Changing data providers— PEP , and sanctions —is addressed in three decisions. The first decision concerns the scope: data alone, the screening engine, or both. The second concerns the criteria: coverage and recency of the lists, false positives, integration, hosting, and support. The third decision outlines the migration process: migrating existing data, running the process twice on the same data, and then switching over with proof that the monitoring was never interrupted.
An expiring contract, too many alerts, or support that responds in a different language: the reasons to switch are piling up even before the project gets underway. However, the risk involved in switching holds teams back, because the screening process cannot be interrupted.
When should you switch data providers PEP , and penalties?
Three categories of issues justify launching the project: operational difficulties, comments made during an audit, and the actual cost of the system.
Operational notifications: alerts, updates, support
The volume of alerts that must be processed manually is the first indicator. When the false-positive rate exceeds what your analysts can investigate within regulatory deadlines, the engine is no longer fulfilling its purpose. Measure the average analysis time per alert: if half of that time is spent ruling out obvious homonyms, the configuration is no longer appropriate.
The currency of sanctions lists and politically exposed persons (PEP) databases (PEP) can be verified by comparing the displayed update dates with the publication dates of the official lists. For sanctions involving the freezing of assets, the time gap must be as short as possible, since asset-freezing measures take effect immediately upon their entry into force.
Technical and regulatory support is just as important as the tool itself. When support is provided in English from a distant time zone by someone who isn’t familiar with French regulations, every adjustment is delayed. Take note of the actual response times as well as the relevance of the answers provided.
Regulatory Indicators: Findings from an Audit or Inspection
A finding identified during an audit or inspection by the Prudential Supervision and Resolution Authority may concern the scope of the lists, the traceability of decisions, or the explainability of the algorithm. In such cases, it indicates noncompliance. The regulator requires the institution to demonstrate the effectiveness of its anti-money laundering and counter-terrorist financing framework (AML-CFT).
The joint guidelines issued by the Directorate General of the Treasury and the ACPR address the implementation of asset freeze measures. They specify that the institution remains responsible for its own system, even when it uses a service provider.
Economic indicators: maintenance costs and analysis time
The total cost of ownership far exceeds the license price. It includes the time spent handling alerts, as well as integration, maintenance, and support costs. When analyzing false positives requires the efforts of several full-time equivalents, the actual cost exceeds that of a better-configured engine. An engine that significantly reduces false positives may therefore have a higher license cost but a lower total cost.
Data provider or screening engine: What difference does it really make?
The data and the engine are two distinct layers. The data layer includes lists of sanctions and asset freezes, as well as the databases PEP. The engine is the tool that matches names, sorts alerts, and maintains the audit trail.
| Scope of the Change | What is being replaced | What Remains in Place | Symptom leading to it | Point to Watch For |
| The data alone | Sanctions and asset freeze lists, databases of PEP | The screening engine, its settings, and the alert history | Coverage or timeliness of the lists deemed insufficient | Run the portfolio screening again using the new data before deleting the old data |
| The screening motor alone | The tool that matches names, sorts alerts, and maintains an audit trail | Data sources, if the new engine supports them | Too many alerts to handle, inflexible configuration, cumbersome integration, and remote support | Check which data sources the new engine can utilize |
| The Data and the Engine | The entire screening process | Procedures, risk classification, past decisions | Outdated equipment, end of contract, findings from an audit or inspection | Longer double execution: two variables change at the same time |
When only the data changes, the engine retains its settings. This saves you from having to learn how to use a new tool, but you must verify that the new lists cover the same jurisdictions and risk categories.
Switching engines without changing the data requires that the new tool be able to utilize the current data sources. Some engines support multiple providers, while others are tied to a single database. Replacing both layers simultaneously prolongs the dual execution, since any discrepancy could then stem from either the data or the engine.
What criteria should you use when choosing a new supplier?
The 10-criteria comparison chart for a screening solution details all the points to consider. Two criteria set a replacement apart as the top choice.
Criteria Common to Any Tool Selection
Ten criteria apply to every project:
- list coverage;
- their freshness;
- the false-positive rate;
- the explainability of decisions;
- integration into the information system;
- data hosting;
- the language and time zone of the support service;
- the pricing model;
- the frequency of updates;
- including the regulatory day prior.
Coverage includes international sanctions lists (United Nations, European Union, and OFAC), national asset freeze lists, and PEP. Verify that the provider covers the jurisdictions in which you operate as well as the categories you need to detect.
Timeliness is measured in hours between the official release and the availability of the data in the tool. For asset freezes, the data must be added immediately. For PEP, please inquire about the update frequency.
The false positive rate depends on the precision of the settings. An engine that allows you to adjust phonetic matching, editing distance, name variants, and geographic filters reduces irrelevant alerts without sacrificing coverage.
Criteria Specific to a Replacement
Migrating the existing system distinguishes a replacement from an initial deployment. You must retrieve the current configuration, approved whitelists, past decisions and their justifications, as well as the alert history. Without this migration, you lose traceability.
Ensuring continuity of monitoring requires running both systems simultaneously. The old and new systems operate in parallel on the same data, and you compare their results before the switchover. The reversibility window is also important: if the new system shows an unexplained discrepancy after the switchover, you must be able to revert to the old system without disruption.
Which family of solutions should you choose?
Three families stand out based on their deployment models, their track record, and their alignment with French requirements. The choice depends on the size of your portfolio, your information system, and your resources. A dedicated guide helps you choose between a French RegTech provider and an international solution.
| Family of Solutions | Considerations for a Migration | Question to Ask |
| Suites from Historic International Publishers | Setup costs, integration time, license and maintenance costs, language of support, data hosting location | Who configures the tool, where is support provided, and in what language? |
| In-house solutions | Maintenance costs, regulatory compliance that must be handled in-house, technical debt, updating lists | Who updates the lists and rules when a text changes? |
| Recent RegTech Developments | Proven track record, experience managing large volumes, and references from comparable institutions | What other projects of comparable size can we cite as examples? |
Software suites from long-established international vendors offer broad coverage and proven reliability. However, the complexity of their configuration and the cost of integration may exceed the capabilities of a medium-sized team.
In-house solutions offer complete control but place the burden of regulatory monitoring on the institution. Every change to the list must then be implemented in the code. Recent RegTech solutions offer more agile integration, French-language support, and hosting in France, but have a shorter track record.
How can you migrate without losing control?
The migration is carried out in five stages, each associated with a deliverable and a key consideration. One general rule applies: detection must not be interrupted.
| Step | Objective | Available | Point to Watch For |
| 1. Assessment of the Current Situation | Take an objective look at what no longer works | Summary of identified limitations: alerts, list coverage, updates, support | Base your analysis on your own data rather than on a hunch |
| 2. Defining the Need | Translate constraints into requirements | Specifications and test data set from your database | Integrate compliance, IT, and procurement at this stage |
| 3. Adaptation of the Existing Structure | Don't lose any settings or decisions | Inventory of lists, rules, whitelists, and alert histories to be migrated | Past decisions must remain available for review |
| 4. Double execution | Compare the old and new systems using the same data | Variance Report Explained and Validated | No unexplained detection discrepancies prior to the switchover |
| 5. Transition and Follow-Up | Phase out the old system without losing control | Shift handover report, updated procedures, team training | Maintain access to the archives of the old system |
Restore data, rules, and whitelists
The current configuration reflects your risk-based approach through reconciliation thresholds, geographic filters, monitored e PEP categories, and validated whitelists. It must be carried over to the new engine or recalibrated if the new engine operates differently.
Whitelists identify recurring false positives that have been ruled out following review, including namesakes with no connection to a PEP, entities outside the scope, and detection errors. These decisions must remain accessible. Ask in what format the previous provider provides these lists and how the new tool incorporates them.
The alert history serves as your audit trail and must be retained for the required period. If a technical backup is not performed, maintain read-only access to the archives.
Run both devices in parallel
Dual execution involves running both the old and new systems on the same data for a period long enough to compare the results. Feed them with identical data streams: the daily customer database extract, the new customer sign-up stream, and the transaction stream.
Compare the alerts triggered and classify the discrepancies into three categories: those detected by both systems, those detected only by the new system, and those detected only by the old system. Each discrepancy must be explained. An alert detected only by the new system may result from better coverage, while an alert detected only by the old system may indicate a loss of coverage.
Decide on the transition
The transition takes place when three conditions are met: the root cause analysis has been explained and approved, procedures have been updated, and teams have been trained. A written record documents the date and time when the old system was shut down and the new one was launched.
Maintain access to the archives of the old system for the entire statutory retention period. A comprehensive review of the database at the time of the migration confirms that the new system covers the entire portfolio from day one.
What kind of French-language support can we expect during and after the migration?
Support determines how quickly the system responds to a list change, an audit finding, or a configuration adjustment. Five points must be negotiated at the time the contract is signed.
The language and support hours determine the actual response time. Support staff who respond in English from a distant time zone may take several days to address a question posted on a French mailing list. Request support in French, available during French business hours.
The contact person must be familiar with compliance AML-CFT and French regulations. A question regarding the treatment of a relative of a “ PEP ” cannot be handled by a purely technical support team.
Service commitments cover the tool’s availability, as well as the timeframes for corrections, list updates, and responses. They must be included in the contract.
Integrated regulatory monitoring means that the provider tracks changes to regulations and updates the tool without any action required on your part. Ask about the frequency of updates and how they are deployed.
The frequency of updates determines the system's ability to evolve. A platform that doesn't evolve for several years becomes obsolete. Choose a provider that releases a new version every four to six months.
How much does it cost to switch providers?
Cost is measured in terms of total cost of ownership, not just the license price. It consists of six components.
| Job | What it covers | To be requested from the supplier |
| License or Subscription | Tool usage fee, based on the volume screened | The billing unit and how it changes with the portfolio |
| Data | Sanctions lists, PEP databases, and other sources | What's Included and What's Billed Separately |
| Integration and Recovery | Integration with the information system; import of settings and historical data | The portion completed by the supplier and the portion still to be completed by your teams |
| Operation | Time spent by analysts handling alerts | A measure of the number of alerts in your trial game |
| Maintenance and Updates | Updates, regulatory monitoring, new versions | What is included in the contract and how often |
| Exit | Return of Data and History Records at the End of the Contract | The delivery format and its cost |
The license is billed based on the volume processed, which may correspond to the number of clients in your portfolio, transactions, or API calls. Ask how this metric changes as your business grows. Data may be included or billed separately: be sure to check exactly what the contract covers.
Integration and data migration are often the most time-consuming tasks. Connecting the new tool to your system, transferring settings, and migrating whitelists and historical data all take time. Ask what the vendor will handle and what your teams will be responsible for.
Operations represent the recurring cost associated with the time spent handling alerts. An engine that reduces false positives lowers this cost over the long term. Maintenance and enhancements include updates, regulatory monitoring, and new versions. In SaaS mode, these enhancements are deployed automatically.
Your ability to switch providers again depends on the terms of your contract termination. Ask in what format you will receive your data at the end of the contract.
What should you show your supervisory authority after the transition?
The institution remains responsible for its system, even when it uses a service provider. You must be able to demonstrate that monitoring has never been interrupted and that the new system is at least as effective as the previous one.
The migration file consists of six documents. The reasoned decision explains why the change was necessary by outlining the identified limitations, the measures taken, and the selection criteria. The specifications list the requirements that the new system had to meet. They translate the limitations of the old system into objective criteria, such as list coverage, false positive rate, update time, language of the platform, and hosting.
The discrepancy report generated by the dual execution compares the alerts triggered by the old and new systems on the same data, and then explains each difference. The switchover log records the date and time when the old tool was shut down and the new one was started. It specifies that the screening process was not interrupted.
The updated procedures describe how the new system works: who configures it, who handles alerts, who approves whitelists, and who monitors updates. Access to the archives of the old tool ensures that past decisions remain available for review for the required regulatory period. If the historical data has not been technically migrated to the new tool, maintain read-only access to it.
Compile a test set from your database before launching the project. This representative sample of your portfolio should include PEP known cases, recurring homonyms, and borderline cases that have already been processed. It is used to compare providers based on your own data and then to validate the configuration before the switchover.
Discover AP Scan, a solution for screening PEP , and sanctions. For legacy systems, a guide explains how to modernize an aging AML-CFT system.
FAQ
How long does it take to switch data providers PEP , and penalties?
The duration depends on three factors: the volume and quality of the data to be migrated, the number of systems to be connected, and the dual-operation period you set for yourself. Ask each vendor for a timeline tailored to your specific scope, along with references from comparable organizations, rather than an average estimate that would not commit them to anything.
Do you need to change the data when you switch to a different screening engine?
Not necessarily. The data and the engine are two separate layers: on one hand, the sanctions lists and PEP databases; on the other, the tool that matches names and sorts alerts. If your issues stem from the volume of alerts, configuration, or support, it’s the engine that needs to be reviewed. Be sure to check, however, which sources the new engine can utilize.
Do we need to re-enter the entire customer database when we switch over?
A comprehensive scan of the database at the time of the switchover is the simplest way to demonstrate that the new system covers the entire portfolio from day one. It also provides a point of comparison with the last run of the old tool. Keep both sets of results, along with the variance analysis, in the migration file.
Can I keep my whitelists and alert history?
This data migration must be specified in the terms of reference. Ask in what format the previous supplier provides the whitelists, decisions, and their justifications, and how the new tool imports them. If technical migration is not possible, retain read-only access to the archives: an auditor may ask why a previous alert was dismissed.
Who should lead the change: Compliance or IT?
Compliance drives the need and validates the results, as it is accountable to the supervisor for the system. IT leads the integration and data migration, while Procurement oversees the contract, reversibility, and total cost. A committee comprising all three functions—with a designated leader from the compliance side—ensures that decisions are not based solely on technical criteria.
