Adverse media screening for vendors: what to search, how to judge a hit, and what to keep

What adverse media screening is

The Wolfsberg Group, an association of global banks that publishes financial crime guidance, says there is “no universally agreed and accepted definition of Negative News” and offers a working one: “information available in the public domain which FIs would consider relevant to the management of Financial Crime risk” (Negative News Screening FAQs, question 1, May 2022). Two parts of that definition matter for a payer. The information is public: news, court and regulator publications, not private databases. And it has to be relevant to financial crime, which is why a vendor's bad reviews or a parking ticket are not what you are looking for.

It sits next to sanctions screening, not in place of it. A sanctions check has a defined list, a yes-or-no answer and, for OFAC, strict liability. Adverse media has no list and no single answer; it is a judgment, and the record of how you made it is most of its value.

Is it required?

Not for an ordinary business paying vendors. The FinCEN customer due diligence rule for banks, 31 CFR 1010.230, requires identifying and verifying beneficial owners through risk-based procedures; its text does not mention media searches. What the sources do say:

So the honest answer for accounts payable is: required nowhere by name, expected wherever a regulator or prosecutor asks how you knew who you were paying. The DOJ guidance is written for companies of every kind, not just banks, and it is the one most likely to be read against an ordinary company's vendor program.

Which vendors to search

A risk-based program decides this in writing. The DOJ guidance names the third parties it worries about: “the agents, consultants, and distributors that are commonly used to conceal misconduct,” and partners with relationships with foreign officials. In an accounts payable file the same logic points to:

• Intermediaries: agents, consultants, brokers, distributors and anyone paid a commission or success fee.
• Vendors that touch government: customs brokers, permit expediters, anyone who deals with officials for you.
• Vendors in higher-risk countries or industries for your business, and new vendors with large first payments.
• The people behind a small or closely held vendor: its owners, officers and the person who signed the W-9. Searching only the company name misses most of what matters for a two-person firm.
• Any vendor where something already looks wrong: a TIN mismatch, a name that does not match the bank account, a change of bank details, or a business you cannot find on a state register.

What to search for

The Wolfsberg FAQs recommend defining “key words” (search phrases), known as “search strings” (question 19), and warn that “Use of generic words, which refer to stages of a crime rather than crime itself, will affect the volume of alerts generated.” In practice that means two kinds of term, kept in balance:

• Offence terms, which name a crime: fraud, money laundering, bribery, corruption, embezzlement, tax evasion, sanctions violations, terrorism, trafficking, organized crime.
• Stage terms, which name a step in a case: arrested, charged, indicted, convicted, sentenced, fined, settled. These find more, and much of what they find is about other people and other cases.

Wolfsberg also suggests that, depending on risk appetite, certain phrases be searched on an exact-match basis to cut irrelevant results (question 18). In a search engine that means quotation marks around the name and around two-word terms such as “money laundering”.

Building searches that work in Google

A widely shared adverse media search string is one long query: the name in quotes followed by forty-odd terms joined by OR, many with a trailing asterisk (launder*, bribe*, prosecut*). Pasted into Google as one search, it does less than it appears to:

• The asterisk is not truncation in Google. Google's own help page lists quotation marks, the minus sign, site:, before:, after: and filetype: as operators and does not document the asterisk at all (Refine Google searches). Google Guide, a long-running independent reference, describes * as a placeholder for a whole word and says “Google ignores asterisks (*) that are not surrounded by spaces” (The * operator). So launder* is read as launder, and the forms you meant (laundering, laundered) have to be written out.
• Long queries get cut. Google Guide states that “Google limits queries to 32 words” and that operators count toward the limit (Interpreting your query). On that rule a forty-term string loses everything after the first few terms. Google has not published a current figure; the safe course is to keep each query short whatever the limit is today.
• OR has to be uppercase. Google Guide: a lowercase or is treated as a search word, and OR (or the | bar) applies to the terms immediately next to it (The OR operator). Parentheses are not documented as grouping in either source, so the builder below does not rely on them.

The fix is several short queries instead of one long one: the quoted name plus one family of terms at a time, each written out in full. The adverse media search builder does that from a name, its variants and an optional location, keeps every query well under 32 words, and gives one-click Google and Google News links and a search log to save with the vendor file.

Match, namesake or false positive

Most hits are about someone else with the same name. The Wolfsberg FAQs list the grounds on which an alert can be discounted, including a significant difference between the customer's name and the name in the article, differences in key secondary identifiers such as date of birth, date of incorporation or gender, and a source not deemed credible, “e.g., blogs, tabloids” (question 24). For a vendor, the identifiers you usually hold are:

Classify every result you review into one of four outcomes and write down why: confirmed match (identifiers line up), potential match (cannot rule in or out; needs more information, often from the vendor), false positive (a different party, with the identifier that shows it), or no material adverse information found. Do not treat a name match alone as a match.

Judging a real hit

A confirmed match is the start of the analysis, not the end. Three questions from the Wolfsberg FAQs:

• Is it relevant? The definition is information relevant to financial crime risk. A product recall or an employment dispute is a business-risk question, not a financial-crime one; decide in your policy whether you care about those too.
• Is the source credible? “The credibility of the media source will be a key factor in determining whether it should be used” (question 14). A regulator's press release or a court record outranks a news story, and a news story outranks a blog. Reporting corroborated by other reputable sources is more reliable.
• What stage is it at? Wolfsberg describes the “maturity of the offence”: it “starts with an allegation, which then likely becomes an investigation which may lead to charges ending with a conviction” (question 5). Record the stage and say it accurately. An allegation is not a finding, and an acquittal or dismissal belongs in the record too.

What follows is a business decision: approve with a note, ask the vendor about it, apply extra controls (no prepayments, a second approver), escalate to legal or compliance, or decline. For a bank, the SAR FAQ above is explicit that negative news alone does not decide the filing question; the same logic applies to a payer's decision to stop doing business.

When to search, and how far back

Wolfsberg lists the options as daily, weekly, monthly, quarterly, annually, whenever due diligence is done including onboarding, on a triggered event, periodically or ongoing, and leaves the choice to the institution (question 10). It suggests that once an initial review has been done, for example at onboarding, later screening may only need to cover new media events, and that a multi-year look-back period may suit, longer or shorter by type of offence. For a payer a workable pattern is: search at onboarding for the vendors your policy covers, re-search on a trigger (ownership change, bank change, a payment well above normal, a TIN problem), and re-search the highest-risk group on a fixed cycle. Google's after: operator, which Google documents, limits results to a look-back window.

What to record

Wolfsberg stresses documenting the alert-handling approach and the rationale for it (question 23), and procedures that give “a clear demonstration of the logic applied in alerts assessment and the rationale for decisioning made in respect of all alerts (including true and false positive matches)” (question 24). For each vendor search keep:

• The date, who ran it, and the names and variants searched.
• The exact queries, the look-back window and the search engines or databases used.
• Each result reviewed: title, publisher, date, link, and the outcome (confirmed, potential, false positive) with the identifier that decided it.
• The conclusion, any escalation, and the business decision.

The search builder produces this log as text, ready to paste into the vendor record. Keep it with the sanctions screening result and the TIN match, so one file shows the whole onboarding decision.

Using an AI assistant

AI assistants are increasingly handed this job with a long prompt and a list of names. They can read and summarize results quickly, but the same rules apply, and a few more:

• Ask for a link and a publication date for every finding, and open the links. A summary without a source is not evidence, and a link that does not say what the summary claims is worse than none.
• Check how the assistant searched. If it passed one long boolean string to a search engine, the limits above apply to it too; short, separate queries are more reliable whoever runs them.
• Do not let it decide a match. Identity checks against the identifiers in your file, and the outcome and its reason, are yours to record.
• Mind what you paste. Names, dates of birth and addresses of individuals are personal data; follow your own data-handling policy before putting them into any outside tool.

Questions people ask

Related: sanctions screening for payers, the OFAC 50 percent rule for vendors, OFAC enforcement action finder and how to verify a vendor exists.