Screening tuning: stages and deadlines
Screening tuning moves through four stages: baseline review, rule adjustment, controlled testing and sign-off. Each stage carries its own internal deadline, set by the compliance function rather than by a regulator. The point of no return sits at sign-off: once a tuned rule set goes live, undoing it needs a new cycle, not a rollback.
What changes once tuning starts
Before tuning, the screening engine runs on inherited thresholds — often set at onboarding and left untouched. Once a review begins, every alert generated during the review window becomes part of a record that an auditor or a supervisor can ask to see later. Staff handling the queue also work under a second constraint: they cannot quietly loosen a rule to clear a backlog. Any threshold change has to go through the same stages as a planned tuning exercise, even if the trigger was pressure rather than a schedule.
The practical effect is timing risk, not legal risk. A tuning cycle that overruns pushes back the next scheduled review, and a queue that grows faster than the rule set can be adjusted starts to look, on paper, like a control gap rather than a temporary spike.
Stages, typical duration and who signs off
| Stage | What happens | Typical duration | Who signs off |
|---|---|---|---|
| Baseline review | Pull alert log and false-positive rate for the last full cycle | 3–5 working days | Compliance officer |
| Rule adjustment | Draft new thresholds and matching logic with IT or the vendor | 1–2 weeks | Compliance officer with IT |
| Controlled testing | Run adjusted rules against historical data in a test environment | About 1 week | Testing team |
| Sign-off | Approve the tuned rule set for production and file the change log | 1 working day | Compliance officer or MLRO |
| Post-change audit | Confirm the change log matches what actually went live | Next scheduled audit | Internal audit |
What to do
- The compliance officer pulls the baseline alert log for the last complete reporting cycle before touching any threshold.
- IT or the vendor exports the current rule set, including matching logic and any manual overrides.
- The compliance officer and IT agree a test window and a rollback point in writing before any change reaches production.
- The testing team runs the adjusted rules against historical data and records the shift in false positives and false negatives.
- The compliance officer or MLRO signs off the tuned rule set and files the change log with a timestamp.
- Internal audit checks the change log against the live configuration at the next scheduled review.
Who decides
Day-to-day tuning decisions sit with the compliance officer or MLRO. Changes that affect risk appetite — widening a threshold rather than narrowing it, for instance — go to senior management or the board before sign-off. A supervisor only enters this process where the tuning request follows the supervisor's own finding. In that situation, An appeal deadline follows a refusal authorisation who decides sets out how that separate clock runs and who decides it.
Where this splits into a different question
If the screening engine itself is licensed rather than owned, continuity depends on the licence terms, not on the tuning schedule. Where the vendor's rights over the underlying logic are unclear, the question becomes contractual: When escrow is demanded for source code covers what happens when a counterparty asks for that guarantee.
Where the screening tool sits inside a broader technology contract rather than a standalone licence, the same continuity question is framed differently, and When source code escrow is demanded sets out who decides on that arrangement and when it becomes relevant.
If volume growth, not a rule defect, is driving the backlog, the fix is staffing or queue management. Tuning the rule set in that case only masks a resourcing problem for one cycle.
What this page does not resolve
This page covers the internal process — stages, deadlines, sign-off — not the substance of any individual rule. It does not set thresholds for a specific sanctions list, decide which risk factors belong in a scoring model, or fix jurisdiction-specific reporting timing. It also does not resolve vendor pricing for tuning support or for escrow arrangements; those sit with the vendor contract, not with this procedure.
Verified
Reviewed against internal change-control policy and audit checklist templates. No external legal text is cited on this page, because none applies directly to the internal tuning procedure described here. Where a tuning cycle is triggered by a supervisor's finding, the applicable deadline is set by that supervisor's own decision, not by this procedure.
Related
Where tuning uncovers a match that needs reporting rather than adjusting, Suspicious activity reporting step by step sets out that separate process.
FAQ
How long does screening tuning take in practice?
A full cycle, from baseline review to sign-off, usually runs three to four weeks. Testing is the stage most likely to overrun, particularly where historical data has to be cleaned before the adjusted rules can run against it.
Which documents are needed to start?
The baseline alert log, the current rule export, a written test-window agreement, and a sign-off template that records who approved the change and when. Without the baseline log, there is no way to measure whether the tuning improved anything.
What happens if the other side does not respond?
If a vendor does not respond within the agreed test window, the current rule set stays in production and the delay is recorded in the change log. Tuning does not proceed on an assumed approval, and the compliance officer escalates internally rather than pushing an untested change live.
Next steps
If a pledged portfolio complicates who controls the vendor relationship behind the screening engine, When a portfolio is pledged to a lender sets out what that changes.
If the trigger for this tuning cycle was a supervisor's question about governance rather than a scheduled review, start with When a supervisor asks about governance: what to do.