Something changed at UK border control this autumn. On 6 October 2026, the Home Office began switching airport eGates to contactless technology, starting with British passport holders at East Midlands Airport and rolling out to every eGate in the country by early 2027 [1].

Travellers no longer place their passport on a reader. They stand at the gate, a camera takes their photo, and the system checks it against verified immigration, travel, and passport records. Border Force says these new gates are up to 25% faster than using passports at eGates [1].

The payoff is shorter queues and officers who no longer spend their shifts checking passports that were never in doubt. Travellers who cannot be cleared automatically are directed to further verification, including passport checks or assistance from a Border Force officer.

Financial institutions are currently looking for the same efficiency in screening, but at a far larger scale. 

Every new customer and every outbound payment must be checked against sanctions lists and watchlists, and almost every possible match that comes back belongs to an innocent person. 

Analysts can spend whole days clearing alerts that were never in doubt, while the one real match waits in the same queue as everything else. Miss it, and the consequences run from asset freezes and reportable breaches to penalties in the hundreds of millions.

So, what do leading institutions do differently? 

They treat screening less like a manual checkpoint and more like a modern border, cleaning and standardising data before matching, using AI to clear low-risk alerts with documented reasoning, sending genuinely ambiguous cases to experienced analysts, and keeping every decision explainable to regulators.

What happens when screening trusts the wrong data?

The eGate’s first job is to read something it can trust. Screening is no different: a sanctions filter can only judge the data it is shown, and it has to know which data to believe. 

Binance, the world’s largest crypto exchange, showed what happens when it doesn’t. In November 2023, Binance agreed to pay the Office of Foreign Assets Control (OFAC) $968.6m over 1,667,153 apparent sanctions violations [2]. 

OFAC found the exchange kept allowing trades by users logged in from IP addresses in comprehensively sanctioned countries, as long as they had submitted identity documents from somewhere else. One of its own engineers had warned that users who failed KYC screening could simply switch IP addresses with a VPN [2].

Now, Binance is back in the headlines for a different reason. More than $6B was stolen from the exchange in October 2026, thought to be the biggest crypto heist ever, and the FBI has blamed North Korea [3]. While it was a security breach and not a screening failure, the FBI’s response was pure screening. 

The FBI urged firms to block transactions with, or derived from, the addresses the hackers are using [3]. Whether the money is stopped now depends on how quickly exchanges and payment firms turn that list into working controls.

Most data failures are quieter. In May 2026, the Financial Conduct Authority (FCA) published its review of sanctions controls at more than 150 firms. In its tests, 90% of alerts correctly identified the sanctioned party when names matched exactly, but only 75% did when spellings varied slightly [4]. 

Titles pushed match scores below alert thresholds, long names failed without raising an alert, and customer records held placeholder dates of birth. Only around two-thirds of firms in its proactive work said they applied sanctions list updates within a day [4].

An eGate that opened for anyone whose face and passport didn’t match would be switched off within a day. Yet that is close to what OFAC found at Binance: two pieces of data disagreed, and the system believed the convenient one. 

When an IP address, a document, and a customer record tell different stories, leading institutions stop and check instead of picking the answer that keeps the transaction moving. 

They test their matching against the messy names the FCA found slipping through, and they treat a new list, like the FBI’s wallet addresses, as something to load in hours, not days. The institutions pulling ahead know screening can only be as good as the data behind it.

How do leading institutions decide which alerts deserve human review?

Not every passenger at an eGate needs an officer, and not every screening alert needs an analyst. The hard part is telling them apart quickly, and getting it wrong in either direction is expensive.

The scale of the problem is easy to underestimate. According to the FCA, 95% of firms that screen their customers and report financial crime data to the regulator had found no true sanctions matches among them since 2022, and 98% had found none in the payments they screened [4]. 

For many firms, screening produces significant operational work while confirmed sanctions matches remain rare. The challenge is resolving potential matches efficiently without allowing genuine risks to disappear into the queue, potentially leading to sanctions breaches, regulatory investigations, and significant penalties.

Speed varies widely. The FCA found that about 44% of firms resolve name screening alerts within one working day on average, and 47% do the same for payment alerts. However, more than a quarter take three to five days to close name alerts, and some firms couldn’t tell the regulator how long their alerts took at all [4].

When queues build, people cut corners. At one wholesale bank, analysts under pressure to hit internal targets skipped mandatory escalation steps and missed a link to a designated vessel owner [4]. 

At a retail bank, controls flagged a newly sanctioned individual, but transactions were released in the gap before restrictions were applied, partly because manual processes broke down when fewer staff were on duty [4].

The stronger firms in the FCA’s review ran structured alert management: internal service levels, a documented rationale for every decision, quality checks on outcomes, and clear escalation routes between the first and second lines of defence [4].

The largest institutions are now adding AI to that structure rather than simply hiring more analysts. Troy Rohrbaugh, then co-CEO of JPMorgan Chase’s Commercial & Investment Bank, told investors in February 2026 that the division was running roughly 400 AI projects, and suggested that AI helped to cut unit costs in KYC and AML by roughly 40% [5]. 

Done well, compliance AI works a lot like an eGate. It doesn’t wave travellers through when the officer’s queue gets long, and it doesn’t send everyone to the desk either. It resolves clear-cut false positives quickly and reserves human review for cases that require further judgement.

For banks, the FCA’s findings point the same way. An alert backlog is a risk in its own right, and the answer is to sort alerts by risk, with a recorded reason for every decision, rather than lowering the bar or leaning harder on tired analysts.

Why does explainability matter as much as accuracy?

When an eGate can't clear a passenger, further verification is required. Where necessary, a Border Force officer makes the final judgement.

Screening should work the same way, but only if the analyst understands what the alert is asking. An alert that nobody understands isn’t much better than no alert at all.

In 2015, PayPal paid OFAC $7.66m to settle apparent sanctions violations. Its automated filter at first failed to flag an account belonging to an individual on the US sanctions list. Once it did, staff dismissed the alerts on six separate occasions without obtaining or reviewing documents that corroborated his identity [6].

According to the settlement, one member of PayPal’s risk operations staff closed an alert believing the system had raised it simply to confirm the customer’s name and address [7]. The technology had done its job, but the person reading its output didn’t know what the job was.

More than a decade later, the FCA found the same gap from the other direction. In its 2026 review, several firms had to ask their vendor why certain sanctioned names had failed to alert [4]. If a bank can’t explain why its system stayed quiet, it can’t show a regulator that the system works.

OFAC has been clear about where responsibility sits. In its Binance decision, it said an automated system is no defence, because companies are responsible for the technology they use [2].

Speed is only half of what makes an eGate useful. The other half is that the officer can trust its decisions and stand behind them.

For banks, PayPal and Binance point the same way. Leading institutions make every alert carry its reasoning, so analysts know exactly what they are being asked to judge and why.

They understand their screening well enough to explain a silence as confidently as a hit, rather than relying on a vendor’s word, and they keep a record of every decision that a regulator could follow years later.

Screen like the leaders

The eGate has not replaced Border Force. It has freed officers for work that truly requires a person, such as spotting potential victims of trafficking [8].

Taken together, the lessons learnt from Binance, PayPal, and JPMorgan show what good screening depends on: data the system can trust, a sensible way of deciding which alerts need a person, and decisions that can be explained afterwards. 

Increasingly, banks are meeting those needs the way the eGate does, letting well-governed AI and automation clear routine cases so experienced people have the time and evidence to judge the rest.

Silent Eight's Iris 7 uses policy-bound AI Agents to automate eligible customer and payment screening decisions, escalate cases requiring human judgement, and maintain explainable, auditable decision records.

If your analysts still feel like they are checking every passport by hand, explore Silent Eight’s Customer Screening Suite.

FAQs

What causes most missed sanctions matches?
Usually it’s messy data and badly set-up matching, not bad intent. In the FCA’s 2026 tests, alerts correctly identified the sanctioned party 90% of the time when names matched exactly, but only 75% of the time when spellings varied slightly [4]. The fix is to standardise data before screening and test matching against misspellings, titles, and missing fields.

Why are so many screening alerts false positives?
Screening rules are set so that real matches aren’t missed, which means common names and spelling variations throw up large numbers of possible hits. According to the FCA, 95% of reporting firms had found no true sanctions matches among their customers since 2022 [4]. The answer is to sort alerts by risk and record a reason for every decision, rather than raising thresholds until the queue goes quiet.

Can AI safely close sanctions screening alerts?
Yes, for clear-cut cases, as long as every decision is explained, recorded, and open to review, and uncertain cases still go to an analyst. Regulators won’t accept “the system decided” as a defence. OFAC made that clear in its Binance decision [2].

Who is responsible if a vendor’s screening tool misses a sanctioned name?
The firm is. In its 2026 review, the FCA found several firms had to ask their vendor why sanctioned names hadn’t triggered alerts [4]. Leading institutions understand their screening set-up well enough to explain a missed match as confidently as a hit, and they test it regularly rather than relying on the vendor’s word.

How are the world’s biggest banks using AI in financial crime compliance?

At scale. JPMorgan Chase was running roughly 400 AI projects in its Commercial & Investment Bank in early 2026, including work on KYC and AML checks [5]. For more on how JPMorgan, Citi and Wells Fargo are applying AI to anti-money laundering work, read JPMorgan, Citi and Wells Fargo Are Transforming AML Thanks to AI Tools.