Adverse media screening, also called negative news screening, is the search of news and other public sources for negative information about a customer or the people behind it, especially anything that points to financial crime: fraud, corruption, money laundering, sanctions evasion, tax crime and the like. Most of the work is in deciding whether an article is about your customer, what it says happened, and whether any of it changes how you should treat the relationship.
This piece follows a single alert through those decisions, one step at a time. For how adverse media fits into checking a business customer as a whole, see our guide to KYB verification.
Why so many hits are noise
A screening search starts with a name, and names are shared. In the 2010 US Census, 2,442,977 people had the surname Smith. A search on a common name returns everyone who has it, and a search on an uncommon one still returns anyone whose name is spelled similarly.
Names carried between languages and scripts multiply the possibilities. The Wolfsberg Group, an association of global banks, gives an example in its negative news screening FAQs: Piotr Czajkowski, Pyotr Tchaikovsky and Piotr Chaykovskiy are the same name, written three ways. Names also appear in different orders, shortened to initials, or with and without a middle name or a second surname, so a system that matches loosely enough to catch every variant also catches a great many strangers.
The second source of noise is context. Your customer can be named in an article without being accused of anything.
Each hit raises a few questions, starting with whether it is about your customer at all.
Is the article about your customer?
Resolve the identity before you read the allegation. Otherwise a vivid story about a stranger colours everything that follows.
The Wolfsberg FAQs separate strong grounds for clearing a hit, such as a clearly different name or a mismatch in a key identifier like date of birth or gender, from weaker ones such as profession or place of residence, which make a match less likely without ruling it out.
Compare whatever the article gives you against what you hold:
| Identifier | How much it settles | What to watch for |
|---|---|---|
| Date of birth or age | A lot, when present | Articles give age at the time of the story, so work out the birth year |
| City or country | Some | People move, and a city can have many residents with the name |
| Occupation or employer | Some, more when an employer is named | Job titles in news copy are loose |
| Company name or registration number | A lot, for business customers | Similar company names in other countries |
| Other people named | Often decisive | A co-director or family member who appears in both |
| Photograph | Some | Low-quality images, and photos of a different person with the same name |
Most articles carry only a few of these. A single strong mismatch, such as an age that is twenty years out, is usually enough to clear a hit. Agreement on one weak identifier is not enough to confirm one.
What part does your customer play in the story?
A true identity match still needs reading. Note what role the customer has: the subject of the allegation, a victim, a witness, someone quoted, or a company in the same sector as the one under investigation. Only the first is adverse. The rest are context, and clearing them is quick once you have read the article rather than the snippet. The Wolfsberg FAQs list a customer who is not the subject of the story, such as a plaintiff, as a reason to discount the hit.
How far did the story get?
Every adverse story describes a matter at one point in its life. The Wolfsberg FAQs describe the progression as a "risk stage" that "starts with an allegation, which then likely becomes an investigation which may lead to charges ending with a conviction". A matter can also stop at any point, or end in an acquittal.
Plenty stop. In the 2023 fiscal year, US attorneys declined to prosecute 54 percent of the fraud suspects in the matters they concluded. In the most recent Bureau of Justice Statistics study of felony cases in the 75 largest US counties, which followed cases filed in May 2009 for a year, about a quarter of the cases decided within that year ended in dismissal.
Early stages also tend to get more coverage than outcomes, so a case being dropped can get far less attention than the arrest did. When an article reports an early stage, search for what happened next before you record it: a later report of the outcome, a court record, an official statement, or a correction from the publisher. Record the stage you could confirm, and say plainly when the outcome is unknown.
One story or ten?
Several articles can trace back to a single report. A 2018 study of a year of articles from major Dutch news outlets found that at the country's largest news site, three in four articles were based on copy from the largest national news agency, and that much of the online news it studied reused agency text with little or no editing. A press release can also be republished almost word for word by outlets that never checked it.
So group the hits that describe the same event in the same words, and trace them back to the first report or the underlying document. A court filing or an official statement carries more weight than a summary of it, and an anonymous blog post or a forum thread carries less than either.
The Wolfsberg FAQs describe source credibility in similar terms: content that has been through editorial oversight is generally more credible, content that readers can edit or that reads as opinion is less so, and a report that other reputable sources corroborate is more reliable than one they do not.
Does it matter for this relationship?
A confirmed, adverse, well-sourced story still needs weighing against what the customer is going to do with you, on three things: how serious the matter is, how recent it is, and how relevant it is.
Financial crime, corruption and sanctions evasion bear directly on most financial relationships. A decade-old traffic offence does not.
On recency, the Wolfsberg FAQs suggest deciding how far back screening should look, and say a multi-year look-back may be appropriate, for all coverage or with longer or shorter periods for different kinds of offence. An old story still counts, and it should be read alongside everything that has happened since.
On relevance, an allegation about how someone ran a payments business matters more to a payments provider than the same allegation about their conduct in an unrelated hobby club.
Writing the decision down
Every hit should end in a recorded decision that someone else can follow later, and the Wolfsberg FAQs say procedures should require a recorded rationale for every alert decision, including the ones cleared as false positives. The possible outcomes are few: cleared as a different person, cleared as context, cleared as an unreliable source, noted as a true match that does not change the risk, or escalated for review.
The record needs five things: the article and where it came from, the identifiers you compared and the result, the customer's role in the story, the stage the matter reached, and the conclusion with the reviewer's name. With those written down, the decision can be checked, or revisited when the story develops, without starting again.
One alert, start to finish
The alert below is a composite, and the people in it are invented.
A payments company is onboarding a sole trader who runs a restaurant in Manchester. The customer gave a full name and a date of birth in 1981. Screening on the name returns fourteen articles.
Nine are about a local politician with the same name in another country, aged in his sixties. The age and the country both differ, so all nine are cleared as a different person in one step.
Two are local news stories about a burglary at a restaurant whose name matches the one on the application, and the customer is quoted as its owner. Right person, but the customer is the victim. Cleared as context.
The remaining three describe a man with the same name, aged 38 in 2019, who was charged that year with fraud connected to a restaurant business in Manchester. An age consistent with a 1981 birth, the city and the trade all fit, so this is treated as a probable match, with the supporting identifiers recorded. On reading, the three articles are one wire report carried by three sites, which makes it one source rather than three. A search for the outcome finds a short court report from 2020 saying the case was discontinued.
So fourteen hits come down to one relevant story, probably about the customer, which reached a charge and was then dropped. The file records each step: which hits were cleared and on what grounds, which report the three articles came from, and the court report on the outcome. The case goes to a reviewer with the question already narrowed to one thing: whether a case discontinued in 2020 changes anything for this account.
Screening every customer fairly
A screening process can end up treating some customers worse than others for reasons that have nothing to do with risk.
Some names are shared by far more people than others, and names from some languages have more spelling variants in Latin script. Customers with those names will generate more hits, so judge each hit on what it shows rather than on how many there are. The number of hits mostly reflects how common a name is and how often the people who share it make the news. On its own it says little about risk.
Results also age. A customer who was clean at onboarding can appear in tomorrow's news, and one who was once charged can have been cleared since. Re-screen on a schedule that matches the risk, and re-read old true matches when you do.
Where Sixtyfour helps
Sixtyfour's agent does the research behind each hit. It searches news and records for potentially adverse coverage of a customer and the people behind it, and puts each result beside the identifiers that support or weaken the match, with its source attached. Anything it could not establish is reported as open. Your analysts review the evidence, and the decision about the relationship stays with them.