Screen against the lists. Then keep screening.

Every screen is checked live against global data that brings together sanctions lists, politically exposed persons, wanted lists and debarments from 300+ official sources in most countries. On top of that, Verifia pulls OFAC, the EU consolidated list, the UN Security Council list, UK OFSI and Sri Lanka’s own UNSCR 1373 designations straight from their publishers every night, and keeps the CBSL list of prohibited schemes as a watch list.

Adverse media sits alongside the lists, so a match is not only a legal designation but a reputational one. It searches the public web rather than a curated news archive, so “nothing found” is reported as a weaker answer than a sanctions clearance, with the number of sources searched. Names are matched across spellings, including Sinhala and Tamil transliterations.

What the lists do not hold is a complete Sri Lankan PEP register, because no official one is published. Local politicians and state-company officials are covered as far as the global data covers them; your own watch list fills the rest.

A hit does not decide anything on its own. It returns as a structured outcome you can route to a human, which is what the review queue in the console is for. Screening that silently auto-declines is screening you cannot defend to a regulator.

Sanctions lists name the people governments have designated. They do not name the person who forged a payslip at another lender last month. Companies on the platform can report confirmed fraud to a shared blocklist, and when a screen includes the customer’s NIC it is checked against that list alongside the sanctions lists and adverse media.

Only a salted, one-way hash of the identifier is stored, never the NIC itself. A company sees its own entries and the size of the list, not anyone else’s entries; what it learns on a match is the reason the reporting company gave. A screen sent with a name alone cannot match a hashed NIC, and the result says the blocklist was not screened rather than reporting it clean.

Customers go into a register that is re-screened when a list changes, so a name that becomes sanctioned after you onboarded still surfaces. Politically exposed persons are escalated to enhanced due diligence and carry periodic review rather than sitting on a single cleared result from months ago.

Screening tells you who someone is. Transaction monitoring tells you what they are doing. Alongside rules your team builds and backtests without a developer, Verifia ships money-mule patterns — pass-through, fan-in, fan-out, a sudden new counterparty, a dormant account waking up — and a Sri Lanka pack for hundi, cross-border transfers, prohibited schemes, crypto and betting, round-tripping, round amounts, odd hours, cash-intensive activity and turnover that does not fit the customer’s profile. The pack arrives as drafts, so you switch on each rule after testing it on your own history.

Customers are also read as a network. Shared faces, devices and counterparty accounts connect people who look unrelated, which is how a mule ring shows up, and a customer who behaves unlike their peers is flagged even when no single rule fires. Device signals, including app attestation, feed the same risk score. Alerts are ranked by a model that learns from how your own cases were closed, once enough of them have been.

Suspicious Transaction Report, Cash Transaction Report and electronic fund transfer drafts are exported as goAML XML, built to the schema the Financial Intelligence Unit of the Central Bank of Sri Lanka publishes. Drafts, deliberately: the filing decision and its contents remain yours, and a system that files on your behalf is a system that files your mistakes.