Payments Training Hub
Compliance hold investigation 1 NOW Compliance 2 Screening matches and false positives 3 Parties 4 Worked 5 Release or rejection 6 Investigation data A compliance hold investigation starts when a payment is stopped by sanctions screening Step 1 of 6 Compliance hold investigation 1 NOW Compliance 2 Screening matches and false positives 3 Parties 4 Worked 5 Release or rejection 6 Investigation data A compliance hold investigation starts when a payment is stopped by sanctions screening Step 1 of 6
Screening matches and false positives 1 Compliance 2 NOW Screening matches and false positives 3 Parties 4 Worked 5 Release or rejection 6 Investigation data Why a payment is held is that a name, a country, a purpose or an amount matched a rule, and the rule requires a human to decide whether the match is real or a false positive. Step 2 of 6 Screening matches and false positives 1 Compliance 2 NOW Screening matches and false positives 3 Parties 4 Worked 5 Release or rejection 6 Investigation data Why a payment is held is that a name, a country, a purpose or an amount matched a rule, and the rule requires a human to decide whether the match is real or a false positive. Step 2 of 6
Parties in the hold 1 Compliance 2 Screening matches and false positives 3 NOW Parties 4 Worked 5 Release or rejection 6 Investigation data The parties are the bank that holds the payment Step 3 of 6 Parties in the hold 1 Compliance 2 Screening matches and false positives 3 NOW Parties 4 Worked 5 Release or rejection 6 Investigation data The parties are the bank that holds the payment Step 3 of 6
Worked example of a hold 1 Compliance 2 Screening matches and false positives 3 Parties 4 NOW Worked 5 Release or rejection 6 Investigation data How the investigation runs is shown by a worked example. Step 4 of 6 Worked example of a hold 1 Compliance 2 Screening matches and false positives 3 Parties 4 NOW Worked 5 Release or rejection 6 Investigation data How the investigation runs is shown by a worked example. Step 4 of 6
Release or rejection 1 Compliance 2 Screening matches and false positives 3 Parties 4 Worked 5 NOW Release or rejection 6 Investigation data On success the hold is resolved, the payment is released or rejected with a reason, the customer is told the outcome, Step 5 of 6 Release or rejection 1 Compliance 2 Screening matches and false positives 3 Parties 4 Worked 5 NOW Release or rejection 6 Investigation data On success the hold is resolved, the payment is released or rejected with a reason, the customer is told the outcome, Step 5 of 6
Investigation data 1 Compliance 2 Screening matches and false positives 3 Parties 4 Worked 5 Release or rejection 6 NOW Investigation data The data the investigation needs is the UETR, the status, the holding bank, the review team, the information requested, and the deadline. Step 6 of 6 Investigation data 1 Compliance 2 Screening matches and false positives 3 Parties 4 Worked 5 Release or rejection 6 NOW Investigation data The data the investigation needs is the UETR, the status, the holding bank, the review team, the information requested, and the deadline. Step 6 of 6

Exception workflow, step by step.

0:00 / 6:27 Step 1 of 6

Investigation: the compliance hold

Cross-border investigations, Lesson 5 of 10, Narration 6:27, D06 Cross-border payments

Correspondent bankingSanctions screeningCreditor

What you will learn

Your objective. By the end of this lesson, you will be able to explain investigation: the compliance hold. A compliance hold investigation starts when a payment is stopped by sanctions screening, anti-money laundering monitoring or fraud detection, and the customer wants to know why the money has not arrived, and the bank.

Why it matters. Takeaway: find the holder, the review and the deadline, tell the customer a factual update without revealing the match, and record the hold.

Chapter objective: Finding a missing MT103, a missing MT202 COV, and every other cross-border failure

Key learning points

  • Compliance hold investigation
  • Screening matches and false positives
  • Parties in the hold
  • Worked example of a hold
  • Release or rejection
  • Investigation data

Key terms

Correspondent banking: A service where one bank holds accounts for another bank so the second bank can make payments in currencies or countries where it has no branch.

Sanctions screening: Checking payment parties, countries and references against sanctions lists published by governments and international bodies.

Creditor: The party that is owed money and receives a payment, such as a supplier, a seller or a service provider.

Exception investigation workflow showing Investigation: the compliance hold.

Practise this lesson

Exercise

A company in London pays a supplier in Dubai USD 140,000 on Monday, and on Tuesday the supplier has not been credited. Work out the compliance hold investigation.

Use pacs.028 to find the holding bank, then the compliance channel to find the review, and ask the customer for the invoice that proves the false positive.

  1. What to do. State the cause, the release day, and what the customer is told.

Correct result. The intermediary holds the payment because the supplier name matched a sanctions list entry; the customer sends the invoice Tuesday afternoon, the review confirms a false positive Wednesday morning, and the supplier is credited Wednesday at 11:00; the customer is told only that the payment was delayed for a routine review.

Why. A compliance hold is a legal pause, and the customer message must not reveal the screening.

Check your understanding

Practice question

Why must a bank not tell a customer the reason for a compliance hold in detail?

Takeaway and next step

What to remember

Takeaway: find the holder, the review and the deadline, tell the customer a factual update without revealing the match, and record the hold.

Follow USD 140,000 through every stage, from instruction to beneficiary credit, and note where it can stop.

Open the Payment Lifecycle Simulator →

Builds on "Investigation: the delayed payment".

Transcript and full text

Show transcript

A compliance hold investigation starts when a payment is stopped by sanctions screening, anti-money laundering monitoring or fraud detection, and the customer wants to know why the money has not arrived, and the bank must answer without revealing the screening itself. A hold is not a rejection and it is not a failure: it is a pause while a human reviews a match, and most held payments are released within hours, but the customer experiences it as a delay, who is holding it, and when it will be released, while saying nothing that would tip off a person who is genuinely trying to evade sanctions. Source: Wolfsberg Correspondent Banking Principles; SWIFT CBPR+ usage guidelines; Financial Action Task Force Recommendation 16 on wire transfer information. Why a payment is held is that a name, a country, a purpose or an amount matched a rule, and the rule requires a human to decide whether the match is real or a false positive. A supplier named Al-Rashid Trading may match a sanctioned entity with a similar name, a payment to a high-risk country may trigger an enhanced review, a payment with a vague purpose may trigger a request for more information, and a payment that is much larger than the customer usual pattern may trigger a fraud review. Each of those is a different review, done by a different team, with a different deadline, and the investigation must find which team holds the payment, because asking the wrong team wastes a day. The parties are the bank that holds the payment, which is usually an intermediary or the creditor bank, the compliance team that reviews it, the debtor bank, which must answer its customer, and the customer, who must be told the payment is delayed without being told why in a way that reveals the screening. The enquiry message is pacs.028, which asks for the status, and the answer is pacs.002 with a status that shows the payment is pending, but the status does not say why, because the reason is confidential, so the investigator must follow up through the compliance channel, not through the payment message, and must record the hold in the case file without writing the match details into a message the customer will see. How the investigation runs is shown by a worked example. A company in London pays a supplier in Dubai USD 140,000 on Monday at 09:00, and on Tuesday the supplier has not been credited. The London bank sends pacs.028, and the intermediary replies that the payment is pending, with no further detail. The London bank asks the customer for the invoice, the customer sends it on Tuesday afternoon, the intermediary reviews it on Wednesday morning, confirms the false positive, releases the payment, and the supplier is credited on Wednesday at 11:00, one day late. The customer is told the payment was delayed for a routine review and is now released, with no mention of the sanctions match. On success the hold is resolved, the payment is released or rejected with a reason, the customer is told the outcome, and the case closes with the hold recorded, so the next payment to the same supplier is recognised as a known false positive and is released faster. On failure the hold sits unworked, because the compliance queue is long, or the customer does not provide the information requested, and the payment stays held for days, and the customer escalates, and the bank must decide whether to release, reject or return the payment. The most expensive failure is a hold that is never communicated to the customer, because the customer assumes the payment is lost, and the relationship is damaged even though the bank was doing its legal duty. The data the investigation needs is the UETR, the status, the holding bank, the review team, the information requested, and the deadline. The information requested is the field that matters most, because a hold that needs an invoice cannot be released until the invoice arrives, and the investigator must ask the customer for it on day one, not day three. A BA must specify the hold notification, the information request, the deadline per hold type, the escalation when the deadline passes, and the customer message, which must be factual, must not reveal the screening, and must give a realistic time, because a customer who is told the payment will be released today, when it will be released on Wednesday, will complain twice. Edge cases show the depth. A true hit, where the payment really is to a sanctioned person, must be blocked and reported, not released, and the customer must be told only that the payment cannot be processed, with no detail that would help the customer evade the sanction. A payment that is held for fraud, because the customer may be a victim of a scam, must be handled differently, because the bank may need to warn the customer, and the customer may need to be protected from themselves. A payment that is held by one bank in the chain but not by the others must be traced to the holding bank, because asking the other banks wastes time, and the pacs.028 chain is how the holding bank is found. The effect on the bank is a compliance duty that cannot be skipped, and a queue of held payments that must be worked within legal deadlines, because a hold that exceeds the deadline becomes a regulatory breach. The effect on the customer is a delay that feels arbitrary, and the bank must manage that feeling with a factual update and a realistic time. The effect on operations is a case file that records the hold, the review, the information requested and the outcome, without recording the screening match in a place the customer can see. What a BA, PO or SME must understand is that a compliance hold is a legal pause, not a system failure, and the investigation is about finding the holder, the review and the deadline, while saying nothing that reveals the screening. The requirement must name the hold notification, the information request, the deadlines, the escalation and the customer message. The test is to take one held payment, find the holding bank, state the review type and the deadline, and tell the customer a factual update without revealing the match, because if the message reveals the screening, the bank has breached its duty. Further reading: Wolfsberg Correspondent Banking Principles; Financial Action Task Force Recommendation 16; SWIFT CBPR+ usage guidelines. Last reviewed 7 November 2026.

A compliance hold investigation starts when a payment is stopped by sanctions screening, anti-money laundering monitoring or fraud detection, and the customer wants to know why the money has not arrived, and the bank must answer without revealing the screening itself. A hold is not a rejection and it is not a failure: it is a pause while a human reviews a match, and most held payments are released within hours, but the customer experiences it as a delay, who is holding it, and when it will be released, while saying nothing that would tip off a person who is genuinely trying to evade sanctions. Source: Wolfsberg Correspondent Banking Principles; SWIFT CBPR+ usage guidelines; Financial Action Task Force Recommendation 16 on wire transfer information.

Why a payment is held is that a name, a country, a purpose or an amount matched a rule, and the rule requires a human to decide whether the match is real or a false positive. A supplier named Al-Rashid Trading may match a sanctioned entity with a similar name, a payment to a high-risk country may trigger an enhanced review, a payment with a vague purpose may trigger a request for more information, and a payment that is much larger than the customer usual pattern may trigger a fraud review. Each of those is a different review, done by a different team, with a different deadline, and the investigation must find which team holds the payment, because asking the wrong team wastes a day.

The parties are the bank that holds the payment, which is usually an intermediary or the creditor bank, the compliance team that reviews it, the debtor bank, which must answer its customer, and the customer, who must be told the payment is delayed without being told why in a way that reveals the screening. The enquiry message is pacs.028, which asks for the status, and the answer is pacs.002 with a status that shows the payment is pending, but the status does not say why, because the reason is confidential, so the investigator must follow up through the compliance channel, not through the payment message, and must record the hold in the case file without writing the match details into a message the customer will see.

How the investigation runs is shown by a worked example. A company in London pays a supplier in Dubai USD 140,000 on Monday at 09:00, and on Tuesday the supplier has not been credited. The London bank sends pacs.028, and the intermediary replies that the payment is pending, with no further detail. The London bank asks the customer for the invoice, the customer sends it on Tuesday afternoon, the intermediary reviews it on Wednesday morning, confirms the false positive, releases the payment, and the supplier is credited on Wednesday at 11:00, one day late. The customer is told the payment was delayed for a routine review and is now released, with no mention of the sanctions match.

On success the hold is resolved, the payment is released or rejected with a reason, the customer is told the outcome, and the case closes with the hold recorded, so the next payment to the same supplier is recognised as a known false positive and is released faster. On failure the hold sits unworked, because the compliance queue is long, or the customer does not provide the information requested, and the payment stays held for days, and the customer escalates, and the bank must decide whether to release, reject or return the payment. The most expensive failure is a hold that is never communicated to the customer, because the customer assumes the payment is lost, and the relationship is damaged even though the bank was doing its legal duty.

The data the investigation needs is the UETR, the status, the holding bank, the review team, the information requested, and the deadline. The information requested is the field that matters most, because a hold that needs an invoice cannot be released until the invoice arrives, and the investigator must ask the customer for it on day one, not day three. A BA must specify the hold notification, the information request, the deadline per hold type, the escalation when the deadline passes, and the customer message, which must be factual, must not reveal the screening, and must give a realistic time, because a customer who is told the payment will be released today, when it will be released on Wednesday, will complain twice.

Edge cases show the depth. A true hit, where the payment really is to a sanctioned person, must be blocked and reported, not released, and the customer must be told only that the payment cannot be processed, with no detail that would help the customer evade the sanction. A payment that is held for fraud, because the customer may be a victim of a scam, must be handled differently, because the bank may need to warn the customer, and the customer may need to be protected from themselves. A payment that is held by one bank in the chain but not by the others must be traced to the holding bank, because asking the other banks wastes time, and the pacs.028 chain is how the holding bank is found.

The effect on the bank is a compliance duty that cannot be skipped, and a queue of held payments that must be worked within legal deadlines, because a hold that exceeds the deadline becomes a regulatory breach. The effect on the customer is a delay that feels arbitrary, and the bank must manage that feeling with a factual update and a realistic time. The effect on operations is a case file that records the hold, the review, the information requested and the outcome, without recording the screening match in a place the customer can see.

What a BA, PO or SME must understand is that a compliance hold is a legal pause, not a system failure, and the investigation is about finding the holder, the review and the deadline, while saying nothing that reveals the screening. The requirement must name the hold notification, the information request, the deadlines, the escalation and the customer message. The test is to take one held payment, find the holding bank, state the review type and the deadline, and tell the customer a factual update without revealing the match, because if the message reveals the screening, the bank has breached its duty. Further reading: Wolfsberg Correspondent Banking Principles; Financial Action Task Force Recommendation 16; SWIFT CBPR+ usage guidelines. Last reviewed 7 November 2026.

Full lesson text (all scenes)

Completing a lesson updates your progress dashboard on the homepage.

Scene timestamps are estimated by allocating the narration text proportionally across the real audio length. The audio playback position is the source of truth: pause freezes the visual, seeking restores the correct scene, replay restarts the scene animation.