Sanctions screening¶
This page describes how GRN.CLOUD meets its obligation under EU sanctions law to know who it serves: what is screened, against which lists, who decides, and what a decision does to an order and to a cloud account. It is written for customers, for auditors, and for the GRN staff who review a possible match. The compliance check covers the customer's side only: why an order can be held and what to send.
Every customer and every contact on a customer is screened against the consolidated sanctions lists of the EU, the UN, the UK, the US and the Netherlands. The matcher runs on GRN.CLOUD's own infrastructure, so no customer data leaves the platform. The matcher never decides alone: a possible match is a decision by a compliance reviewer, recorded with a written note, and only a confirmed match blocks a customer. The one automatic block is a customer in a country under a prohibiting EU sanctions programme, and a reviewer can lift it.
What is screened, and against what¶
| Screened | When |
|---|---|
| Every customer, company or person, and every contact on a customer | When the record is created, whenever its name, country, registration number, VAT number or company flag changes, and again every night for every customer with an active order |
| Customers whose last screening is older than 30 days | Every night |
The list data is the sanctions collection of OpenSanctions: the consolidated lists of the EU,
the UN, the UK, the US and the Netherlands. GRN.CLOUD runs its own copy of the matcher next to the back office, and the copy
checks for a new release of the list data every hour and downloads it when there is one. That
download is the only traffic that leaves the platform for the screening. A query about a customer goes to the matcher on the
cluster network and nowhere else, so no third party processes customer data for the check.
flowchart LR
OS["OpenSanctions<br/>public list data and programme feed"] -. download only .-> M["Matcher<br/>on GRN.CLOUD infrastructure"]
B["Back office<br/>customers and contacts"] -->|name, country, registration and VAT number| M
M -->|candidates with a score| B
B --> R["Compliance reviewer<br/>Clear or Block, with a note"]What is matched¶
A screening sends the customer's name, country, registration number and VAT number, and whether the record is a company or a person. The matcher returns the listed entities that resemble the record, each with a score between 0 and 1.
| Rule | Value |
|---|---|
| Match threshold | A candidate with a score of 0.85 or higher counts as a possible match. Candidates below it are kept for the reviewer and change nothing. |
| Name at checkout | The shop refuses a contact name of one word. A single first name resembles every listed person of that name and tells the reviewer nothing. |
| Country | A customer without a country, on its own record or on its company, cannot confirm an order until the country is filled in |
A screening has one of four outcomes:
| State | Meaning |
|---|---|
| Unscreened | Not screened yet, or an identifying field changed and the new screening has not run. Retried every 15 minutes. |
| Clear | No candidate at or above the threshold, or a reviewer cleared the record |
| Hit | At least one candidate needs a decision. The order is held; the reviewer is notified. |
| Blocked | A reviewer confirmed the match, or the customer's country is prohibited |
A candidate a reviewer has cleared is remembered: a later screening that returns only that candidate keeps the customer clear. A new candidate needs a new decision.
Country risk¶
Besides the name, every customer's country is checked against the active EU sanctions programmes. Each country has one of three levels:
| Level | Set when | Effect |
|---|---|---|
| Prohibited | An active EU programme targeting the country includes export controls, financial restrictions or import restrictions | The customer is blocked at screening, without a reviewer. The reviewer is notified and can clear the customer. |
| Enhanced due diligence | An active EU programme targeting the country includes an asset freeze or a travel ban | Recorded on the customer. The name screening alone decides the state. |
| Normal | No active EU programme targets the country | None |
The levels follow the public OpenSanctions programme feed and are refreshed daily, so a country that enters or leaves a programme changes level without anyone editing the table. When a country becomes prohibited, every customer in it is screened again; when it stops being prohibited, the block is lifted at the next screening. A country can carry an override that fixes its level, for a case where the programme feed does not describe the country's situation.
Who decides¶
The matcher proposes; a person decides.
| Decision | Made by | Recorded as |
|---|---|---|
| Possible match, clear or block | A compliance reviewer in the back office, after comparing each candidate with the customer's registration and VAT data | The decision, the reviewer, the time and a written note on the customer record |
| Prohibited country | The screening, automatically | The country and its level on the customer record, and a notification to the reviewer |
| Lifting a country block | A compliance reviewer | As a clear, with a note |
A reviewer cannot decide without a note. The note says what was compared and what was found, and it stays on the customer record with the decision, so an auditor can see who decided, when, and on what grounds. Changing an identifying field of a customer that a reviewer blocked does not lift the block; a block by country is re-evaluated at the next screening.
What a decision does¶
| Decision | New order | Existing cloud account |
|---|---|---|
| Hit, waiting for a reviewer | The order is not confirmed. The shop reports that the order needs a manual check, and the customer is informed by e-mail. Nothing is provisioned. | Nothing changes |
| Clear | A held order is confirmed on the customer's next visit to the payment step, and provisioning starts | Nothing changes, or a paused account returns within about an hour |
| Block | The order is not confirmed. No account is created. | The account is paused: no pod runs, traffic to and from its projects is denied, its users cannot sign in, its data is kept. The pause has no deletion date. |
A block pauses the account rather than deleting it, because an asset freeze obliges GRN.CLOUD to keep what it holds, and because a decision must be fully reversible when it turns out to be wrong. The orders stay as they are until a person at GRN.CLOUD closes them.
Account lifecycle places the pause among the other states of an account; Paused accounts and restore describes what a paused account looks like from the inside.
Disputing a decision¶
Write to the helpdesk at info@grn.cloud, as a reply to the e-mail about the check or as a new message. The reviewer compares the candidates with the company's registration extract and the names of its beneficial owners, so send those. A cleared customer's held orders go through and a paused account returns within about an hour. Nothing is deleted while the check runs.
For GRN staff¶
The review happens in the back office. The reviewer needs to be a member of the group KYC reviewer; anyone else sees the screening result but cannot decide.
- Open the activity Sanctions screening: possible match, from the activities list or from the customer's chatter. It opens the contact.
- Open the tab Sanctions screening. It shows the state, the country risk level, the block reason, and the candidates with their score, their datasets and a link to each candidate's OpenSanctions page.
- Compare each candidate with the contact's registration number, VAT number and country. Ask the customer for the registration extract and the beneficial owners when the record does not settle it.
- Click Clear when no candidate is the contact, or Block when one is. When the contact belongs to a company, decide on the company as well: the cloud account follows the company.
- Write what you compared and what you found in the note, then click Apply. An empty note is refused.
- After a Block, ask finance to close the customer's subscriptions and cancel its open quotations. The platform pauses the account but never touches the orders.
The settings live under Settings, section Sanctions screening:
| Setting | What it does |
|---|---|
| Enforce | On: an order whose customer or contact is not clear is held. Off: the same checks run and are logged, and the order confirms. Switch it off only during an outage of the matcher, never to push one order through; clear the contact with a note instead. |
| Reviewer | The user who receives the review activities. When empty, the first member of the group KYC reviewer. |
| Match threshold | The score from which a candidate counts as a possible match, 0.85 by default. Do not lower it to make hits go away; clear the candidates on the contact, so the decision is recorded. |
| Country risk | Opens the country table, also reachable under Contacts, Configuration, Country risk |
The country table is synced daily from the OpenSanctions programme feed. A row with Override ticked keeps its level across syncs; ticking it and changing the level is how a country's level is set by hand, and the change is applied to the contacts in that country as a sync would apply it.