Lookback Review

What Is a Lookback Review?

A lookback review is a retrospective examination of a firm's historical transactions, customers or screening decisions, carried out to find suspicious or prohibited activity that its controls failed to detect at the time. It is sometimes called a transaction lookback, a historical review or a remediation review.

Lookbacks are usually triggered by the discovery of a control failure. That might be a transaction monitoring scenario that was misconfigured, a screening system that skipped part of the customer base, a data feed that never reached the monitoring engine, or a regulatory examination that found the program inadequate. Once a firm knows its controls were not working, it needs to establish what it missed during the affected period.

A lookback can be initiated by the firm itself, recommended by internal audit or an independent reviewer, or required by a regulator as part of a supervisory action or enforcement settlement.

Why Lookback Reviews Matter

A broken control does not just create risk going forward. It means that suspicious activity may have gone unreported, sanctioned parties may have been served, and criminals may still be using the firm. Fixing the control without looking back leaves those past failures unaddressed.

A lookback serves several purposes:

• Meeting reporting obligations. Activity that should have been reported can still be reported, late, to the Financial Intelligence Unit.
• Identifying risky relationships. Customers involved in previously missed activity may need enhanced due diligence, restriction or exit.
• Measuring the impact. The results show how serious the failure was, which informs remediation, governance changes and communication with supervisors.
• Rebuilding trust. A thorough, well-documented lookback helps demonstrate to regulators that the firm takes the failure seriously.

Lookbacks are also expensive and time-consuming. Large reviews can involve millions of transactions and many months of analyst work, which is one reason firms invest in getting monitoring and screening right in the first place.

How a Lookback Review Works

1. Scoping

The firm defines what is being reviewed and why. Key decisions include:

• The review period, usually covering the time the control was ineffective.
• The population: which customers, accounts, products, channels or payment types.
• The type of risk: suspicious activity, sanctions exposure, or both.

Scope is often agreed with the regulator where the lookback is part of a supervisory requirement.

2. Data Collection and Validation

Historical data must be extracted, reconciled and checked for completeness. Gaps in data are a common reason lookbacks overrun, and they may themselves be findings.

3. Rescreening or Remonitoring

The historical population is run through corrected or new rules. For a transaction monitoring lookback, this means applying scenarios that should have been in place. For a sanctions lookback, it means screening historical customers and payment parties against the lists that applied at the time of each transaction, as well as against current lists.

4. Alert Review and Investigation

Alerts generated by the lookback are reviewed and investigated in the same way as live alerts, with clear criteria for escalation and closure. Quality assurance sampling checks that analysts are reaching consistent decisions.

5. Reporting and Remediation

Suspicious activity is reported to the FIU. Potential sanctions breaches are assessed and, where appropriate, disclosed to the relevant sanctions authority. Customers may be re-risked or exited. The firm documents the methodology, results and root cause, and reports on progress to senior management and, where required, the regulator.

6. Root Cause and Prevention

The final step is making sure the same failure does not recur: fixing the control, adding monitoring of the control itself, and strengthening change management and data governance.

Regulatory Expectations

There is no single rule that defines a lookback. Instead, the obligation flows from the underlying duties to monitor and report suspicious activity under the Bank Secrecy Act and FinCEN's rules, the EU AML framework including Regulation (EU) 2024/1624, and the UK Money Laundering Regulations 2017, and from the duty not to deal with sanctioned persons.

In the sanctions area, OFAC's Economic Sanctions Enforcement Guidelines treat voluntary self-disclosure and remedial action as factors that can be considered when OFAC determines its response to an apparent violation. A lookback is often how a firm identifies what it needs to disclose. In supervisory or enforcement contexts, regulators may require an independent party to conduct or validate the review.

Common Challenges

• Point-in-time accuracy. Sanctions lists change constantly. A meaningful sanctions lookback must consider what the lists said on the date of each transaction, not only today.
• Legacy data. Older records may be incomplete, stored in retired systems or formatted inconsistently.
• Volume. Broad rules applied to years of history can produce more alerts than the firm can handle. Careful tuning and prioritization are essential.
• Consistency. Large temporary review teams need detailed procedures and quality checks to keep decisions consistent.
• Running in parallel. Business-as-usual monitoring must continue while the lookback is under way.

How on8.ai Helps

SmartSanction supports batch screening as well as API calls, so historical customers, counterparties, vessels and crypto wallets can be rescreened in bulk against sanctions, PEP and other risk sources. Each match carries the reasoning behind it, which makes large review queues easier to work through and to document.

Related Terms

• Transaction Monitoring System (TMS)
• SAR (Suspicious Activity Report)
• OFAC (Office of Foreign Assets Control)
• Compliance Risk
• Alert Rules
• Continuous Monitoring