Ongoing Monitoring and AML Alerts

What it does

Verification is a moment-in-time check. Monitoring is continuous — once an applicant is approved, we keep them on a watchlist and re-screen them against sanctions, adverse media, and PEP databases on a schedule. If anything changes (a new sanction designation, a new news story, a politically-exposed-person status update), an alert lands on the Monitoring page and we email the applicant's primary manager.

Think of verification as "is this person OK to onboard today?" and monitoring as "is this person still OK?"

Where it lives

Insights → Monitoring in the left sidebar.

Enabling monitoring

Monitoring is a plan feature (Ongoing Monitoring) and you choose who is monitored:

• Per verification — open an approved verification and use the Ongoing AML monitoring card: pick how often the person is re-screened (daily, weekly or monthly, on top of the daily checks below) and press Start. Stop ends it; a paused record can be resumed. The same is available from the API: POST/GET/DELETE /api/v1/kyc/requests/:id/monitoring (developer docs).
• By default, for everyone you approve — Settings → Fraud prevention → Rules → Enrol approved verifications in ongoing AML monitoring automatically. Switch it off to monitor only the people you choose. An organization that never touched the setting keeps the original behaviour: every approval is enrolled.

An automatic enrolment that cannot go ahead (the plan doesn't include monitoring, or there is no credit for a person beyond the included quota) is skipped and written to the audit log (monitoring.enroll_skipped); a manual one tells you why (not in your plan, or not enough credit).

Cost

Monitoring is billed per monitored person per year: one unit when a person is enrolled, and another each year they stay enrolled. Your plan includes a number of monitored people per year (or is unlimited but counted); beyond that each unit is charged at the Ongoing AML monitoring price, from your credit — the card on the verification and Settings → Credits & usage show the figures. If a yearly renewal can't be paid for lack of credit, monitoring for that person is paused (audit event monitoring.paused_for_credit) instead of continuing unpaid; add credit and press Resume.

How people are re-screened

An alert is raised only for something new: a sanctions hit that wasn't open, a person who became a PEP, a PEP who moved to a stricter tier, or adverse media that wasn't there before. A status that gets better (a PEP leaving office) is recorded but doesn't alert. The decision-time result of the verification is the starting point, so re-confirming it stays silent.

PEP tiers

A PEP hit now carries a tier, shown on the alert and in the verification, usable in policies as sanctions.pepTier, and sent in webhooks (pepTier):

When the screening source classifies the person itself, that class is used. Otherwise Certivant reads the person's listed positions and topic tags — a heuristic, so always read the position on the alert before deciding. A higher-risk tier counts for more in the customer risk rating: tiers 1 and 2 carry the full PEP weight, tier 3 two thirds, tier 4 half.

Adverse media is flagged when a hit's topics say the person is wanted, charged, or the subject of a regulatory action. It is available as sanctions.adverseMedia in policies and workflows and raises a monitoring alert. It does not change the trust score.

The names of the underlying list vendors are never shown or sent: alerts, audit entries and webhooks say what was screened (sanctions, PEP, adverse media), not who answered.

Alert types

The alert queue

The Monitoring page shows every active alert, with:

Filters

By type, severity, status, date, owner/team. Partner orgs also get a Sub-tenant filter (once requests carry sub-tenant tags) to narrow alerts to one of your end customers — see partner attribution.

Steps — handle an alert

SLA & escalation

Alerts not actioned within the SLA window (set under Settings → KYC/B → Monitoring SLA) appear in the Overdue filter. They don't auto-resolve — they just become more visible so you don't forget.

Stopping monitoring

If you no longer need to monitor an applicant (they offboarded, they closed their account, you're cleaning up cost):

• Open the applicant's verification request detail.
• Ongoing AML monitoring card → Stop.

Historical alerts are preserved; no new ones will fire. A year already paid is not refunded.

Troubleshooting

Lots of false-positive alerts

Three common causes:

1. Name normalisation is off. Make sure your applicants enter their legal name as it appears on their ID, not nicknames.
2. DOB missing on the applicant. Sanctions matching weights date-of-birth heavily — without it, every name match scores high.
3. Screening too broad — under Settings → KYC/B → Sanctions provider, you may have sanctions, PEP and adverse-media screening all on. Tighten to your regulatory requirements.

A real sanctions hit on a customer I trust

Don't dismiss it. Even false hits in your gut judgment must be reviewed and documented before resolution — that's the regulator-required trail. Resolve with a detailed note explaining why you concluded it wasn't a match.

Monitoring is enabled but I get no alerts

The data sources update at most once per day; alerts can take 24h to fire. If you're sure something should have triggered, check Settings → KYC/B → Monitoring providers to confirm a provider is configured and enabled.

Related

• KYC list & detail — verify a person in the first place.
• Reports — generate compliance reports including monitoring activity.
• Audit log — every monitoring action is in here.