Compliance
Language

LibraryYou asked

Updates & insights

Practical explanations, platform changes and regulatory developments for teams that need decisions they can defend.

All publicationsExplainersPlatform updatesRegulatory changes
A PEP status plate above three enhanced due diligence steps — source of funds and wealth, senior-level approval, ongoing monitoring — illustrating that a PEP match calls for closer review, not automatic refusal.
Explainers

They came back as a PEP. Is that bad?

A PEP hit is a signal to look closer, not a reason to say no. Refusing every politically exposed person on sight is a documented supervisory mistake, not a compliance best practice.

Read publication
A split card: what you remember — 'we checked it' — versus what you can prove, which is empty unless the list version was kept with a timestamp, illustrating why negative results need the same evidence discipline as positive ones.
Explainers

We checked. Nothing came up.

A clean result today doesn't prove what you saw eighteen months ago. Sanctions lists change constantly, and overwriting yesterday's data destroys your own alibi.

Read publication
A grid of European country codes colour-coded by beneficial-ownership access: open (UK, Latvia, Estonia), by legitimate-interest application (Norway, France, Belgium), and closed (Lithuania, Poland, Germany, Denmark, Slovakia), illustrating that finding a company in a registry doesn't mean finding who owns it.
Explainers

Who actually owns this company?

A registry that shows a company's directors doesn't show who owns it — and since a 2022 EU court ruling, most of Europe closed the second half to the public. Free, open beneficial-ownership data now means three countries, not twenty-seven.

Read publication
A shrugging figure between two verdict panels: WHO screening comes back clear, while WHAT—the goods classification—remains unchecked, illustrating that clearing the buyer doesn't clear the shipment.
Explainers

The counterparty came back clean. The deal is still illegal.

Screening the buyer answers one question. Whether the goods themselves are allowed into that destination is a separate one—and a clean counterparty result doesn't touch it.

Read publication
Diagram showing one payee name splitting into two different results: Verification of Payee returns no match, while sanctions screening returns an exact match on the same name.
Explainers

“VoP came back clean.” So sanctions are cleared too?

A Verification of Payee “no match” answers a narrower question than “is this sanctioned” — the two checks can genuinely disagree on the identical name, and only one of them is a sanctions clearance.

Read publication
Diagram showing CN code 8542 branching into six different real export-control outcomes — from no control at all to EU Dual-Use, EU Military List, US and UK control-list entries — all sharing the same ten-digit customs code.
Explainers

“We have the CN code.” Isn’t that enough for export control?

A CN/TARIC code is a customs classification, not an export-control determination — the same heading can cover a routine commercial item and a controlled dual-use or military one, and a bare code search finds almost none of that difference.

Read publication
Diagram showing a company marked as screened clean on one side, connected by an ownership arrow to its director or beneficial owner on the other side, flagged as not yet checked.
Explainers

“The company came back clean.” What about whoever’s actually running it?

A clean company screening checks the legal entity’s own name against sanctions lists — it says nothing about the officers and beneficial owners behind it, and one of those people can be sanctioned while the company itself has never been listed.

Read publication
Diagram showing an AI model's unsourced memory branching into two equally confident but unverifiable answers, clean or a match, contrasted with a single sourced answer carrying a citation and list-state date.
Explainers

“I checked it in ChatGPT.” It said they’re clean.

An answer with no source is unverifiable in both directions — it can wave through a real hit as confidently as it can flag a clean counterparty, and nothing in the reply tells you which one just happened.

Read publication
Diagram showing eight different spellings of one name — Latin and Cyrillic, official and informal — all converging on a single resolved identity.
Explainers

Why does one name return 200 matches?

A useful match count isn't low or high — it's explainable. Screening compares one identity against every spelling it has ever used, and a short name needs a second signal before it counts.

Read publication
Diagram showing the customer as controller and Norvext as processor acting on documented instructions.
Explainers

Is it legal to send counterparty data to Norvext?

The answer depends on roles, purpose and instructions—not on whether a name is typed into a compliance tool.

Read publication
Three-layer diagram showing the database in Stockholm, application servers in Frankfurt and subprocessor operations across multiple countries.
Explainers

“The data stays in Europe.” All of it?

Data residency is not one location. A useful answer separates storage, application processing and the providers needed to run the service.

Read publication