Fuzzy matching, traditionally used for name matching when undertaking customer screening, is a technique that identifies approximate matches rather than exact matches. It is particularly useful when dealing with data that may have inconsistencies, such as typographical errors, different spelling variations, or missing characters. By allowing for a certain degree of variation, fuzzy matching helps to find similar entries that are not identical.
How Fuzzy Matching Works
Fuzzy matching algorithms compare strings and determine how similar they are based on predefined criteria. These criteria can include the number of characters that need to be changed, added, or removed to turn one string into another. A common example is the Levenshtein distance, which measures the number of single-character edits required to change one word into another. Analysts can set a threshold to decide how close the match needs to be for it to be considered a valid match.
Challenges with Fuzzy Matching for Name Matching
Despite its usefulness in many scenarios, fuzzy matching presents significant challenges when it comes to name matching. The primary issue is the high number of false positives it generates. When the threshold for matching is set too low, many unrelated names may be flagged as potential matches, creating a considerable amount of work for analysts to sift through the irrelevant data. This is particularly problematic when dealing with large datasets.
Fuzzy matching also struggles with aliases and nicknames, such as “Ted” for “Edward” or “Maggie” for “Margaret.” These variations are not always phonetically or character-wise similar, making them difficult to detect using traditional fuzzy matching methods.
Cultural Limitations of Standard Algorithms
Standard fuzzy matching algorithms do not account for the likelihood of different variants or the cultural significance of certain name elements. For example, certain typographical errors are more likely than others, and accents on letters may be frequently missed.
Furthermore, some names do not have a standard English spelling, leading to multiple variations and further complicating the matching process. For example, the name “Mohammad” has numerous spellings due to the lack of vowels in Arabic. Similarly, different Latin languages will transcribe Cyrillic names differently. For example, German and English versions of the name “Vladimir Putin” may be spelled differently despite both being Latin languages.
The importance of effective transliteration, transcription and translation in customer name screening is also raised by The Wolfsberg Group in their 2022 Negative News Screening FAQs, which provide guidance on tackling different languages and scripts in the context of adverse media screening.
What is Ripjar’s Approach to Name Matching?
Unlike traditional fuzzy matching, our name variants approach is designed to minimise false positives and maximise recall, ensuring accurate and efficient name matching.
Rather than relying only on traditional fuzzy matching methods, we take a much more comprehensive, in-depth approach. Our advanced technology encompasses over 25 different techniques which work together to identify the most relevant and accurate matches based on different name variants. This can then be tuned to suit individual organisations.
Name Variants Database
Instead of relying solely on fuzzy matching, we undertake name screening in over 400 languages, scripts and dialects, and maintain an extensive database of over 1 million name variants, encompassing different spellings, translations, and truncations of names.
Ripjar offers a 94% improvement over fuzzy matching technology
International name matching expert
Our approach involves using multiple matching techniques simultaneously rather than relying on a single fuzzy matching algorithm. We consider a variety of factors, including character-based algorithms, phonetic matching, and real-life name variant patterns. By addressing all potential variations, we ensure that our system captures a comprehensive range of name possibilities.
For instance, while other systems might rely solely on the Levenshtein distance to measure character changes, we incorporate subtraction variants, spelling corrections, and database variants created from observed name representations in different countries. We also apply region-specific rules based on the origin of names, enhancing our ability to match names accurately across diverse datasets.
Additional data points such as date of birth, location, or other identifiers, are then used to help identify and discard mismatches.
Risk-Based Approach and Custom Tuning
We understand that there is no one-size-fits-all solution to name matching – it depends on the specific use case and the associated risk tolerance. That’s why we enable a risk-based approach, offering multiple different matching strategies out of the box. These can then be further refined to suit different scenarios and client needs, with 25+ name variant techniques to choose from.
Our Operational Data Science team works closely with customers to fine-tune these strategies, balancing the need for high recall with the minimisation of false positives. This collaboration ensures that the matching process is as efficient and accurate as possible. We can also tailor the matching strategies for smaller subsets of client data, or based on different types of risks, such as sanctions or adverse media, providing users with control over the balance between recall and the amount of manual review work required.
Data-Optimised Name Matching and Linguistic Matching
We leverage real data to optimise our matching processes, including analysing the frequencies of name occurrences. By understanding how often certain names appear on watchlists or in media, we can make informed decisions about which name versions to include or exclude, enhancing the overall performance of our matching engine.
Specifically for adverse media matching, we are also able to leverage the rarity of a name in a particular region to reduce the false positives arising from returning too many matches on common names.
In addition, we use linguistic techniques to understand the origin and structure of names, which allows us to identify and manage name variations more effectively. Having characterised the likely origin of a name, we use a rule-based name matching system to vary different parts of the matching to account for certain variations and name structures being more prevalent in certain cultures/languages. For example, we handle declensions in different languages, recognising them as legitimate variants rather than typographical errors. This level of linguistic sophistication enables us to accurately match names across different cultures and languages.
Our name variants approach also includes translations of corporate names in various languages, and their likely manipulations. For example, a corporate name in Chinese might have multiple international translations, and we include all plausible versions to ensure comprehensive coverage.
Conclusion
Fuzzy matching alone, while useful for finding approximate matches, falls short in the context of name matching due to its high rate of false positives and inability to account for cultural and linguistic nuances. Maintaining a comprehensive database of name variants and employing multiple matching techniques can provide more accurate and efficient results. Understanding the likely mistakes and variations specific to names is crucial for effective name matching, making it a complex task that goes beyond the capabilities of simple fuzzy matching algorithms.
Ripjar’s name matching system stands out from traditional fuzzy matching approaches by leveraging a combination of data science, linguistic techniques, and customised tuning. Our comprehensive name variants database ensures that we deliver accurate and efficient name matching for a wide range of use cases and enables a risk-based approach to be undertaken. By understanding the cultural and structural nuances of names, we provide a superior solution that meets the complex needs of global screening at scale, and consistently performs top in name matching tests.
In an increasingly crowded adverse media landscape, location data associated with news stories can be particularly useful to compliance teams when it comes to accurately matching customer names and addressing compliance threats.
Given the clarity that it can provide, many firms are now integrating location data as a secondary identifier, in addition to identifiers such as dates, times, and monetary amounts. Location data has the potential to significantly enhance the customer screening process, offering a far greater level of coverage at scale for adverse media name searches.
Location-enhanced name searches can represent a valuable advantage in a challenging adverse media environment – not least in reducing the cost of false positive alerts triggered by the sheer volume of news stories. With that in mind, it’s time for compliance teams to explore the potential of location data to transform the accuracy and efficiency of their screening process.
What is location data?
When firms screen customers against adverse media, they use certain identifiers to help match names against stories, and develop a more accurate understanding of compliance risk. Location information is one of those identifiers: by extracting location data from stories, compliance teams increase the likelihood of a correct name match, and so enhance their anti-financial crime (AFC) compliance response.
Even when location data is only a small component of a given story, it may carry significant screening value. For example, if a search for a customer living in Scotland triggers an alert from a local news outlet, such as “The Cheltenham Echo”, it is unlikely that the story in question will be about the same person given the localised, southern-Midlands focus of the source, and so can be quickly remediated as a false positive.
It’s easy to underestimate the prevalence (and potential) of location data in media stories. Around 95% of media articles include some location component that carries value for compliance risk assessment. In this context, the term ‘location data’ may include:
Places referred to in the story itself
The place in which the story itself was filed
The place of media publication
The physical location or headquarters of the media outlet
Ripjar’s AI Risk Profiles feature, available as part of the Labyrinth Screening platform, offers further insight into the value of location data. Around 99% of AI Risk Profiles that include adverse media articles contain location information.
By using location data in combination and context with other indicators, compliance teams can significantly enhance its value in the name-matching process, and ultimately, in the accuracy of screening results.
What screening problems does location data solve?
Navigating the vast landscape of adverse media is a significant screening challenge. Firms must sort through huge volumes of data to find relevant risk information, while managing the associated noise, including duplicate stories or stories about people with similar names – all of which can drastically increase the false positive alert rate. Some of the most common location challenges include:
Frequent travellers: High profile customers, such as politicians, may travel around the world frequently and generate numerous news stories in the locations that they visit. This can confuse name searches and make it harder for compliance teams to get to the meaningful risk data that they need.
Name variance: Adverse media stories concerning the same topic may duplicate references to the same location, creating extra work for screening solutions: “Oxford’, for example, may also be referred to in stories as “Oxfordshire”, “Oxon” and “OX”.
Punctuation: Some location references include lots of punctuation, such as Manhattan, New York, New York. Complexity of punctuation may make it hard for screening solutions to identify the meaningful data.
By implementing context-driven searches which incorporate location data, compliance teams can cut through that screening noise, reduce false positives, and enrich their customer risk profiles.
Criminal methodologies
Location data isn’t just a ‘nice to have’ option for compliance teams. As criminal methodologies evolve, and regulators respond, firms must be able to keep up with a constantly evolving risk environment, embracing screening innovation wherever possible to meet compliance expectations..
With this challenge in mind, location data takes on an added significance – not just as a secondary identifier but as an integral component of compliance strategy, capable of transforming the accuracy and effectiveness of the name search process.
Regulatory trends and requirements
Beyond adverse media screening applications, financial regulators are zeroing-in on the potential of location data in wider compliance.
Since 2020, the US Office of Foreign Assets Control (OFAC) has required obligated entities to implement IP address geolocation screening measures, along with location-screening considerations as part of due diligence, for virtual currency firms. OFAC set out its location screening expectations in its paper: Sanctions Compliance Guidance for the Virtual Currency Industry. Similarly, in June 2024, the US Bureau of Industry and Security (BIS) added addresses to its watchlists, essentially prohibiting trade with entities at the designated locations.
It goes without saying that location data has always been critical in the enforcement of international sanctions, including OFAC’s programmes against Iran, Cuba, Venezuela, and so on. As that data becomes more available, and more functional, it’s likely that authorities around the world will seek to integrate it further into screening requirements – with adverse media screening a priority.
Who can benefit from location data screening?
All firms with anti-money laundering (AML) compliance concerns may benefit from integrating reliable location data into their screening process since it promises an extra layer of accuracy and confidence for the risk assessment process, while reducing the time and cost associated with false positive alert remediation.
Firms with particularly large retail client bases, stretched across multiple locations, may find even greater value, not least in enhancing the trust relationship between users of a particular platform and secondary service providers associated with it. In these contexts, identity matching must be more discerning to ensure it functions effectively at the largest scales.
Travel aggregation sites, for example, offering products and services in multiple global locations will benefit significantly from that enhanced trust metric. Online accommodation exchanges will be able to enhance the trust and confidence between both guests and hosts, while simultaneously offering expedited onboarding and smoother payment processing. Meanwhile, retail banks and B2C tech companies that trade internationally also stand to benefit from enhanced location screening capabilities.
Like regulators, industry bodies have begun to pick up on the potential advantage of location data. Events like TrustCon, for example, offer forums where experts can discuss innovations, including advanced adverse media screening.
Next Generation Location Screening with Ripjar
With screening solutions powered by industry-leading AI technology, Ripjar is harnessing the power of location data to keep our clients at the cutting edge of financial crime compliance.
In the latest upgrade to the Labyrinth Screening platform, we integrated additional enhanced location data analysis capabilities, designed to help compliance teams build out rich, detailed customer risk profiles and significantly reduce the potential for false positive alerts. Our screening technology integrates AI algorithms to identify and extract relevant information from both structured and unstructured data sources, and facilitate faster, stronger compliance decisions.
Labyrinth’s location data analysis also offers valuable flexibility, automatically adjusting name match scores based on the population of a given location. A search for “John Smith” in Cheltenham, for example, would deliver a higher score than a search for “John Smith” in London, given the disparity in population and the lower number of “John Smith” names in the former location. The system combines that feature with frequency of names appearing in media screening results to determine the likelihood of a correct match, and assign an accurate score.
Labyrinth Screening Location Test Results
Our location data identifiers are achieving real-world screening results, at scale, in a complex and challenging adverse media landscape. In an early trial by a US-based technology company involving 1.2 million people registered with address data, location-enhanced Labyrinth Screening achieved over 90% true positive accuracy in its top screening hits.
The company highly values internal trust between its service providers and its clients, and so needs as smooth a screening process as possible, that preserves the user experience. The trial demonstrated Labyrinth’s capacity to deliver that type of media screening at scale. In the riskiest 3,000 of the customer names screened, the upgraded system revealed the following AML compliance risks:
The manufacture of illegal or controlled drugs
Organised criminal trafficking of drugs
Attempted murder
Prostitution of a minor
A charge of armed robbery and aggravated battery causing harm
Using a combination of location data and name-frequency, the upgraded Labyrinth Screening process not only delivered a higher rate of exact identity matches but enabled the tech company to permanently remove many of the highest risk accounts.
On Thursday 30 May, Ripjar hosted a webinar on Navigating Cyber Threats. The online event included a guest presentation and a discussion of the top cyber-security challenges in the current threat landscape. Ripjar’s Chief Product Officer, Gabriel Hopkins, chaired the panel which brought together:
Brian Wrozek – Principal Analyst, Forrester Don Smith – Vice President Threat Research, Secureworks Matt Chinnery – Pre-Sales Manager, Ripjar
Let’s explore some of the webinar’s highlights and key discussion points.
Presentation: Threat Intelligence Trends
Opening the webinar, guest speaker Brian Wrozek outlined the top cyber-threats faced by the global business community in 2024, and the role that threat intelligence plays in addressing them.
Brian began with a reminder that day-to-day cyber-threats such as ransomware and denial of service are pervasive, and never really go away. Beyond that ambient, ongoing threat, he pointed to a number of emerging concerns in 2024, grouping them into two broad trends:
The uncertainty created by false or unverifiable information, such as:
Narrative attacks
Deepfakes
AI responses
The increasing complexity of threat environments in which advanced technology installations create opportunities for misinformation to take hold. Complexity trends include issues relating to:
AI software supply chain
Nation state espionage
These emerging trends have been prompting firms to increase their security spending in recent years, with security leaders prioritising threat intelligence as a means to address emerging and future threats. Brian noted, however, that firms also allocate a significant portion of their cyber-incident response to the investigation phase, meaning that better threat intelligence capabilities could enhance both the efficiency and impact of their response.
With that in mind, many firms are focusing on threat hunting: the process of identifying areas in which a system may be compromised, and developing strategies to deal with that vulnerability. Effective threat hunting should have multiple objectives:
Primary objectives:
Finding previously undetected network intrusions
Verifying that there is no evidence of a successful attack
Enhancing a firm’s security controls
Secondary objectives:
Enhancing security team knowledge and skills
Demonstrating the complexity and maturity of the security solutions
Acquiring potential new security assets
Brian stressed that threat hunting should result in firms being able to take tangible action – and so the intelligence that it provides must be complete, accurate, relevant, and timely to the needs of the commissioning firm. He added that expectations around cyber-security are also rising, and contributing to the need for threat-fighters to leverage as much expertise as possible, including from third-party data and networks.
Exploring trends in cyber-security and threat intelligence
Responding to Brian’s presentation on threat intelligence trends, Don Smith zeroed in on one of the most specific threats on the landscape: ransomware attacks.
Don made the point that the ransomware’s danger lies not only in its prevalence but its impact, since the ROI on a ransomware network intrusion is “maximised” in the sense that it “drives an entire criminal ecosystem”. Referencing the success of the recent Operation Endgame, the largest coordinated operation by European law enforcement authorities against malware botnets, Don emphasised the importance of ongoing disruption to that criminal ecosystem. As part of that disruptive effort, Don added that firms should focus on cyber-security fundamentals, such as applying timely patches for internet-facing software, fully implementing multi-factor authentication (including for admins and supply chain), and dealing with basic-commodity malware.
Don pointed to the need for firms to “extract salient learning” from the threat intelligence they gain from incidents, and use it to determine where they should be investing in controls or double-checking compliance. That constant strengthening is critical since cyber-criminals typically take “a scattergun approach” to their attack methodologies, with firms “self-selecting as victims through the state of their control frameworks.”
Ripjar’s Matt Chinnery also focused on the pervasiveness of cyber-threats, warning that “everyone is a threat and everyone is a target” in the 21st century cyber-security landscape. Complicating the challenge further is the constant evolution of both threats and targets, which means that it often falls to security professionals to ”fit in with what the bad guys are doing”. Matt raised the importance of threat data, pointing out that many clients struggle to “make sense” of the sheer volume of information feeding in to their risk screening solutions, making it “difficult to ratify and justify and get to the root cause immediately.”
He added that, while having enough information to address potential cyber-threats is critical, the quality of that information is just as important to defending against attacks.
Gathering meaningful threat intelligence
“Automation is absolutely key” to the threat data challenge, said Don Smith. Discussing his experience with Ripjar’s Labyrinth Intelligence over the last 5 years, he pointed to the value of the platform’s flexibility, a quality that allows his team to analyse vast amounts of risk data in seconds, and tailor “tens of thousands of indicators” to the specific needs of clients.
That screening capacity includes performing quality assurance against client telemetry from the past 24 hours, along with other checks and balances, to ensure the client’s security operations centre (SOC) isn’t adversely impacted, and domains like Amazon.com aren’t inadvertently put into a protective block list. “There is absolutely no way that you can do threat intelligence these days without having automation to orchestrate the researcher playbook,” Don said.
Understanding a new generation of hackers
Exploring the threat of “different attack groups”, Gabriel Hopkins brought up the issue of a new type of bad actor: “nihilistic young hackers with very, very different motivations” to their predecessors. Don characterised this group as “the Minecraft generation of young, Western-located cyber-criminals who have a unique combination of skillsets”. He added that this new type of hacker has not only the technical expertise to carry out cyber-attacks but the “social engineering” skill and eloquence to exploit the human vulnerabilities of a target network.
Brian noted that the motivation of this new kind of hacker is fundamental to their threat, with groups perpetrating attacks for reasons beyond the financial, and targeting critical infrastructure as much as corporate assets. “In the past, there was almost an honour among the threat actors,” he said. “They didn’t target things like nuclear power plants or the healthcare industry. Now it seems all that’s changed. Anything’s a target.”
Don underlined that difficulty. “The motivations change,” he said. “One day they’re an affiliate of a ransomware gang. Another day, they’re stealing crypto wallets. Another day, they’re doxxing or swatting their friends. Very, very unpredictable.”
The novelty of this emergent hacking trend adds to the danger it poses, Brian argued. Since critical infrastructure targets haven’t had to contend with the level of cyber-threat they now face, they are now years behind their corporate counterparts in terms of their investment in, and maturity level of, cyber-security. He suggested that while nation state actors were once held back by a sense of mutual financial threat, the new generation of hackers doesn’t face that same constraint.
The importance of threat intelligence to threat hunting
Brian illustrated the advantages of leveraging threat intelligence during a cyber-attack, describing an instance in which he was able to use a TTP approach (tactics, techniques and procedures) to identify a specific threat actor, inform the security response, and ultimately eliminate the threat. Don pointed out that threat hunting also plays a critical role in the effectiveness of cyber-security frameworks, emphasising the investigative value of hunting exercises, which not only prevent attacks but increase client confidence and create better business outcomes.
Picking up on that point, Brian noted that threat reports help justify budget decisions by demonstrating the requirements, and limitations, of a particular security system, and ultimately supporting the opinions of compliance officers.
The value and functionality of AI and machine learning
Brian suggested that AI tools are contributing to the effectiveness of threat intelligence. For example, generative AI queries phrased in simple English are replacing the archaic query language required in previous security frameworks, speeding up incident responses and threat hunting activities, and even simplifying the search process to the point that junior analysts can be better involved. Similarly, generative AI tools are capable of creating human-readable summaries and reports from unstructured threat intelligence data, making the screening process quicker and easier to validate.
Following on from Brian, Don recommended caution around the more open-ended applications of AI, including requests for generative AI tools to report on specific threat actors. He pointed out that, even when producing quality, informative threat intelligence “98% of the time”, generative AI is vulnerable to hallucinations and firms should be wary of that potential outcome. “They’re trained to sound like they know the answer,” Gabriel added, “even when they don’t.”
Gabriel closed the webinar by asking the panellists for key takeaways from the discussion:
Matt focused on the need for specifics, suggesting that in order to acquire actionable security data, firms need to know exactly “what it is you’re trying to get” from their threat intelligence. He also stressed the need for users to be mindful of generative AI since, as much as security teams can use AI tools for good, threat actors may also be able to use them maliciously. To that end, users should stay on top of their security responsibilities, enabling dual-factor authentication, patching regularly, and preparing for the unexpected.
Don emphasised the importance of perspective when dealing with the changing threat landscape. “There is an awful lot of turbulence for very little flow,” he said, suggesting that while information security incidents may appear to vary over the short term, over a longer timescale we see consistency across TTP and “the learning remains fairly solid.”
Finally, Brian urged security leaders to strike the right balance between implementing foundational security controls and taking the time to understand new threats, solutions, and technologies. Finding that balance not only offers protection from existing and emerging cyber-threats, but helps firms keep pace with competitors in a rapidly changing risk landscape.
On 13 June 2024, in coordination with other G7 countries, the UK announced a round of new sanctions on Russia, strengthening the economic measures already in place to degrade Vladmir Putin’s war machine in Ukraine. Announced during the G7 Leaders Summit in Italy, these latest sanctions will have far-reaching global effects, which means businesses in the UK and beyond must understand how to achieve compliance, or face costly penalties.
UK Russia Sanctions in 2024
The UK issued a previous round of sanctions against Russia in February 2024, targeting supplies of munitions and military end-use tools, and persons involved in the financing of Putin’s war effort. At the time, the UK also announced that it would be increasing its focus on Russia’s attempts to avoid sanctions, not least by cracking down on corporate compliance, and by addressing the illicit trading of oil via a ‘shadow fleet’ of ships.
The UK’s position on Russia sanctions reflects that of its international partners, and in particular members of the G7 who have also signalled an increased focus on Russia’s attempts to circumvent the economic measures against it.
New Sanctions Targets
The UK has issued 50 new sanctions designations against Russia. Notable amongst the new targets is the ‘shadow fleet’ of ships which the Russian government uses to trade oil in violation of existing sanctions. The oil trade is critical to financing the Ukraine invasion and generated 31% of Russia’s total federal revenues in 2023.
The new UK sanctions also target munitions, machine tools, microelectronics suppliers, and companies providing logistics to the Russian military. That group of targets includes foreign companies based in China, Turkey, Kyrgyzstan, and Israel, and ships supplying military end-use goods to Russia from North Korea.
In conjunction with new US sanctions, the UK sanctions have also increased pressure on Russia’s financial system and, in particular, the Moscow Stock Exchange, with new restrictions for individuals and entities involved in Russian stock trading.
UK Prime Minister Rishi Sunak stressed that the renewed economic pressure would “bear down on Russia’s ability to fund its war machine” and cut off Putin’s ability to prolong the Ukraine conflict. Echoing that sentiment, Foreign Secretary David Cameron said that the UK would continue to work with its International partners to increase that pressure, and would “stand by Ukraine in this fight.”
The UK Government has listed the targets of its new Russia sanctions, which include:
4 ships in Russia’s ‘shadow fleet’
2 ships found to have transported weapons to Russia
1 ship manager
6 entities in the Russian liquefied natural gas (LNG) sector
1 Russian insurance company
2 entities with connections to Russia’s civil nuclear sector
4 entities and 1 individual with connections to the Russian financial system
21 suppliers of goods for Russian military end-use
6 individuals or entities with connections to the Russian state that have benefited from the invasion
2 designation from the UK’s Central African Republic sanctions lists with connections to the Wagner Group
The Future of UK Sanctions on Russia
To date, the UK Government has sanctioned over 2,000 individuals and entities, with restrictions applied to over 90% of the Russian banking sector, and over 130 close associates of Vladmir Putin – with a combined net worth of around £147 billion.
The UK’s latest sanctions, along with those issued by the G7, suggest that the pressure on Russia will continue for the foreseeable future, with a more complex focus on the Russian government’s attempts to circumvent the measures against it, and on efforts to fund its campaign in Ukraine. To that end, the UK recently published the UK Sanctions Strategy, which set out the UK Government’s sanctions position on Russia, and detailed wider diplomatic efforts to address Vladmir Putin’s evasion strategies.
As the UK’s sanctions against Russia evolve and expand, it’s vital that UK firms put adequate sanctions screening measures in place to meet their compliance obligations. Ripjar’s Labyrinth Screening platform is designed to help compliance teams keep pace with new sanctions by providing continuous monitoring and real-time name search capabilities of international sanctions lists, and of thousands of adverse media sources from across the world. Labyrinth Screening includes the cutting-edge AI Risk Profiles and AI Summaries features, which enable compliance teams to identify and extract only the most relevant risk information from vast amounts of unstructured data, and then use advanced generative AI to create a concise summary of that risk, and significantly reduce assessment times.
