Five days to answer, and five more to prove it: notes from the London market sanctions panel
Earlier this year I joined a panel at NTT DATA’s London headquarters for a session called Sanctions in the London Market: Regulation, Risk and Reality. The room was made up of people who run sanctions compliance for a living, and the conversation was more candid than most events of this kind manage.
Three things came out of it worth repeating.
The world firms screen against has fragmented
Christopher Po-Ba of Lloyd’s described the current environment as a “multiplex world order”: competing economic and political blocks, fragmented standards, and rules that diverge rather than converge.
For anyone maintaining a screening program, that is not an abstraction. The lists you screen against, the thresholds you set and the rationale you document all have to hold up against several regimes at once, and those regimes are no longer moving in the same direction.
Regulators now ask for evidence on a clock
Darren Temple of Brighter Consultancy Limited walked through recent FCA sanctions audit activity and the practical reality of what is often described as the five plus five day approach: five working days to produce detailed information, and five more to demonstrate that the controls actually operate as described.
That is a test of operational readiness, not of documentation. A policy that reads well and a screening tool that is switched on will not survive it.
Agentic AI is in production, not in a pilot
My own contribution was to show what that looks like in practice rather than on a slide. Alert clearing driven by AI is materially reducing false positives and the volume of manual review, in live environments, today.
The interesting part is not the technology. It is that the output has to be explainable and auditable, because the second five days in Darren’s example is exactly where a model nobody can explain falls over.
What it adds up to
The session kept returning to one point. Sanctions compliance has stopped being a question of whether you have a policy and a tool. It is a question of operational readiness, governance clarity, auditability, and whether you can evidence that your controls work when somebody asks you to prove it inside two weeks.
Thanks to NTT DATA for hosting, and to Christopher and Darren for a genuinely useful session.