Potential Sanction Match
Follow-up request regarding a potential sanctions match
Pay. screens payment flows for potential matches with individuals and organisations included on sanctions lists. This applies to both incoming payments and outgoing funds, such as refunds and payouts.
Occasionally, this screening may result in a potential sanctions match. This does not automatically mean that the individual or organisation involved is actually subject to sanctions. In many cases, the alert is simply caused by a similarity in names. However, any potential match must be investigated further.
This page explains why you may have received a request from Pay., what information we need, how this relates to the GDPR, and what happens next.
Why have I received a request?
During the screening of a transaction, we identified a similarity between the name of an account holder and the name of an individual or organisation included on a sanctions list.
Such an alert is an indication that further investigation is required. A potential sanctions match therefore does not mean that the account holder is actually subject to sanctions.
To determine whether the account holder is the same person as the individual on the sanctions list, we need additional information. For example, a different date of birth or nationality may be sufficient to establish that the account holder is not the listed individual.
This investigation is carried out pursuant to applicable sanctions legislation, including the Dutch Sanctions Act 1977 (Sanctiewet 1977).
What information do we need?
To investigate and, where possible, rule out the potential sanctions match, we ask you to provide the following information about the relevant account holder, insofar as it is available to you:
- full first and last name;
- date of birth;
- nationality.
Alternatively, you may provide a copy of an identity document containing the relevant information.
You can provide the requested information simply by replying to the email you received from Pay.
What if I do not have this information?
The investigation relates exclusively to the individual associated with the bank account specified in our email.
For example, your customer may not be the same person as the account holder. It is also possible that, due to the nature of your services, you do not have access to all of the personal data we have requested. Naturally, you are not expected to provide information that you do not have.
We do, however, ask you to reply to our email and let us know that the requested information is unavailable or only partially available. We can then take this into account as part of our investigation.
Can I share this information under the GDPR?
We sometimes receive responses stating that personal data cannot be shared with Pay. because of the General Data Protection Regulation (GDPR). However, the GDPR does not impose a general prohibition on sharing personal data.
Instead, the GDPR sets out conditions for the lawful processing and disclosure of personal data. Personal data may be shared where there is an appropriate legal basis and the processing is necessary and proportionate.
The information requested by Pay. is specifically used to investigate a potential sanctions match and determine whether the relevant account holder is in fact the individual identified on a sanctions list. This investigation is conducted in connection with obligations arising from applicable sanctions legislation.
We therefore only request information that can help distinguish between individuals and confirm or rule out a potential sanctions match, such as the person's full name, date of birth and nationality. An identity document may also be provided for this purpose.
The GDPR therefore does not automatically prevent you from providing the requested information to Pay.
Each merchant remains responsible for ensuring that personal data is processed and disclosed appropriately. If you do not have the requested information or believe that, in your specific circumstances, you are unable to provide it, please still reply to our email and explain the situation. We can then take this into account in our investigation.
When do I need to respond?
Please respond within 5 business days of receiving our request. This also applies if you do not have, or only partially have, the requested information. A timely response helps us complete the investigation as quickly as possible.
What happens to the information I provide?
Pay. assesses the available information to determine whether the account holder is the same person as the individual included on the relevant sanctions list.
If we have sufficient information to establish that there is no connection with the listed individual, we will close the investigation. The relevant bank account number may subsequently be added to our allowlist to help prevent unnecessary repeat alerts.
Being added to the allowlist does not guarantee that no further investigation will ever be required. New or updated information may result in Pay. making another enquiry at a later date.
Why does Pay. carry out these checks?Pay. must take measures to prevent its payment services from being used for transactions that breach applicable sanctions.
For this reason, we screen both incoming and outgoing payment flows for potential matches with individuals and organisations included on sanctions lists. When a potential match is identified, further investigation is required to determine whether there is an actual sanctions risk.
We understand that gathering additional information can create extra work and that you may not always have access to the personal data requested. We therefore only request information that is relevant to the investigation and take into account situations where certain information is unavailable.
Frequently asked questions
Does a sanctions match mean that my customer is subject to sanctions?
No. A potential sanctions match initially means only that a similarity has been identified, for example between the name of an account holder and a name on a sanctions list. Further investigation is required to determine whether they are actually the same person or organisation.
My customer is not the account holder. What should I do?
Please let us know by replying to our email. The investigation concerns the individual associated with the bank account specified in our request. If you do not have personal information about that individual, simply tell us.
I do not have all of the requested information. Should I still respond?
Yes, please. Provide the information that is available to you and let us know which details you do not have.
Can I refuse to share personal data because of the GDPR?
The GDPR does not impose a general prohibition on sharing personal data. Whether personal data may be disclosed depends, among other things, on the legal basis, purpose and necessity of the processing.
The information requested by Pay. is required for the specific purpose of investigating a potential sanctions match. If you believe that you cannot provide certain information in your particular circumstances, please still respond to our request and explain why. We can then take this into account as part of our investigation.
Is a copy of an identity document sufficient?
Yes. An identity document may be used to establish the identifying information required for the investigation.
Why do you ask for the person's date of birth and nationality?
These details help distinguish between people with identical or similar names. For example, if the account holder's date of birth or nationality differs from that of the individual on the sanctions list, this may provide an important basis for ruling out the potential match.
What happens after I respond?
Pay. will assess the available information and continue the investigation. If we can sufficiently establish that the account holder is not the individual identified on the sanctions list, we will close the investigation.
Questions?
If you have any questions about our request, please reply directly to the email you received from Pay. This allows us to link your question to the correct investigation.
Thank you for your cooperation.