Financial institutions measure a great deal of compliance activity. 

Customers screened.  
Alerts generated.  
Cases reviewed.  
Investigations completed.  
 
These measures are useful. They tell us that a control is in place and being used.  
But how much do they tell us about how well it actually works? 

That distinction is becoming more important in financial crime compliance.  
Recent regulatory and industry guidance is increasing emphasis on effectiveness, proportionality and risk-based decision-making.  

FinCEN's proposed reforms to AML/CFT programme requirements, for example, focus on risk-based and reasonably designed programmes, with institutions directing greater attention and resources towards higher-risk areas.  
 
The Wolfsberg Group's updated Risk-Based Approach guidance similarly emphasises proportionality, prioritisation and effectiveness. 

At the jurisdiction level, FATF’s assessment methodology makes a similar distinction: technical compliance and effectiveness are assessed separately. 

In simple terms, having the right controls in place is one part of the job. Understanding whether they achieve what they were designed to achieve is another. 

How Does the Control Perform in Practice? 

Sanctions screening provides a useful example. 

A financial institution may screen its customers against relevant sanctions lists every day. It may have documented procedures, established alert thresholds and a team responsible for reviewing potential matches. 

All of that demonstrates that a screening control exists. 

But how does that control perform when it encounters the complexity of real data? 

The FCA's 2026 review of sanctions systems and controls offers an interesting answer. 

As part of its testing, the FCA identified 90% of alerts raised for exact-name scenarios correctly identified the relevant sanctioned party. When names appeared in slightly different forms, that figure fell to 75%. 

That difference is significant. 

Names do not always arrive in clean, standardised formats. Transliteration, aliases, spelling variations and incomplete information are part of the reality that screening controls have to deal with. 

This is where measuring activity and measuring effectiveness begin to diverge. 

Performance Depends on More Than the Screening Engine

It is easy to think of screening effectiveness as a question of matching performance. 

In practice, the screening result sits at the end of a much longer process. 
 
Watchlist management illustrates this well. What can appear to be a straightforward data process actually involves bringing together different sources, reconciling changes, maintaining data quality, applying appropriate controls and ensuring approved information reaches downstream screening systems. 

Regulatory change  →  watchlist data  →  screening  →  alert  →  investigation  →  decision 

Facctum’s approach to watchlist management follows these operational stages, including ingestion, reconciliation, configurable controls, validation, approval and traceability. 

These steps rarely receive the same attention as the eventual screening decision. 

But they help determine the quality of that decision. 

Measuring Activity and Understanding Outcomes

None of this means that traditional compliance metrics are no longer useful. 

Alert volumes can reveal changes in workload.  
False-positive rates can indicate whether a control needs calibration.  
Investigation times can expose operational bottlenecks.  
Screening coverage can help identify gaps. 

Taken individually, they describe activity.  
Viewed together and against the purpose of the control, they can help institutions understand performance. 

For a sanctions screening control, that could mean looking beyond the number of customers screened and asking whether relevant sanctions exposure is being identified. 

It could mean examining whether the data supporting screening is sufficiently current and complete. 

It could mean testing how the control performs against realistic variations rather than only straightforward matches. 

And when a risk is identified, it means understanding whether it is escalated to the right people, acted on appropriately and supported by enough evidence to explain the decision later.

An institution should be able to understand how an important compliance decision was reached: what information was available, how that information moved through the process and where human judgement was applied. 

Effectiveness Changes the Question 

The shift towards effectiveness does not require compliance teams to abandon the measures they already use. It requires them to ask more of those measures. 

That is ultimately what makes the focus on effectiveness useful. 

Did the control run? 

↓ 
Did the control work as intended? 

And for financial institutions trying to demonstrate the strength of their financial crime controls, that is a much more meaningful question.