Discrepancy, Risk & Escalation Controls

Discrepancies, risk triggers and escalation controls must be handled as evidence questions, not as loose suspicions or checklist noise.

A mismatch should not automatically be turned into a risk conclusion. It should first be documented, classified and linked to evidence. Only then should the case be mapped to risk triggers and escalation logic.

Discrepancy handling sequence#

identify mismatch
→ record source and evidence
→ classify discrepancy type
→ assess materiality
→ request clarification or additional source checks
→ map to risk trigger if relevant
→ route for analyst review when required

Discrepancy types#

Common discrepancy categories include:

Type Example
Identity discrepancy Name, date of birth, registration number or legal name mismatch.
Ownership discrepancy UBO list, ownership percentage or control information does not reconcile.
Address discrepancy Declared address differs from registry, document or source data.
Source limitation Source unavailable, outdated, incomplete or not checked.
Screening ambiguity Possible match requires analyst review.
Activity mismatch Declared business activity conflicts with public footprint or transaction context.
Jurisdictional exposure Declared location differs from operational, digital, bank or ownership exposure.

Risk trigger mapping#

A risk trigger is a rule or pattern that requires attention. It may come from internal policy, source findings, red flags, regulatory expectations or reviewer judgment.

Examples:

  • possible sanctions or targeted financial sanctions match;
  • PEP or close associate exposure;
  • adverse media suggesting financial crime risk;
  • unexplained complex ownership;
  • high-risk jurisdiction exposure;
  • nominee or opaque control pattern;
  • mismatch between declared and observed activity;
  • source unavailable for a material verification step.

Escalation override#

A controlled framework should prevent a case from being released as routine when active escalation conditions are present.

If escalation is required, the workflow should route to the responsible reviewer, MLRO or compliance team instead of producing a routine release.

Handover output#

An escalation handover should include:

  • case identifier;
  • subject and connected parties;
  • summary of issue;
  • relevant source checks;
  • evidence references;
  • discrepancy register;
  • active risk triggers;
  • unresolved questions;
  • recommended analyst review path.

The handover prepares the reviewer. It does not replace the reviewer.