Author: Linus Etchingham

In 2026, the FCA, HKMA, Gibraltar Gambling Commissioner and UAE CMA each found that sanctions screening systems detect exact matches but fail on manipulated names — and that accountability cannot be outsourced to the vendor. Here is what the four regulators now expect, and how to evidence that your screening meets the 2026 requirements.

The FCA assessed sanctions screening systems at over 150 UK financial services firms and found that systems missed one in four names containing minor variations. The most common root causes of sanctions breaches were weaknesses in screening, alert management, and due diligence. Firms must now demonstrate, with evidence, that their systems are tested, tuned, and effective.

Threshold calibration decisions can no longer sit quietly at the operational layer. With EBA guidelines now in force, financial institutions must show documented, risk-based evidence for how their sanctions screening systems are configured, and why. Here's what that means in practice.

Screening failures regularly stem not from system errors, but from name variation that pushes similarity scores below detection thresholds. The sanctioned person exists in your dataset. Your system operates as designed. But no alert generates. Can you prove your fuzzy matching controls detect manipulated names?

Learn what sanctions screening system testing is, why regulators now expect it, and how independent validation supports defensible sanctions compliance.

Sanctions compliance in 2026 demands explainable controls, timely list management, and defensible screening. Understand the key challenges facing financial institutions, and how leading firms are strengthening sanctions programmes.