Complianceby Norvext
Language

LibraryYou asked

Updates & insights

Practical explanations, platform changes and regulatory developments for teams that need decisions they can defend.

All publicationsExplainersPlatform updatesRegulatory changes
A split card: UK, Latvia and Estonia publish beneficial ownership as free open data, while the rest of the EU is closed, paid, or accessible only through a manual, case-by-case request via BORIS or a national registry.
Explainers

Free, open beneficial-ownership data exists in three EU countries. Here's how we cover the rest.

Companies House, Latvia's UR and Estonia's e-Business Register hand over who actually owns a company — free, open, machine-readable. Most of the EU closed that door in 2022. The EU's own fix, BORIS, has technically connected only 17 of 30 countries so far, and even there it's a manual, one-company lookup, not an API. We don't wait for that to get fixed — where a registry is closed or paid, we connect a provider for that specific country.

Read publication
A split card: the destination Türkiye is not sanctioned and the export is legal, while the same good comes back review-required because it is a high-priority dual-use item on a known Russia re-export corridor.
Explainers

It's legal to ship to Türkiye. That isn't the same as a clear shipment.

"The destination isn't sanctioned" is a fact about the country, not about the goods. For a high-priority item, a legal export to Türkiye, Kazakhstan, Armenia or the UAE is exactly the diversion route — and the check says so.

Read publication
A six-step chain showing every party named in an ISO 20022 payment message — sender bank, ordering institution, ordering customer, intermediary (highlighted as easy to miss), beneficiary bank, beneficiary — illustrating that a name-only check on the invoice covers only one of six parties.
Explainers

The payment message names six parties. You checked one?

A wire instruction isn't one name — an ISO 20022 message names up to six parties across the chain, and sanctions exposure can sit on any of them, not just the one you were told to check.

Read publication
A live '150+' counter above a grid of source categories with their own counts — sanctions, export control, PEP/EDD, maritime risk, MDB debarment, customs — illustrating that the aggregate number sums categories answering different questions, not one capability.
Explainers

What's actually behind "150+ sources"?

It's a real number, not a marketing round-up — a live count from the source catalog, not copywriting. But it's a sum across categories that do very different jobs, and no single check you run touches all of them.

Read publication
A PEP status plate above three enhanced due diligence steps — source of funds and wealth, senior-level approval, ongoing monitoring — illustrating that a PEP match calls for closer review, not automatic refusal.
Explainers

They came back as a PEP. Is that bad?

A PEP hit is a signal to look closer, not a reason to say no. Refusing every politically exposed person on sight is a documented supervisory mistake, not a compliance best practice.

Read publication
A split card: what you remember — 'we checked it' — versus what you can prove, which is empty unless the list version was kept with a timestamp, illustrating why negative results need the same evidence discipline as positive ones.
Explainers

We checked. Nothing came up.

A clean result today doesn't prove what you saw eighteen months ago. Sanctions lists change constantly, and overwriting yesterday's data destroys your own alibi.

Read publication
A grid of European country codes colour-coded by beneficial-ownership access: open (UK, Latvia, Estonia), by legitimate-interest application (Norway, France, Belgium), and closed (Lithuania, Poland, Germany, Denmark, Slovakia), illustrating that finding a company in a registry doesn't mean finding who owns it.
Explainers

Who actually owns this company?

A registry that shows a company's directors doesn't show who owns it — and since a 2022 EU court ruling, most of Europe closed the second half to the public. Free, open beneficial-ownership data now means three countries, not twenty-seven.

Read publication
A shrugging figure between two verdict panels: WHO screening comes back clear, while WHAT—the goods classification—remains unchecked, illustrating that clearing the buyer doesn't clear the shipment.
Explainers

The counterparty came back clean. The deal is still illegal.

Screening the buyer answers one question. Whether the goods themselves are allowed into that destination is a separate one—and a clean counterparty result doesn't touch it.

Read publication
Diagram showing one payee name splitting into two different results: Verification of Payee returns no match, while sanctions screening returns an exact match on the same name.
Explainers

“VoP came back clean.” So sanctions are cleared too?

A Verification of Payee “no match” answers a narrower question than “is this sanctioned” — the two checks can genuinely disagree on the identical name, and only one of them is a sanctions clearance.

Read publication
Diagram showing CN code 8542 branching into six different real export-control outcomes — from no control at all to EU Dual-Use, EU Military List, US and UK control-list entries — all sharing the same ten-digit customs code.
Explainers

“We have the CN code.” Isn’t that enough for export control?

A CN/TARIC code is a customs classification, not an export-control determination — the same heading can cover a routine commercial item and a controlled dual-use or military one, and a bare code search finds almost none of that difference.

Read publication
Diagram showing a company marked as screened clean on one side, connected by an ownership arrow to its director or beneficial owner on the other side, flagged as not yet checked.
Explainers

“The company came back clean.” What about whoever’s actually running it?

A clean company screening checks the legal entity’s own name against sanctions lists — it says nothing about the officers and beneficial owners behind it, and one of those people can be sanctioned while the company itself has never been listed.

Read publication
Diagram showing an AI model's unsourced memory branching into two equally confident but unverifiable answers, clean or a match, contrasted with a single sourced answer carrying a citation and list-state date.
Explainers

“I checked it in ChatGPT.” It said they’re clean.

An answer with no source is unverifiable in both directions — it can wave through a real hit as confidently as it can flag a clean counterparty, and nothing in the reply tells you which one just happened.

Read publication
Diagram showing eight different spellings of one name — Latin and Cyrillic, official and informal — all converging on a single resolved identity.
Explainers

Why does one name return 200 matches?

A useful match count isn't low or high — it's explainable. Screening compares one identity against every spelling it has ever used, and a short name needs a second signal before it counts.

Read publication
Diagram showing the customer as controller and Norvext as processor acting on documented instructions.
Explainers

Is it legal to send counterparty data to Norvext?

The answer depends on roles, purpose and instructions—not on whether a name is typed into a compliance tool.

Read publication
Three-layer diagram showing the database in Stockholm, application servers in Frankfurt and subprocessor operations across multiple countries.
Explainers

“The data stays in Europe.” All of it?

Data residency is not one location. A useful answer separates storage, application processing and the providers needed to run the service.

Read publication