Finic
ContactTry the API
AML and sanctions

Triage sanctions and watchlist screening hits

Grayson compares a screening hit's list entry with your customer record, names the identifiers that rule it out, and picks clear, request information, escalate or block.

Grayson reads a screening hit the way a level 1 analyst does: the list entry your screening vendor returned, next to your customer record, accounts, payments, earlier screening decisions and adverse media. It returns how likely it is that your customer is the listed party, which of the entry's identifiers your record contradicts (the reason to record when you clear it), whether the adverse media is about your customer and financial crime, and whether to clear, request information, escalate or block. It costs about $0.55 to $0.81 per 1,000 decisions.

  • Decides: Decide whether a sanctions or watchlist hit is your customer, record why, and clear, request information, escalate or block.
  • Call it: When customer or payment screening returns a possible match against a sanctions, PEP or watchlist entry
  • Questions: 1 score, 1 multiple choice, 1 yes/no, 1 choice
  • Cost: $0.00055 to $0.00081 per decision ($0.55 to $0.81 per 1,000) for these examples' 15,701 to 23,019 input tokens
  • Latency: 243 to 333 ms for these examples, the median of 5 calls each through api.finic.ai from US-West

Examples

Three OFAC SDN hits on existing customers, each sent with the full KYC record, twelve months of monthly totals, every posted item since August 1, two years of wires, earlier screening alerts, the held payment and the vendor's adverse media. They are an exporter whose passport number, birth date and address appear on a new entry, a framer whose wire home hits a new alias on a cartel financier's entry, and a machine repair shop owner who shares a name and birth year with a newly designated exporter in Armenia.

Open in Playground

Open in Playground

Open in Playground

A yes/no answer is Grayson's probability that it's true. A choice answer is the top option and Grayson's confidence: 0% when every option is equally likely, 100% when one option has all the probability. A score answer is the expected level, numbering the levels in its criteria from 0, with its confidence measured the same way and, when no level reaches 70%, each level's probability. A multiple-choice answer lists the options at 50% or more.

  • action: release clear above a high threshold with the reason from conflicting_identifiers written to the case, and send everything else to an analyst. Never let a model block on its own: route block_and_report to whoever signs blocking reports.
  • same_party: sort your queue by it, and audit a sample of the alerts cleared at "Very unlikely" each month.
  • conflicting_identifiers is the audit trail: a clear backed by a different date of birth and national ID number is strong; a clear with nothing listed should go to a person.

Call it from your code

Save an example as request.json, such as fraud.json, and send it with your API key in GRAYSON_API_KEY:

curl https://api.finic.ai/v1/decide \
  -H "Authorization: Bearer $GRAYSON_API_KEY" \
  -H "Content-Type: application/json" \
  --data @request.json

The problem

Screening tools match names, so a common name or a new alias on an old entry raises the same alert every time it appears, and most of a sanctions team's day goes to clearing hits that a date of birth rules out. The few real matches look much like them at first, and telling them apart means comparing every identifier, reading the customer's history and the press release, and writing down why.

What to send

Send the alert with the record your analysts would open next to it. The examples use about 15,700 to 23,000 input tokens.

  • The list entry as your vendor returns it. All names and aliases, dates and places of birth, nationalities, ID numbers, addresses, linked parties, the program and when the entry was added or amended.
  • The vendor's match details. The score, which name or alias matched, and how each secondary field compared.
  • Your KYC record. Legal name and other names, date and place of birth, citizenships, every ID document with its number and dates, addresses with their dates, occupation and business.
  • Accounts, payments and wires. Where your customer lives, works and sends money shows whether they can be the person the entry describes.
  • Earlier screening decisions. A hit cleared twice before on the same identifiers, and why it came back, often settles the case.
  • The held payment, when screening stopped one: the full message, with every party and agent.
  • Adverse media with the text, so Grayson can tell whether it describes your customer or the listed person.

Add your own policy

Many institutions require a second person, usually the sanctions compliance officer, to decide every block, so put your procedure in the state in your team's words.

Your four-eyes blocking procedure adds this to the state of the obvious example:

{
  "institution_policy": "Sanctions screening procedure SS-3 (revised 2026-07): Level 1 analysts never block funds or accounts and never file blocking reports, however strong the match. When a hit on a blocking list (the OFAC SDN list, or an entity owned 50% or more by listed persons) looks like a true match, keep any payment on hold, place a temporary debit restriction on the customer's accounts and escalate the case to the Sanctions Compliance Officer the same day. Only the Sanctions Compliance Officer decides to block and files the report to OFAC. Level 1 analysts clear false positives and request information from customers as usual."
}
QuestionWithoutWith your four-eyes blocking procedure
same_party3.99 of 4, confidence over 99%3.99 of 4, confidence over 99%
conflicting_identifiersNone at 50% or moreNone at 50% or more
adverse_media_financial_crime99% true99% true
actionblock_and_report, confidence 96%escalate, confidence 98%

Applied to the clear true match example: the exporter's passport number, birth date and home address are on the new entry, but under this procedure a level 1 analyst never blocks, so the action moves from blocking and reporting to escalating with a hold, while the match likelihood, conflicting identifiers and adverse media answers stay the same.

Where to call it

  • On every alert, before it reaches the queue, to order it and to prepare the comparison and the reason for each clear.
  • In the payment path, when payment screening holds a wire, so false positives are released in minutes instead of hours.
  • After each list update, across the batch of new hits from rescreening your whole customer base.

Cost and latency

ExampleInput tokensPer decisionPer 1,000 decisionsLatency
Obvious23,019$0.00081$0.81281 ms
Legitimate15,701$0.00055$0.55243 ms
Ambiguous19,179$0.00067$0.67333 ms

You pay only for input tokens, at $0.035 per million, and each request is rounded up to the next millionth of a dollar, so a request with a larger state costs proportionally more; every response reports its size in usage.input_tokens. Latency is the median of 5 calls each through api.finic.ai from US-West, and grows with the number of input tokens. Add your own network time to api.finic.ai.

Evaluate on your own data

Score Grayson on your own past cases before you use it: a CSV with one row per case and a column with the right answer to each question. Every other column is sent as the case.

pipx install https://docs.finic.ai/downloads/grayson_cli-0.4.0-py3-none-any.whl
grayson eval my-cases.csv --questions https://docs.finic.ai/recipes/sanctions-screening-triage/questions.json --label same_party=<column> --label conflicting_identifiers=<column> --label adverse_media_financial_crime=<column> --label action=<column>

Each --label names the column with that question's right answer:

  • same_party: a level, such as "Very likely (over 90%)"
  • conflicting_identifiers: option keys separated by | (date_of_birth, place_of_birth, nationality, id_number, gender, party_type)
  • adverse_media_financial_crime: true or false
  • action: clear, request_information, escalate, block_and_report

Or run grayson on its own to set up your questions step by step. You get each question's accuracy and a CSV with Grayson's answer next to yours for every case.

Evaluate on your own data

How it works, what you get, and every option.

FAQ

Can Grayson clear alerts on its own?

It can if your policy and regulators allow automated clearing with a documented rationale: use a high threshold on clear, require at least one entry in conflicting_identifiers, and keep the answers with the alert. Most teams start by using it to order the queue and prepare the comparison, then measure its clears against their analysts' on past alerts before letting any close without review.

Does it work for PEP and adverse media hits, not just sanctions?

Yes. The identity questions are the same for a politically exposed person or a watchlist entry, and you can send a PEP database record in place of a sanctions entry. A true PEP match isn't blocked, so add your own outcome, such as enhanced due diligence, to the action options or describe it in your procedure.

What about the OFAC 50 percent rule?

An entity owned 50% or more in total by blocked persons is blocked even when it isn't on the list, so screening its name finds nothing. Screen your customers' beneficial owners and send the ownership chain with the alert, and Grayson can weigh a hit on an owner the same way.

Triage AML transaction monitoring alerts

Close, ask the customer, escalate or file on a transaction monitoring alert, with the typology and how likely it meets the SAR standard

Detect account opening fraud and synthetic identities

Approve, step up or decline a deposit account application at risk of stolen or synthetic identity fraud.

Detect money mule accounts

Whether an account is passing other people's money through, whether the holder knows, and what to do

Recipes

Every use case, with its questions and cost per decision.

Money mules

Decide whether an account is a money mule, whether the holder is complicit or was deceived by a job or romance scam, and whether to restrict or close it.

Merchant and platform risk

The merchants on your payments platform, and abuse of your rewards and promotions. Ready-to-run Grayson recipes with real responses, cost and latency.

On this page

ExamplesCall it from your codeThe problemWhat to sendAdd your own policyWhere to call itCost and latencyEvaluate on your own dataFAQCan Grayson clear alerts on its own?Does it work for PEP and adverse media hits, not just sanctions?What about the OFAC 50 percent rule?Related recipes