Respondent banks send Wolfsberg questionnaires on a regular cycle, and the sanctions section is where many Saudi institutions struggle to attach evidence. For Wolfsberg correspondent banking sanctions screening Section 3.5, the question is usually simple: describe your screening controls. The difficulty is proving the answer. Most filters log what matched. Few log the logic that was tested: which lists, which fields, which thresholds, and who changed them.
This checklist sets out eight configuration items your SWIFT or payment-hub filter should log. It is meant to be used the same day: compare each item to what your system records today, mark the gaps, and assign an owner.
A note on scope. The Wolfsberg Group publishes the correspondent banking questionnaire as an industry standard, not as law. Your sanctions obligations come from the regimes you screen against and from SAMA requirements. The questionnaire is how respondents test whether you meet them, so the evidence needs to be consistent with your policy and your actual filter settings.
How to use this checklist
For each item, ask three questions. Is the setting recorded somewhere? Is it recorded with a date and version? Can you export it for a reviewer without a developer's help? If any answer is no, you are relying on narrative.
Group A: What the filter screens against
1. List versions screened
Log each list (UN, local, OFAC, EU, UK and any others your risk assessment requires), its version or publication date, the date it loaded into the filter, and any load failures. This matters because a questionnaire answer of "we screen against OFAC" means little without proof the list was current on the dates in question.
2. Field parsing rules
Log which message fields are screened (for example, ordering customer, beneficiary, intermediary and free-text remittance fields) and how each is parsed. This matters because names and vessel or entity references often sit in unstructured fields, and unscreened fields are the first gap a reviewer probes.
3. Batch versus real-time coverage
Log which payment flows, channels and products pass through real-time screening and which are screened in batch, with the batch schedule and run confirmations. This matters because a reviewer needs to know whether any flow can settle before it is screened.
Group B: How the filter decides
4. Fuzzy-match thresholds
Log the match algorithm, threshold score per list or per field, and the date and approver of every change. This matters because the threshold is the single most asked-about setting, and a change with no record makes your historical results hard to defend.
5. Name-transliteration handling
Log how Arabic names are transliterated to Latin script and back, which variants are generated, and how spelling differences are treated. This matters because a single Arabic name can be written many ways in Latin script, and a filter that tests only one spelling can miss a true match.
6. Legal-entity versus individual logic
Log whether the filter applies different rules to individuals and entities, for example how it handles corporate suffixes, trade names, ownership references and date-of-birth data. This matters because the matching logic that suits a person's name often performs poorly on company names, and the reverse.
Group C: How the filter is governed
7. Override and release audit trail
Log every alert disposition: who closed or released it, when, the reason code, the supporting rationale, and any second-level approval. Also log changes to whitelists or good-guy lists. This matters because overrides are where control failures hide, and questionnaires ask who can release a hit and how that is reviewed.
8. Periodic testing records
Keep dated records of filter testing: test data used, expected and actual results, defects found, remediation and sign-off. This matters because a reviewer wants evidence that you test the filter, not a statement that you do. Where testing is independent, keep the independent report alongside your own results.
Turning the log into questionnaire evidence
Once the eight items are captured, build a short evidence pack that you can reuse across questionnaires:
- A configuration snapshot exported on a stated date, covering items 1 to 6.
- A change log for lists, thresholds and rules.
- A sample of override records with their approvals.
- The latest testing record and any remediation tracker.
- A one-page statement mapping each questionnaire answer to its artifact.
Review the pack on a fixed cycle and after any material filter change. An answer that points to an exported artifact is easier for a respondent to accept and easier for your own team to keep consistent from one questionnaire to the next.
Common gaps to check first
- Logs that retain alerts but not the configuration in force at the time of the alert.
- Threshold changes made by a vendor or IT team without compliance sign-off.
- Free-text fields excluded from screening without a documented rationale.
- Batch processes with no run confirmation.
- Testing performed once at implementation and not repeated.
If your records show any of these, fix the logging before the next questionnaire arrives, not after.
How CISO Consulting can help
Our Sanctions Compliance Program service is a design or review of your sanctions compliance program covering UN, local, OFAC and EU regimes, including screening, trade and payment controls, escalation and reporting. It is delivered as a project of 6–12 weeks, following four steps: assess sanctions risk across products and geographies, design policy, screening coverage and escalation, test screening quality and control testing, and train front-line staff and decision-makers.
The deliverables include a sanctions policy and procedures, a screening coverage assessment, control testing results and training for front-line staff. The work covers trade-finance and correspondent banking controls and is aligned to Sanctions, SAMA AML/CTF and Wolfsberg frameworks, so the evidence your filter produces matches the answers you give respondents.
If you are preparing for a questionnaire cycle, start with the eight items above, then talk to us about closing the gaps.
