False Positive

Definition

A false positive is an alert raised by a screening or monitoring control that turns out, on review, not to be what it appeared to be. In name screening, it is a customer or payment party flagged as a possible match to a sanctions, PEP or adverse media record who is in fact a different person or entity. In transaction monitoring, it is activity flagged as suspicious that has a legitimate explanation.

The opposite error is a false negative: a genuine match or genuinely suspicious activity that the control failed to flag. The two are linked. Almost any change that reduces false positives risks increasing false negatives, and the reverse.

Why a regulated firm cares

False negatives are the regulatory danger. Missing a designated person can mean a sanctions breach, and missing suspicious activity can mean a failure to report.

False positives are the operational cost, and they carry their own compliance risk. Every alert takes analyst time. When alert volumes are high, reviews become rushed, analysts start to close alerts by habit, and the genuine match is more likely to be dismissed along with the rest. Customers are also affected: delayed payments, repeated requests for documents and, in some cases, refused service because of a namesake.

For that reason, the goal is not the lowest possible number of false positives. It is a screening set-up whose alerts can be reviewed properly, with a level of sensitivity the firm can justify.

How false positives arise and are resolved

Common causes include:

• Common names, or names that are common in a particular language or region.
• Loose matching thresholds that treat distant spellings as similar.
• Thin customer data, such as a name with no date of birth, nationality or address to compare.
• Generic words in company names, like "trading", "global" or "holdings", which inflate similarity scores.
• Transliteration, where the same name has many valid spellings in Latin script.

Resolving an alert means comparing secondary identifiers: date or year of birth, nationality, place of birth, identification numbers, addresses, registration numbers, and known associations. The analyst records which identifiers matched, which differed, and why the conclusion was reached. Where the data is insufficient to decide, the alert should be escalated or more information requested, not closed on a guess.

Firms reduce false positives in several defensible ways: collecting better identifiers at onboarding, tuning thresholds based on tested samples, applying rules that ignore generic words, and using a "good guy" or whitelist approach for customers already reviewed against a particular list entry. Each of these needs its own controls. A whitelist entry, for example, should be tied to a specific list record and revisited when that record or the customer's data changes.

Changes to matching logic should be tested before release, including a check that known true matches are still caught.

Regulatory basis

Regulations do not set a target rate for false positives, and firms should be wary of anyone who claims one. The relevant obligations concern the effectiveness of the control.

• FATF Recommendations 6 and 7 require targeted financial sanctions to be implemented without delay, which depends on screening that catches true matches.
• FATF Recommendation 10 and the risk-based approach under Recommendation 1 frame how firms calibrate due diligence and monitoring.
• United States: sanctions compliance sits under OFAC regulations in 31 CFR Chapter V, and OFAC's published framework for sanctions compliance programmes describes testing and auditing as core components. AML programme requirements derive from the Bank Secrecy Act.
• Directive (EU) 2015/849 and the UK Money Laundering Regulations 2017 require firms to maintain policies, controls and procedures proportionate to their risks.

Firms should confirm the specific expectations of their own supervisors, particularly on threshold tuning and model validation.

Worked example (hypothetical)

A small bank screens a new customer, the fictional "Mira Solberg Andersen", and receives an alert against a listed individual named "Mira Andersen". The similarity score is high.

The analyst compares identifiers. The listed individual has a year of birth two decades earlier than the customer's, a different nationality, and a listed place of birth on another continent. The customer's passport data is verified. The analyst closes the alert as a false positive, recording the three differing identifiers and the source of the customer's data.

Because the same alert would recur at every re-screening, the bank adds a whitelist entry linking this customer to this specific list record. If the list record is amended, the entry lapses and the alert is reviewed again.

Related terms

• Fuzzy Matching
• Entity Resolution
• Watchlist
• Adverse Media
• Negative News
• Ongoing Monitoring