Sanctions and PEP screening sits at the intersection of regulatory obligation and operational risk, yet many gaming operators still evaluate their programs by asking a single question: did we get flagged by the regulator? That reactive posture is no longer sufficient. Measuring screening effectiveness through concrete, forward-looking KPIs allows compliance teams to demonstrate program maturity, justify technology investment, and catch process failures before they become enforcement actions.
Why Generic Compliance Metrics Fall Short
Most compliance dashboards in gaming track volumes: how many accounts were screened, how many alerts were generated. Volume metrics describe activity, not quality. A screening program that generates 10,000 alerts per month but resolves 90 percent of them as false positives within 48 hours tells a very different story than one generating 500 alerts with a 60-day average resolution time. Operators need metrics that capture accuracy, speed, and decision quality simultaneously.
Regulatory expectations across major licensing jurisdictions, including the UK Gambling Commission, Malta Gaming Authority, and Dutch KSA, have shifted toward demonstrating that screening controls are proportionate, risk-based, and genuinely effective. Showing a regulator a spreadsheet of alert counts is no longer a convincing proof of compliance maturity.
Core KPIs for Sanctions Screening
False Positive Rate
The false positive rate measures the proportion of alerts that, after investigation, relate to legitimate customers with no sanctions link. A well-tuned sanctions screening system targeting a global player base should aim to keep false positives below 5 percent of total alerts. Rates above 15 percent typically indicate that fuzzy-matching thresholds are misconfigured or that the underlying watchlist data is not deduplicated. Tracking this monthly highlights configuration drift, especially after new list updates.
Alert-to-Resolution Time
Time-to-resolution measures how long it takes from alert generation to a documented compliance decision. For sanctions matches, where a genuine hit may require immediate account suspension and transaction blocking, regulators expect near-real-time action. A practical benchmark is full resolution within four business hours for high-confidence matches and 24 hours for low-confidence matches. Any queue backlog exceeding these thresholds should trigger an escalation review.
List Coverage and Refresh Latency
Screening is only as good as the watchlists it references. Operators should track the number of distinct sanctions and PEP lists ingested and the average delay between a list publisher updating its data and that update being reflected in the live screening engine. A refresh latency above 24 hours for consolidated sanctions lists, such as OFAC SDN, EU consolidated, or UN lists, creates a material compliance gap. This KPI is especially relevant for operators using third-party screening vendors who may bundle list updates on a scheduled basis rather than in real time.
Core KPIs for PEP Screening
PEP Classification Accuracy Rate
PEP data is notoriously inconsistent across data providers. Classification accuracy measures the percentage of flagged individuals who are correctly categorised by PEP tier, whether Category 1 heads of state and senior officials or Category 2 and 3 relatives and close associates, against an independent reference. Operators should conduct quarterly sample audits of PEP classifications, targeting at least 95 percent accuracy. Misclassification drives either under-scrutiny of high-risk customers or unnecessary friction for low-risk ones.
Enhanced Due Diligence Completion Rate
When a customer is confirmed as a PEP, the business relationship should trigger enhanced due diligence. Tracking the percentage of confirmed PEPs who have a completed EDD file within a defined window, typically 30 days from identification, surfaces resourcing gaps and process bottlenecks. An EDD completion rate below 80 percent is a clear signal that the compliance team is under-resourced relative to the volume of flagged accounts.
Ongoing Monitoring Hit Rate
Sanctions and PEP status changes over time. An individual not listed on onboarding may be designated six months into their player lifecycle. Ongoing monitoring hit rate tracks the proportion of existing accounts that trigger a re-screening alert during a defined period, relative to total active accounts. A meaningful hit rate above zero confirms that retrospective screening is actually running; a hit rate of exactly zero for an extended period often indicates a configuration or scheduling failure rather than a genuinely clean book.
Building a KPI Review Cadence
- Review false positive rates and alert-to-resolution times weekly at team level.
- Report list coverage and refresh latency to the MLRO monthly.
- Present PEP classification accuracy and EDD completion rates to senior management quarterly.
- Include all KPIs in the annual MLRO report submitted to the relevant licensing authority.
A compliance program that cannot quantify its own accuracy is, by definition, unmanaged. KPIs transform screening from a box-ticking exercise into an operational control that can be tested, improved, and defended to any regulator.
Practical Implications for Operators
Establishing these KPIs requires coordination between compliance, technology, and operations. The screening vendor contract should include data-export rights that allow internal teams to pull raw alert data for independent analysis. Operators running legacy player databases should also prioritise a backfill screening exercise, ensuring that accounts onboarded before current list versions are re-checked against updated watchlists. Without backfill coverage, the ongoing monitoring hit rate becomes a misleading figure.
At OnlineShine, our compliance practice works with operators to implement these measurement frameworks as part of broader AML program reviews, ensuring that KPI selection is calibrated to the operator's specific licensing environment, player demographics, and transaction risk profile.
