Black List

Definition

A black list, also called a blocklist, internal watchlist or prohibited-party list, is a list a firm maintains itself of people, companies, accounts, devices or other identifiers it has decided not to deal with. Entries typically come from the firm's own experience: customers exited for suspected fraud or money laundering, parties linked to confirmed scams, counterparties refused on risk grounds, or names supplied by law enforcement requests.

The key difference from an official watchlist is authority. A sanctions list is published by a government or international body and carries legal obligations. A black list is the firm's own decision, and its legal weight comes only from the firm's policies and contracts. The two are often screened together, but they should never be confused.

Why a regulated firm cares

An internal list lets a firm act on what it has learned. If a customer was exited for suspected mule activity, the firm needs a way to stop that person opening a new account under a slightly different name next month. Without a list, the knowledge sits in a closed case file.

Black lists also carry risks that official lists do not.

Stale entries. Entries are added easily and removed rarely. A decision taken years ago on thin evidence can keep blocking a person long after the reason has disappeared.

Weak evidence. If entries can be added without a documented reason, the list becomes a record of suspicion rather than of decisions.

Unintended de-risking. Blocking whole categories, such as every customer from a particular country, sector or type of business, is a policy decision with consequences for financial inclusion. FATF has warned against wholesale termination of relationships to avoid risk rather than manage it, and supervisors in several jurisdictions have raised similar concerns.

Data protection. A black list is a register of personal data that can affect people's access to services, and it often contains information about suspected offences. Firms need a lawful basis, clear retention rules and a way to handle challenges.

Confusion with legal obligations. If an internal entry is treated as if it were a sanctions designation, a firm may freeze funds or file reports it had no basis for.

How it is maintained and evidenced

Good governance of an internal list tends to include:

• A defined purpose and scope for the list, and the categories of entry it may hold.
• An entry standard: who may add a name, what evidence is required, and a reason code linking to the underlying case.
• Rich identifiers, so that matching can distinguish the listed person from namesakes. A name alone is a poor entry.
• Review and expiry, with each entry either confirmed or removed after a set period or on a trigger.
• A route for challenge, so that a customer or staff member can ask for an entry to be reconsidered.
• Separation from official lists in screening results, so analysts can see whether an alert comes from a legal designation or an internal decision.

Regulatory basis

There is generally no specific legal requirement to keep an internal black list, and no single instrument that governs one. The practice sits within wider obligations.

• FATF Recommendation 1 and the related risk-based approach expect firms to identify and manage their risks rather than avoid them wholesale. FATF has published statements on de-risking.
• Directive (EU) 2015/849 and the UK Money Laundering Regulations 2017 require risk-based customer due diligence, which provides the basis for refusing or exiting relationships where risk cannot be managed.
• The GDPR and UK GDPR govern the processing of personal data, including stricter rules for data relating to criminal convictions and offences.

Some jurisdictions also restrict the sharing of such lists between firms or set specific conditions for it. Firms should confirm the position in their own jurisdiction before sharing or pooling entries.

Worked example (hypothetical)

A payments firm exits a customer, the fictional "Dorran Hale", after its fraud team confirms he received and moved funds from several scam victims. The firm adds him to its internal list with his date of birth, address, device identifiers and a reason code pointing to the case file. The entry is set for review after a defined period.

Later, an application arrives from "Doran Hale" with the same date of birth and a new address. The screening alert shows the source as internal, not a sanctions list. The analyst links the application to the case and declines it under the firm's policy. No sanctions report is filed, because no designation exists.

At the scheduled review, a different entry, added years earlier with no reason code and a name only, is removed.

Related terms

• Watchlist
• OFAC (Office of Foreign Assets Control)
• False Positive
• Entity Resolution
• Risk-Based Approach (RBA)
• Ongoing Monitoring