Screening Alert Adjudication

Screening Alert Adjudication

This skill adjudicates a single screening hit — a name that an upstream screening system flagged as a possible match against a sanctions list, PEP list, adverse-media source, or similar watchlist — and reaches one of three conclusions:

• True positive (TP) — the screened party is the listed party
• False positive (FP) — the screened party is not the listed party
• Escalate — evidence is insufficient to deterministically conclude either way; hand off to a human analyst with the full evidence record

Why this skill exists

Screening systems generate enormous volumes of low-quality alerts. Analysts spend their time clearing alerts that should never have fired (wrong entity type, common name with no overlap on identifiers, partial-name matches that ignore naming convention). A deterministic, criteria-driven adjudication layer can clear the obvious false positives and confirm the obvious true positives, leaving humans to focus on the genuinely ambiguous cases.

The skill is designed around two non-negotiable properties:

1. Determinism. Given identical evidence, the skill reaches an identical conclusion. The skill never weighs probabilities, never says "this looks like" or "probably is." A rule either fires or it doesn't.
2. Conservatism. Escalation is the safe default. No rule fires unless every one of its preconditions is satisfied. Better to escalate a clear case than to wrongly clear an ambiguous one.

How the work is organized

Adjudication runs through tiers. Each tier escalates token spend; earlier tiers exit as soon as they can.

• Tier 0 — Parse and normalize both names; classify scripts, languages, naming conventions; extract anchor components, aliases, and identifiers. No determinations yet. See references/tier-0-parsing.md.
• Tier 1 — Hard false-positive triggers using only what's in the alert. Cheap, no web access. Only FP rules fire here; TP is never reached at Tier 1. See references/tier-1-rules.md.
• Tier 2 — Structured identifier corroboration using whatever's in the alert and list entry. Both TP and FP rules available. Still no web access. See references/tier-2-rules.md.
• Tier 3 — Targeted external research using web search and fetching. Source-language aware, source-ranked, capped at 8 page retrievals per case. See references/tier-3-research.md.

If no determination is reached by the end of an applicable tier, the skill escalates with the full evidence record.

What the skill needs to start

Required from the user or upstream system:

• The screened name (the name being checked — usually a customer, transaction party, beneficial owner, or similar)
• The matched name from the list entry

Useful if provided, optional otherwise:

• The name of the list (e.g., "OFAC SDN List", "EU Consolidated Financial Sanctions List", "UK OFSI Consolidated List", "Dow Jones PEP"). The skill doesn't branch on list name operationally — the matching question is the same across all lists — but the list name is captured in the audit record and informs the analyst's downstream disposition.
• Entity type on the screened side (individual / entity / vessel)
• Any secondary identifiers (DOB, POB, nationality, ID numbers, addresses)
• The upstream system's match score
• The list version or snapshot date (for audit binding)