Why "no match" in a vendor database will not protect you from the regulator

The uncomfortable truth

In the majority of cases, a search against a comprehensive global vendor database returns nothing. That is not proof the customer is low risk. Most people who launder money are not sanctioned, not PEPs and have no adverse media under their own name.

Several of the largest Nordic and Baltic money-laundering cases involved institutions that held commercial screening subscriptions. The risk was not visible in name lists; it was visible in the customer profile: structures, jurisdictions, flows and stories that did not add up.

What the law actually requires

Neither the EU AML Directives, the Swedish Money Laundering Act (2017:630), the Norwegian Anti-Money Laundering Act (2018) nor the EBA Risk Factor Guidelines require an obligated entity to license a commercial vendor database.

They require: screening against applicable sanctions lists; reasonable, risk-based measures to identify PEPs, family members and close associates; identification and verification of the customer and beneficial owners; understanding the purpose of the relationship and, in high-risk cases, the source of funds and wealth; enhanced measures where risk is high; and documentation that shows why the decision was taken.

This is a general overview, not legal advice. Each organisation must check the rules and supervisory guidance that apply to it.

Responsibility does not move to the tool

Whether or not you screen against a commercial database, the obligated entity remains responsible for the customer. A "no match" result does not transfer that responsibility to a vendor, and it does not replace a risk assessment.

Supervisors typically criticise firms not for missing a specific subscription, but for failing to assess and document contextual risk.

Risk lives in the profile, not the name

Indicators that matter more than a clean name search: unclear or layered ownership, nominee directors, secrecy jurisdictions, business activity that does not fit the customer, wealth that cannot be plausibly explained, high-risk corridors, cash intensity, and a relationship purpose that makes no economic sense.

A structured EDD weighs these factors explicitly, so that a high-risk profile is visible even when every database search is empty.

EDD is a point-in-time snapshot

An EDD is old tomorrow. Ongoing monitoring is a separate obligation, often sold as an expensive subscription. But the EDD snapshot is what the organisation knew when the decision was taken, and it is what you show the regulator to prove that you assessed the risk with reasonable measures at that moment.

You are judged on whether your measures were reasonable and documented at the time, not on information that only surfaced later.

What good enough looks like

Verified identity and ownership from official registers. Screening against official sanctions lists, with any incomplete screening recorded as incomplete. A risk-based PEP assessment. Relevant adverse information weighed for materiality and current relevance. A documented assessment of jurisdiction, structure, product and relationship risk. A reasoned conclusion and the measures applied.

When the profile shows unresolved ownership, possible sanctions or PEP exposure, or wealth that cannot be explained, good enough means escalating to an experienced investigator.

How EDD Solution fits

EDD Solution produces a structured, time-stamped EDD snapshot from official registers and official sanctions lists, scored on five transparent risk domains, with evidence lineage and a documented rationale. It is a helping tool: the buyer remains responsible for the EDD and the decision. Where the risk calls for it, the report recommends an expert review by Andréas Hobbelin.