A false positive in AML/CTF screening is an alert that flags a customer as a possible politically exposed person (PEP), a sanctions match or an adverse media subject, when on review the person is someone else. For an Australian real estate agency, law firm, accounting practice or conveyancer, the way to reduce them is not to loosen the search. It is to feed the search better identity data, review each alert in a set order, and record why you cleared or escalated it. This guide sets out how, and what to keep on file for each alert.
TL;DR
- False positives mostly come from common names, spelling variants and thin identity data, so the biggest reduction comes from collecting full identity information before you screen.
- AUSTRAC’s guidance points to searches that tolerate minor discrepancies, so tightening matching until alerts vanish trades noise for missed matches. That is the worse risk.
- Every cleared alert is a decision you may need to defend, so record the evidence, the reasoning and the person who approved it. Keep it for 7 years.
- A possible sanctions match is different: take legal advice before proceeding, and never deal with a designated person’s assets without an Australian Sanctions Office permit.
Table of Contents
- What a false positive means in AML/CTF screening
- Why screening systems raise false positives
- Why more alerts is not a safer position
- Five ways to reduce false positives without missing real matches
- How to review, clear or escalate a possible match
- What to keep when you resolve an alert
- Our perspective: fewer false positives start at intake
- See it working on your intake
- FAQ
- Sources
What a false positive means in AML/CTF screening
Screening compares your customer’s details against lists and databases: DFAT’s Consolidated List for targeted financial sanctions (TFS), PEP data, and often adverse media. The software returns a score for each candidate. A “hit” is a candidate above your threshold. A false positive is a hit that review shows is not your customer. A true match is a hit that is your customer. A false negative is a real match the system failed to raise, and it is the outcome that creates regulatory and legal exposure.
Any screening test that catches more genuine cases will also raise more alarms that turn out to be nothing. The difference in AML is that a missed match is not a statistic. If a customer is subject to TFS, the Australian Sanctions Office advises seeking legal advice before proceeding with dealings involving a listed person, entity or vessel. Your goal is therefore fewer unnecessary alerts at the same or better detection, not fewer alerts at any cost.
Why screening systems raise false positives
Most false positives trace back to a small number of causes.
Similar and identical names. AUSTRAC notes that customers may share the same or a similar name, and that names can have spelling variations, particularly non-English names. A transliterated name can be spelled several legitimate ways, which is why matching has to be fuzzy in the first place.
Thin identity data. A search on a first and last name alone has nothing to separate one person from another. The Consolidated List carries names and aliases, dates and places of birth, citizenships and addresses. If you only supply a name, you cannot use any of those fields to discount a candidate.
Screening before the data is complete. AUSTRAC’s guidance says that conducting PEP and TFS verification after collecting identity information helps make searches accurate. Agencies that screen at the enquiry stage, on whatever the agent typed in, generate the most noise.
Poorly calibrated settings. One match threshold for every customer type is rarely the right setting. A threshold tuned for overseas buyers purchasing through intermediaries floods a local residential file with noise, and one tuned for local files can be too loose for a complex overseas structure. Set the threshold, and the depth of review, by customer type.
Duplicate and inconsistent records. The same buyer entered twice with different spellings, or a company director captured differently in two matters, produces repeat alerts for one underlying person. We cover this in more depth in our piece on data quality and false positives at intake.
Why more alerts is not a safer position
It can feel prudent to keep the net wide and review everything. In practice, high volumes damage the control: when most alerts are obvious noise, reviewers stop reading them closely.
A Tranche 2 firm does not have an analyst team. The person clearing alerts is usually the principal, the compliance officer or a property manager with a full diary. If most alerts are obvious non-matches, the tenth alert is cleared in seconds without reading the date of birth. That is how a genuine match gets cleared by habit.
Five ways to reduce false positives without missing real matches
1. Collect complete identity data first
Capture full legal name, any other names used, date of birth, nationality or citizenship and residential address before screening starts. For companies, capture the ACN and the people behind it. A date of birth alone will discount most namesakes automatically or let a reviewer do so in a moment.
2. Screen the right people
For an individual customer, AUSTRAC requires you to establish whether the customer, a person acting on their behalf, or a person on whose behalf the service is received is a PEP or designated for TFS. Initial CDD also extends to relevant beneficial owners and persons acting for the customer. Screening the correct, fully identified people avoids two problems at once: false alerts on the wrong names, and gaps where a genuine party was never screened.
3. Keep fuzzy matching, but tune it by customer type
AUSTRAC’s guidance indicates that screening services could allow effective searching despite minor discrepancies or errors in entered data. Do not turn that off. Instead, set expectations by segment. A domestic residential seller with a full identity record and a long-standing client relationship is a different screening proposition from an overseas buyer purchasing through an intermediary. Our guide to overseas buyer AML checks shows where the risk, and therefore the appropriate scrutiny, concentrates.
4. Use ongoing re-screening on changes, not on a blind schedule
Lists change. A customer who was clear at onboarding may be designated later. Ongoing re-screening is necessary, but each re-run should compare against previous decisions so that an alert already cleared on the same evidence does not return as if it were new. Only a changed list entry or changed customer data should reopen it.
5. Prioritise alerts rather than treating them all alike
Not every alert deserves the same attention. For a property business, the practical point is a workflow that puts a date-of-birth mismatch at the bottom of the queue and a full-name, date-of-birth and citizenship agreement at the top. Tools that sit above your systems, such as a business action layer for compliance, show how governed workflows can route and audit decisions of this kind. Whatever you adopt, a person must still make the final call.
How to review, clear or escalate a possible match
A consistent review sequence matters more than speed. A workable order for a small team:
- Compare the strong identifiers. Date of birth, place of birth, citizenship and address against the list entry. A clear mismatch on a strong identifier supports clearing the alert.
- Check aliases and transliterations. The Consolidated List includes aliases, so a name that looks different may be the same person.
- Seek additional information if unresolved. AUSTRAC’s position is that if you are not satisfied that you have established a matter on reasonable grounds, you take further action, which may include collecting and verifying additional information until you are satisfied. Ask the customer for a further identifier rather than guessing.
- Clear with reasons, or escalate. Record what you compared and why you concluded it was not the same person. If you cannot rule the match out, escalate to the compliance officer.
- For a possible sanctions match, stop and take advice. Do not proceed with dealings until you have sought legal advice, as the Australian Sanctions Office directs. If you hold information that a person is subject to TFS, you must not deal with that person’s assets without an Australian Sanctions Office permit.
- Consider the next obligation. A confirmed PEP usually changes the customer’s risk rating and may call for enhanced due diligence. See our guide to enhanced due diligence triggers. Where suspicion remains after review, consider whether a suspicious matter report is required under section 41.
Our PEP screening match workflow walks through the PEP side of this sequence in more detail.
What to keep when you resolve an alert
A cleared alert is a decision, and your supervisor may later ask you to justify it. AUSTRAC requires reporting entities to keep records reasonably necessary to demonstrate CDD compliance, including the customer information collected, the verification steps, and the analysis or decision-making about ML/TF risk. System logs are among the examples given.
For each screening alert, a defensible record holds:
- the data submitted to the search, with the date and time;
- the list or database searched and the candidate returned;
- the identifiers compared and the reviewer’s reasoning;
- the outcome (cleared, escalated, reported) and who approved it;
- any further information requested from the customer.
CDD records must be kept for 7 years after the business relationship ends or an occasional transaction is complete, and AML/CTF program records until 7 years after they are no longer relevant to demonstrating compliance, according to AUSTRAC’s record keeping overview. Our explainer on the seven-year record-keeping clocks sets out when each clock starts.
Our perspective: fewer false positives start at intake
We built AML Guard for Australian Tranche 2 reporting entities, and we see the same pattern in how firms think about false positives: they look for a setting in the screening tool, when the cause sits earlier. Names arrive incomplete, the same person is typed three ways across matters, and the screening run on that data is blamed for the noise.
Our view is that the fix is mostly upstream and procedural: complete identity data before the search, a set order for comparing identifiers, and a recorded reason for every alert you clear or escalate. That is how AML Guard is built. Each identity check, screening result and officer decision sits in one case record, so the reason an alert was cleared stays on the file with the alert. For companies, beneficial ownership is determined from the ACN, and an officer approves each determination. The platform automates the lookups and the record keeping, not the judgement.
A screening result is also only as defensible as the program around it. AML Guard’s guided wizards produce the risk assessment, the AML/CTF program, a customer acceptance policy and the training manual, and can pre-fill from your risk assessment, so the review steps your staff follow match what your policies say.
See it working on your intake
If you want to see how screening behaves on your own client data, book a demo and we will walk through a realistic matter: the identity checks, the screening results, the officer’s decision and the case record. AML Guard is not self-service; every firm starts with a demo. Details of the platform subscription and per-check fees are on our pricing page. For the wider obligation, our customer due diligence guide is a good starting point.
FAQ
What is a good false positive rate for AML screening?
No regulator we have found publishes a target rate for Tranche 2 firms, and the right figure depends on your customer mix and how complete your data is. Treat a falling share of alerts that are cleared on a single obvious identifier as a sign your intake is improving. Never measure success only by alert volume, because a quiet system may simply be missing matches.
Can I switch off fuzzy matching to cut alerts?
We would not. AUSTRAC’s guidance contemplates searches that allow for minor discrepancies or errors, because names are spelled in several ways, particularly non-English names. Reduce noise by improving the data you submit and by segmenting your review, not by requiring exact name matches.
Who should clear a screening alert in a small agency?
The person you have named as compliance officer, or a trained delegate working under your written policy, with the compliance officer approving anything unresolved or any possible sanctions match. The key is that your policies say who decides and your records show that they did.
How long must I keep records of a cleared alert?
CDD records must be kept for 7 years after the business relationship ends or an occasional transaction is complete. Record the data searched, the candidate, your reasoning and the approver, so the file still makes sense to a reviewer years later.
Sources
- Initial CDD for individuals, AUSTRAC
- Overview of initial customer due diligence, AUSTRAC
- Initial CDD for a government body, AUSTRAC
- Record keeping overview, AUSTRAC
- Consolidated List, Australian Government Department of Foreign Affairs and Trade
- Your AI is not enough: business action layer for compliance, Neota Logic
Recommended
- AML False Positives & Data Quality. The Fix Starts at Intake.
- Tranche 2 AML/CTF for Australian law firms
- AML risk assessment template for Tranche 2 firms
- AML training for law firms under Tranche 2
See How AML Guard Works
Tranche 2 obligations are now in force.
Book a 20-minute demo to see how AML Guard supports your compliance from the moment your designated service begins.