligations, and one does not discharge the other. The blocked property report goes to OFAC; the suspicious transaction report goes to the local financial intelligence unit. A transaction can be both reportable as blocked property and reportable as suspicious. Neither report excuses the bank from the other.
Finally, look back. Three receipts means the control failed on at least two earlier occasions. Scope the lookback, quantify, and evaluate whether a voluntary self-disclosure is warranted. The quality of the escalation record now is what determines how the earlier failures are viewed.