When a regulator walks into an examination, the first thing they ask for is not your screening results. It is your audit trail. Not a summary — the actual record: who ran which search, when, against which list version, what the system returned, and what decision was made. In that order, for every screening event in scope.
Most compliance tools give you the search. Few give you the record. The gap is where enforcement actions begin.
What examiners actually check
OFAC and FinCEN examiners are not impressed by dashboards. They want transactional-level evidence: for each screening event, who initiated it, what the match status was, and how a human adjudicated any alert. They cross-reference your screening records against your onboarding dates and your transaction logs.
The audit question is simple: can you demonstrate that you screened the right people, at the right times, and made defensible decisions on every result? If your system cannot produce that evidence per-entity and per-event, you have a documentation gap regardless of how good your underlying screening logic is.
Five things every screening record must capture
- Timestamp of the screening event, to the second.
- Identity of the user or system that triggered the search.
- Name, version, and date of the watchlist(s) screened against.
- Raw match result returned by the screening engine, including score and matched field.
- Adjudication decision — clear or confirm — with the name of the reviewer and the rationale.
VeriSanction captures all five automatically for every screening event. The audit log is immutable and exportable. When an examiner asks for your records, you produce a structured report — not a spreadsheet assembled the night before.