Adverse Media Screening: What It Is, How It Works, and How to Build It

Adverse media screening is one of those compliance controls that everyone references and few define cleanly. This guide fixes that.

We will cover what adverse media screening is, why regulators expect it, how the pipeline actually works end to end, how the leading tools compare, and how to build a modern version yourself. The framing throughout is honest: cloro is the open-web and AI-answer data layer for screening, not a sanctions or PEP database.

The stakes are not abstract. Nasdaq Verafin puts global illicit financial activity at an estimated $4.4 trillion for 2025, and financial institutions carry the legal burden of not banking the people behind it.

What is adverse media screening?

Adverse media screening is the AML control of checking a counterparty against negative news coverage. The counterparty can be a customer, a vendor, a beneficial owner, or a business partner. It is also called negative news screening, and the two terms mean the same thing.

The goal is simple to state. Before you take on a relationship, and while it continues, you want to know whether the entity shows up in credible reporting on fraud, bribery, money laundering, sanctions, trafficking, or regulatory enforcement.

The Wolfsberg Group defines negative news as information available in the public domain that a firm would consider relevant to managing financial-crime risk. That definition is deliberately broad, because risk shows up in many forms before it ever reaches a watchlist.

What counts as adverse media?

Not every negative mention is relevant. An adverse media check filters for information that bears on financial-crime or reputational risk, then grades how serious and how current it is.

In practice, the categories that matter most are fraud, corruption and bribery, money laundering, sanctions evasion, terrorist financing, organized crime, and regulatory or criminal enforcement. A parking ticket is negative news; it is not adverse media in the compliance sense.

The distinction between a raw mention and a risk-relevant one is where most of the engineering effort goes. Getting it wrong in either direction is expensive.

Severity is the second axis. A resolved civil dispute from a decade ago and an active criminal indictment are both adverse, but they carry very different weight in a risk decision. A usable adverse media check grades how serious a hit is and how recent it is, not just whether it exists.

That grading is also what makes results defensible. When an examiner asks why you kept a relationship, “we saw the coverage, scored it low-severity and historical, and documented that” is a far stronger answer than “our filter never surfaced it.”

Why regulators expect adverse media screening

Adverse media screening is not a nice-to-have. Financial regulators around the world treat it as part of the due-diligence obligations that every regulated firm already carries.

Thomson Reuters describes adverse media screening as an essential legal requirement for KYC onboarding, continued customer due diligence, and enhanced due diligence on higher-risk customers. The obligation is baked into the same rules that govern identity verification.

It also connects directly to global standards. FATF guidance recommends adverse media searches as part of enhanced due diligence, because a negative mention in the news can signal a higher risk that warrants extra scrutiny.

Screening versus ongoing monitoring

There is a critical difference between a one-time check and continuous coverage. Screening is the point-in-time look at onboarding. Ongoing monitoring is the re-check that runs for as long as the relationship lasts.

Regulators expect both. The US CDD Rule requires ongoing monitoring to identify and report suspicious activity and to keep customer risk profiles current. A clean result at onboarding does not stay clean, so a static check ages badly.

This is why negative news monitoring exists as a separate workload from onboarding screening. The entity you cleared last year may be indicted this year, and you are expected to notice.

How adverse media screening actually works

Under the marketing, every adverse media screening system runs the same pipeline. Understanding it is the fastest way to see where the tools differ and where they fall short.

The stages are straightforward. Start with an entity name, expand it into a set of queries, retrieve matching news and search results, classify each hit for relevance and severity, then dispose of it as a true risk, a false positive, or something for a human to review.

1. Entity resolution and query expansion. A name is rarely enough. You expand “John A. Smith” into aliases, transliterations, former names, and name-plus-context queries so you do not miss coverage under a variant spelling.

2. Retrieval. You pull candidate articles from news and web search. Coverage and freshness are decided here — you can only classify what you retrieve.

3. Relevance and severity classification. Each candidate is graded: is this the right entity, is the content actually adverse, and how serious is it? This is where an LLM now does most of the heavy lifting.

4. Disposition. Hits become a true match, a false positive, or a manual review. Clean dispositions feed the customer risk profile and any suspicious-activity reporting.

The step that changed most recently is classification. For years it ran on keyword rules and fuzzy name matching, which are brittle and drown analysts in noise. A language model reads the article the way a human reviewer would, judging whether it is the same entity and whether the content is genuinely adverse.

That shift matters for adverse media screening specifically. The bottleneck was never retrieval; it was deciding, at scale, which of thousands of hits deserve a human’s attention. Better classification is what turns a firehose of mentions into a short, defensible queue.

The false-positive problem

The category’s dirty secret is noise. Name matching produces enormous volumes of hits that are not real risk, and every one still has to be cleared by someone.

The scale is well documented in the adjacent world of transaction monitoring. In legacy rule-based stacks, between 90% and 95% of alerts are false positives, on PwC figures cited widely across the industry since 2018. Adverse media matching layers its own noise on top of that.

Common names, duplicated wire stories, stale archives, and the wrong John Smith all generate hits. The value of a modern system is not that it finds more; it is that it suppresses more of the wrong things while keeping the right ones.

Adverse media screening tools and software, compared

The adverse media screening tools market is mature and consolidated. The established vendors compete on source coverage, matching accuracy, risk categorization, and how fresh their data is. Here is an honest look at where each fits.

ComplyAdvantage built its adverse media screening software around a proprietary database rather than raw news. It advertises over 11,000 media sources across 200+ countries, updated daily, and maps hits to 14 FATF-aligned risk categories so alerts arrive pre-classified. It is a strong fit for fintechs that want structure out of the box.

LexisNexis Risk Solutions is the incumbent for large institutions. Its WorldCompliance data set spans more than 8 million risk profiles across 250 countries and 58 languages, backed by a large research operation. The depth is unmatched; the tradeoff is enterprise pricing and batch-oriented delivery.

Dow Jones Risk & Compliance leans on its newsroom heritage. Its adverse media solution screens over 17,000 licensed Factiva sources with continuous, real-time screening against financial-crime and reputational risk. Licensed-source quality is the selling point.

Moody’s (through its Grid database, formerly RDC) is built for scale. Grid draws on 13,500+ media sources and 29M+ risk profiles built from 3B+ reviewed articles, with risk categories aligned to AML frameworks. It suits firms that want one very large structured graph.

Nasdaq Verafin approaches the problem from the network side, using a consortium data approach to cut false positives across the institutions on its platform. For banks already on Verafin for fraud and AML, the adverse media screening solution is a natural extension.

The shared blind spot

All of these adverse media screening solutions are excellent at what they do, and they share one gap. Every one screens licensed news, watchlists, and PEP data. None of them screen what AI answer engines say about an entity.

That matters more each quarter. When a compliance analyst, a journalist, or a counterparty asks ChatGPT or Perplexity about a company, the answer they get is a risk surface — and it is shaped by how those engines cite and summarize sources. Our guide to how AI engines cite sources walks through why that layer behaves differently from a news index.

An entity can look clean on the lists and still be described as under investigation in an AI answer, or the reverse. Neither state shows up in a traditional adverse media check.

The reason is structural. Incumbent tools were designed around licensing agreements with news aggregators, so their world ends at the sources they license. AI answers are synthesized on the fly from the open web, which no aggregator licenses, so they fall outside the model entirely.

For a compliance team, the practical question is what a motivated outsider would find. Counterparties, journalists, and regulators increasingly start with an AI query, not a database, so the AI-answer layer is now part of your real risk picture whether you screen it or not.

The detection-lag problem

Coverage is only half of screening quality. The other half is timing — how quickly a new adverse event reaches the data your system actually reads.

This is not a fringe concern. Wolfsberg tells firms to assess coverage, matching, and data timeliness when they evaluate a negative-news screening solution. Timeliness is an explicit selection criterion, not an afterthought.

The vendors sit at different points on that axis. ComplyAdvantage refreshes its database daily; Dow Jones markets continuous, real-time screening; several enterprise feeds still run on batch cycles. A story that breaks on Monday may not surface in a batch-refreshed index until later in the week.

Open-web news moves faster than any licensed index, because it is the source those indexes draw from. A story appears in Google News the moment it is published, and an adverse media monitoring layer reading that feed sees it immediately. Reducing the gap between “event happens” and “your screen flags it” is the single highest-leverage improvement most programs can make.

There is a compounding effect, too. Detection lag is not just a first-alert problem; it stretches the window in which you keep transacting with a counterparty who has already become high-risk. Every day of lag is a day of exposure that a regulator can later ask you to explain.

What the open web and AI answers actually surface

To see how much signal lives outside the licensed indexes, we ran a small first-party test: five publicly documented enforcement and fraud events — the TD Bank AML settlement, the Binance settlement, the Wirecard fraud, the FTX collapse, and the Danske Bank scandal — through cloro’s open-web surface and through an AI answer engine, then checked whether each surface returned the known adverse event.

Both did, every time. Open-web search returned risk-relevant coverage for all five entities; the AI answer engine named the specific adverse event for all five, with roughly ten cited sources per answer.

Surface	Surfaced the known event	What we saw
Open-web search	5 of 5 entities	43 of 46 top results were adverse-relevant
AI answer engine	5 of 5 entities	~10 citations per answer
Licensed news index	not tested	vendors self-report daily-to-real-time refresh

Two things stood out. The AI answers leaned on strong primary sources — the DOJ, SEC, FinCEN, and OCC — but they also cited Reddit threads and personal blogs in the same answer. That mix is exactly why the AI-answer layer is a risk surface worth screening rather than trusting blindly: it can be right, current, and poorly sourced all at once.

The method is deliberately reproducible: one open-web call and one AI-answer call per entity, the same two calls the build recipe below automates. One honest caveat — during this run cloro’s dedicated Google News surface returned empty, and the open-web search surface carried the signal instead.

How to build adverse media screening with cloro

You do not need a monolithic vendor to run modern adverse media screening. If you are a RegTech builder, you can assemble the open-web and AI-answer layer yourself and keep the sanctions and PEP lists wherever you already have them.

The honest scoping matters here. cloro is the data infrastructure for the third layer of a screening stack — news, web search, and AI-engine answers per entity, as structured JSON. It is not a watchlist provider, and you should keep using a dedicated sanctions and PEP source for that layer.

The build follows the same pipeline described above, wired to fast, structured feeds:

import requests

CLORO_KEY = "sk_live_your_api_key_here"

def screen_entity(name, aliases):
    """Pull news + SERP + AI-answer signals for one counterparty."""
    queries = [name] + [f"{name} {t}" for t in
               ("fraud", "money laundering", "sanctions", "investigation")]
    queries += aliases

    hits = []
    for q in queries:
        # Google News: fresh, dated coverage the moment it publishes
        resp = requests.post(
            "https://api.cloro.dev/v1/monitor/google/news",
            headers={"Authorization": f"Bearer {CLORO_KEY}"},
            json={"query": q, "country": "US"},
        )
        resp.raise_for_status()
        result = resp.json().get("result", {})
        hits += result.get("newsResults", [])

    return hits

def classify(hit, entity):
    """LLM relevance + severity grading — replaces brittle keyword rules."""
    prompt = (
        f"Entity under review: {entity}\n"
        f"Article: {hit['title']} — {hit['snippet']}\n"
        "Is this the same entity? Is the content adverse (financial crime, "
        "sanctions, fraud, enforcement)? Return JSON: "
        "{match: bool, adverse: bool, severity: 1-5, category: str}."
    )
    return call_llm(prompt)  # your model of choice

Retrieval comes from the Google News API for dated coverage and the SERP API for the wider web. Classification is a single LLM call per hit that grades match, adverse-or-not, severity, and category — far more precise than keyword rules.

The AI-answer leg is the differentiator. Query the AI engines for each entity and treat the summaries as another feed, so you screen not just the news but what the engines tell the world. This is the same signal behind cloro’s news monitoring workload, pointed at counterparties instead of your own brand.

Wiring ongoing monitoring

The onboarding screen is the easy half. The regulatory obligation is continuous, so the same screen_entity call has to run on a schedule for every active relationship, not just at sign-up.

The practical pattern is a nightly or intraday job over your book of counterparties, storing a hash of prior dispositions so you only surface what changed. New adverse coverage since the last run becomes an alert; everything else stays quiet. That keeps analyst attention on genuinely new risk rather than yesterday’s cleared hits.

From there, disposition is your logic: severity thresholds route hits to auto-clear, alert, or human review, and cleared matches update the risk profile. The full endpoint reference and pay-per-call pricing sit behind the adverse media screening API, which is the fastest way to add the open-web and AI layer to an existing compliance stack.

Adverse media screening is not going away — the regulatory floor only rises. The programs that win are the ones that shrink detection lag and screen the surfaces their vendors still ignore.