What adverse media screening does, and what a hit means

01What adverse media screening is

Sanctions and PEP screening ask whether a name appears on a list. Adverse media asks whether a name has been reported in the news in connection with an offence. Someone can be absent from every watchlist and still be the subject of a fraud indictment reported last Tuesday.

We screen against GDELT, an open global index of news coverage. Two paths feed it:

• the GDELT DOC 2.0 article search, which finds articles by keyword; and
• the GDELT GKG 2.1 bulk feed, which publishes, every 15 minutes, the person entities GDELT extracted from each article.

The GKG path is the one that matters for recall. A real hit on a subject frequently carries a headline that names nobody — “Goldman Sachs settles shareholder lawsuit over 1MDB scandal” is an article about Najib Razak that a headline search can never reach. GKG hands us the person names GDELT pulled out of the body, so those articles become findable.

Coverage begins at 1 January 2017, GDELT's DOC archive floor, and the default search window is the last 8 years.

02What a hit means, and what it does not

The decision matrix maps every combination of risk category, evidence strength and match multiplicity to one of Pass, Review or Fail. Out of the box, every adverse-media cell holds the same value. These are the shipped defaults, before any tenant override:

An allegation reported in the press is something an analyst assesses, not an adjudicated blocking event. Three settings let a tenant decide otherwise, and each is a deliberate tenant choice:

• the per-tenant decision-matrix override (PUT /v1/tenants/me/risk-profile/decision-matrix, tenant-admin only) raises a named cell to Fail and is stored in the tenant’s risk profile as the record of that decision;
• a per-warning-type override does the same for one warning type;
• High-band escalation, which a tenant switches on, can escalate a case to Fail on a name-identical adverse-media hit while the adverse-media cell itself still reads Review.

None of them can block on a partial name. Any adverse-media Fail is clamped back to Review unless the name match is 100% character-identical (DecisionMatrix.cs, applied in RiskScoringEngine.cs). The Pass side is a default too, not a law: an override can set an adverse-media cell to Pass, because the floor that forbids Pass covers watchlist categories only.

Three limits that change how you should read a hit

• A theme means the concept appears in the article, not that the article is about it. GDELT tags themes from the whole body, so a corruption theme can fire on a comic-book plot summary. The theme filter is a cheap high-recall pre-filter; the identification work happens afterwards, by binding the subject's name to the person entity GDELT extracted.
• Name matching is name matching. A common name will surface articles about a different person. That is what the clear/confirm step in section 4 exists for.
• The category label is derived, not editorial. See section 5.

03“Unavailable”: the status that stops a silence being read as a clean result

Every screening records whether the adverse-media stage actually ran. There are four values (Domain/Screening/AdverseMediaStatus.cs):

GDELT's free tier returns its rate-limit notice as plain text under HTTP 200. That response used to fail deserialization and degrade quietly to “no results” — an analyst, and an auditor, saw a clean pass on a check that had never run. On a compliance control that is a correctness defect, so the status is now persisted with the screening and printed on both the customer report and the regulator pack, banner included.

A subject nobody has screened before has no pre-collected evidence, so the first screening reports Unavailable straight away and enqueues the name; collection picks it up within minutes. We would rather tell you we have not looked than take seven seconds to tell you nothing.

04What an analyst does with a hit

Each article that matches is a match on the case, and each match carries its own disposition, independent of the case as a whole:

• open — not yet judged, or a previous judgement reversed.
• cleared — judged a false positive for this subject: wrong person, wrong context, or already assessed.
• confirmed — judged a true match for this subject.

The per-match disposition never touches the case-level status, so dismissing one adverse-media article cannot accidentally close a sanctions hit on the same screening. The case is closed separately, by the case-level review action, with its own reason.

Every disposition carries the analyst's identity, the timestamp and an optional reason of up to 2,000 characters, and is written into the case note thread. That trail is what the regulator pack renders.

To triage a hit an analyst does not need to click out. The report carries the headline, the publisher, the publication date and the derived category on the page, so the evidence survives the link rotting.

05Categories

Each hit is labelled with one category, derived from the offence keyword or the GDELT theme that admitted it (Domain/Screening/AdverseMediaCategory.cs):

A tenant can enable a subset of categories and attach its own decision policy per category.

Two things are worth knowing about the label. The theme allowlist behind it was derived from a measured live corpus of GDELT records, and it deliberately excludes themes that denote the institutions that fight an offence — an article about an anti-corruption authority is not adverse media about the people in it, and treating it as such was a real defect that has been fixed. Separately, GeneralCrime was introduced after a measurement found that a majority of records admitted by a catch-all code were being stamped FinancialCrime; a robbery is not financial crime.

Rows persisted before that change keep their original label. Historical compliance labels are not rewritten, so the same article screened before and after can carry two different categories. The row timestamp is what distinguishes them.

06Data handling

What is stored

Article metadata only: the URL, the headline, the publishing outlet's domain, the date the source first indexed it, the single GDELT person entity that binds your data subject, and the offence theme. Article bodies are never retained. The 15-minute bulk slices are downloaded, parsed and discarded.

Whose names are stored

GDELT typically extracts three to eight people from an article. We persist only the one that matches a name already held as a data subject. The co-occurring names are discarded, because retaining them would extend offence-adjacent records to people who never asked to be screened.

How long

The default retention window is 5 years (AdverseMedia:Gkg:RetentionYears). Each row is stamped at write time with the window it was collected under and the date it expires; a daily job deletes what has passed that date. The window is configured in exactly one place, so a shortened retention setting cannot silently apply to rows that were promised longer. If the configured window cannot fit the storage the environment declares, the service refuses to start rather than quietly keeping less than it promised.

Erasure

A data-subject erasure removes the adverse-media evidence held under that person's name, in the same transaction as the rest of their record. Because the evidence is derived from a public feed, a later collection run could otherwise re-create it — so erasure also writes a deny-list entry, keyed the same way the rows are keyed, and the write path checks it. Erasure removes derived news evidence; it does not touch the tenant's own screening records, which are the compliance artefact.

Legal basis is the deployer's

Reporting on alleged offences is criminal-offence-adjacent data under GDPR Article 10. An EU deployer needs its own lawful basis, DPIA and retention limits, and can switch collection off entirely with a single environment setting.

07What runs when

Adverse media does not run inside your screening request. Two background jobs collect evidence ahead of time, and a screening reads what they have collected:

• a sweep that fetches and enriches evidence for names that have been screened or are under monitoring, waking every 15 minutes and refreshing a given name at most once a day;
• a tailer that pulls each new 15-minute GDELT bulk slice and adds hits for names already in the book.

Screening latency is unaffected: a screening reads local evidence and returns, and a name with no evidence yet returns Unavailable immediately rather than waiting on a third party.

Source attribution: adverse-media evidence is derived from The GDELT Project's open data. Article links point to the original publisher.