Home · Solutions · Legal & compliance
Solution · Legal & complianceThe whole counterparty base re-checked every night, not once at onboarding
Counterparty screening: sanctions, VAT status, registers
Every customer and supplier is re-screened daily against sanctions lists, the VAT taxpayer list, VIES and insolvency sources; people only look at the hits.
Executive summary
Your counterparty file was true on the day you checked it. Sanctions and VAT status moved after that.
We build a nightly screening run on the UiPath Platform against your SAP master data and the public sources your trade requires.
The whole base is checked every night, so coverage stops being a sampling argument and becomes a number the board can read.
SAP S/4HANA (payment and delivery blocks); SharePoint evidence library; Power BI compliance report
Business problem
Compliance monitoring
Screening is treated as an onboarding step. A new customer or supplier is checked against sanctions lists, its VAT number validated, its bank account confirmed, and the results filed. From that moment the record is assumed to be true, and stays assumed to be true for years while the facts behind it move. A sanctions package adds a name in March, a supplier is struck off the VAT register in June, a customer files for restructuring in October.
The people who discover this are never the ones who did the original check. Credit control finds out when an invoice cannot be settled, accounts payable when the tax adviser questions a deduction, sales when a delivery is stopped at the loading bay. The compliance officer finds out last, and then reconstructs what was known and when, from folders never built to answer that question.
Most companies answer with a quarterly sample: an analyst picks the largest counterparties and repeats the checks by hand. A sample tells you about the counterparties in the sample, nothing about the rest of the base, and nothing about the eleven weeks in between. At nine thousand records no manual routine covers the base often enough for the coverage to mean anything.
How it works today
Compliance opens each file once, at onboarding, and in a company that has grown past a few thousand counterparties the rest follows this route.
- PersonAt onboarding, compliance runs a sanctions search, checks the VAT number, confirms the bank account and saves screenshots to a folder
- WaitingNothing re-checks the record afterwards; the next look happens at contract renewal, or when a problem arrives from outside
- PersonOnce a quarter an analyst re-checks the largest counterparties by hand, one identifier at a time, across several public sites
- Risk of errorNames are compared by eye, so a transliteration, a changed legal form or a subsidiary of a listed parent goes unnoticed
- SystemPayment runs and deliveries go out against SAP master data whose bank accounts were last confirmed the day the record was created
- Risk of errorA listing, a VAT deregistration or an insolvency filing surfaces when the bank rejects a payment or the auditor asks
- PersonEvidence for the audit is reassembled afterwards from mailboxes, screenshot folders and people's memories
Why the current process costs more than it appears
The bill that never reaches the budget.
- A sample is not a control. Three percent of the base each quarter produces a folder that looks like diligence and a coverage figure no auditor accepts once they ask about the rest.
- Screenshots do not survive a real question. "Prove this supplier was clean on the day you paid it" needs a dated record per counterparty per check, and a browser window pasted into a Word file is not one.
- Discovery through the payment run is the most expensive route available: the goods have shipped, the invoice is posted, and the correction runs through legal, finance and the customer.
- Bank-account drift is a tax exposure finance rarely tracks. An account can leave the VAT taxpayer list with no signal to the payer, and a payment of PLN 15,000 or more to an account not on the list costs the deduction and brings joint liability for the supplier's VAT.
Cost of inaction
The first two rows price the control as salaried work. The third is a single-event illustration: a mid-sized customer of a distributor this size takes roughly €70,000 of deliveries a month, so a name listed in January and spotted in April has taken three months of goods that should not have moved. One scenario, not a probability, and the recovery cost sits on top.
What grows quietly is the gap between what the company believes about its counterparties and what is true. Every month the base gets larger, the last verified date gets older, and the share anyone has looked at in the past year gets smaller. Nothing signals this until something external does, and by then the question is not whether the control existed but why it did not.
A plausible organisation with realistic proportions. The figures are there to be recalculated on your data; they are not a client result.
A chemicals distributor trading in four countries from a Polish head office, on SAP S/4HANA and Microsoft 365 E3, with a compliance function of two who also handle contracts and insurance.
9,500 active counterparties in the master data, roughly 6,200 customers and 3,300 suppliers, growing by about 120 records a month; four list sources matter for the countries it trades in.
Every record was screened once, at creation. Each quarter an analyst re-checks the largest 300 counterparties by hand, about three percent of the base, and files the screenshots in a folder named after the quarter.
A repeat check across the sources takes roughly a minute and a half per counterparty. Covering the whole base monthly would consume most of one person's month, so it is never attempted.
Robots read the active counterparty base from SAP every night, score it against the sanctions lists in scope, verify VAT status, VAT numbers and bank accounts, and raise only scored hits as review tasks in Microsoft Teams; approved blocks reach SAP before the payment run.
In the modelled case the whole base is screened nightly instead of three percent quarterly, hits reach a named reviewer the following morning, and each counterparty carries a dated evidence record. These are modelled figures drawn from the design, not results measured at a client.
Proposed solution
We build a nightly screening run on the UiPath Platform against your SAP master data and the public sources your trade requires. Each run first refreshes and versions the lists: the EU consolidated list of persons, groups and entities subject to EU financial sanctions, the national list where it applies, and the UK or US lists if your export footprint requires them. Robots read the active customer and supplier records from SAP, normalise names and identifiers, and score each counterparty against every list entry. The rules are written with your compliance officer: identifier matches, normalised name comparison, alias and transliteration handling, and thresholds that separate a clear record from a review and a block candidate.
In the same pass, VAT status and reported bank accounts are checked against the Polish VAT taxpayer list, VAT numbers through VIES, and insolvency sources where a machine interface exists. Scored hits become UiPath Action Center tasks delivered into Microsoft Teams, showing the counterparty, the matched entry, the score and the reason on one card. The reviewer clears, escalates or asks for a block; a cleared match is remembered, so the same false positive does not return. An approved block reaches SAP as a payment or delivery block carrying the approver's name and a route back, and every check writes a dated evidence record to SharePoint.
Two design choices are worth stating plainly. Nothing in the matching uses a language model: a score that stops a payment must be reproducible two years later, before an auditor who expects the same answer from the same inputs. The second concerns scope. Banks run dedicated financial-crime platforms with commercial watchlist data, adverse-media feeds and tuning validated to a supervisor's standard, and UiPath sells one to financial services itself. This is not that. It is a corporate control on public sources, for a company that needs to know whether it may pay, deliver to or trade with the names in its own master data.
UiPath Orchestrator queues, time triggers, credential stores and audit; UiPath Robots; UiPath Integration Service connectors for SAP BAPI, SAP OData, Microsoft Teams and Microsoft OneDrive & SharePoint; UiPath Action Center tasks in Microsoft Teams; Microsoft Purview retention labels; Power BI
List acquisition and versioning, the scoring rules and thresholds, the decision bands and cleared-match register, the SAP block and release logic, the review and escalation flow, the evidence record and the monthly report
The VIES service and the VAT taxpayer list API and flat file, wrapped as managed connections through UiPath Integration Service Connector Builder; sources that publish files rather than APIs are downloaded, versioned and parsed on a schedule
How the automated process works
- AutomationOvernight, robots refresh every list in scope, version each download and record which version the run used
- SystemActive customer and supplier records are read from SAP through standard interfaces, with the fields the rules need
- AutomationNames and identifiers are normalised, then every counterparty is scored against every list entry and placed in one of three bands
- AutomationVAT status and bank accounts are checked against the VAT taxpayer list, VAT numbers against VIES, insolvency sources where an interface exists
- PersonScored hits arrive as Action Center tasks in Microsoft Teams; the reviewer clears, escalates or requests a block, with a reason
- AutomationApproved blocks reach SAP as payment or delivery blocks before the next payment run; releases follow the same route in reverse
- AutomationEach check writes a dated evidence record to SharePoint, a summary lands in the compliance channel, and Power BI updates coverage and open items
Human-in-the-loop model
Automation handles
- Refreshing, versioning and parsing every list, and running the full base against all of them each night
- Normalisation, scoring and banding, with the identifier checks against the VAT taxpayer list and VIES
- Writing approved blocks and releases to SAP, filing the evidence record, and posting the daily summary
People decide
- Whether a scored match is the same entity, using the card and the source record in front of them
- Whether a counterparty is blocked and on which side, payment or delivery, and when it is released
- Ownership and control questions, and any change to thresholds, list scope or the cleared-match register
Before and after
Systems and integrations
Everything below runs on licences and systems you already hold, or would need anyway.
Inputs
- SAP customer and supplier master data
- the EU consolidated sanctions list
- the Polish VAT taxpayer list (flat file and API)
- VIES
- insolvency and company registers where a machine interface exists
Automation layer
- UiPath Orchestrator
- UiPath Robots
- UiPath Integration Service
- UiPath Action Center
Target systems
- SAP S/4HANA (payment and delivery blocks)
- SharePoint evidence library
- Power BI compliance report
Human touchpoints: Action Center hit review in Microsoft Teams; block approval by compliance; daily summary in the compliance channel
Technologies used
run the nightly screening; hold the queue, schedule, retries, credentials and the audit trail
Areads the base, writes blocks to SAP, posts the summary and files evidence
Ahit review, block approval and escalation in the client people already have open
Aone dated evidence record per counterparty per check, retained for the agreed period
Amonthly compliance report: coverage, hits by band, decisions, time to decision, open items
Athe public reference data the screening runs against
BIllustrative economic model
A model, not a promise.
Salaried work is the yardstick here; nothing below is measured at a client. The company does not run the check monthly today, so the model prices the control it is missing rather than time it spends. A minute and a half per counterparty is a design estimate for a repeat check, not for first-time due diligence. €30 is a fully loaded hourly cost for a compliance analyst in Central Europe.
Run the numbers on your data
An illustrative estimate from your own inputs. It models released capacity; it is not a promise of savings.
Business benefits
- The whole base is checked every night, so coverage stops being a sampling argument and becomes a number the board can read
- A listing, a VAT deregistration or an insolvency filing reaches a named person the next morning instead of arriving through a rejected payment
- Payments to accounts that have left the VAT taxpayer list are stopped before the payment run, protecting the deduction and the VAT position
- Deliveries to a counterparty that has become restricted are blocked at the order, not argued about after the truck has left
- The two-person compliance function stops doing lookups and spends its time on the matches that need judgement
The management view
- Coverage becomes measurable: what share of the base was screened in the last twenty-four hours, against which list versions, with what result
- The control survives holidays, resignations and growth, and every decision on a hit is attributable: who cleared what, when, on what evidence, and how long it took
- Adding a country, a list or an acquired company's counterparty base is a configuration change, not a headcount request
Board-level KPIs
Security and governance
Control is not an add-on.
- The robot uses a dedicated SAP account with read rights on master data and the single write a block needs; no human's credentials are used
- API keys for the list sources live in the Orchestrator credential store or your own vault, never in a workflow or a script
- List downloads are versioned and kept, so a decision made in March can be replayed against the list as it stood in March
- Blocks are never applied on a robot's own authority; each carries the approver's name, the reason and a documented release route
- Screening data, evidence and tasks stay in your Microsoft 365 tenant and the UiPath Automation Cloud EU region, under retention rules compliance sets
Why now
The EU asset freeze binds every operator, not only banks. Council Regulation (EU) No 269/2014 prohibits making funds or economic resources available, directly or indirectly, to or for the benefit of a listed person, and a distributor that ships goods is making economic resources available.
The Polish VAT taxpayer list turned bank-account verification into a tax question with a price on it, and accounts leave that list without anyone telling the payer. Priced as salaried work, the control the company is not performing is worth about €7,140 a month.
The parts this needs are now ordinary: a scheduled robot, managed connectors into SAP and Microsoft 365, and a review task completed in the client already open on the reviewer's screen.
Relevant executive roles
Payments to deregistered accounts and blocked counterparties stop before the run, and the tax position no longer depends on when somebody last checked
Coverage becomes a number rather than an argument, and every decision on a hit is attributable and dated
Restricted counterparties are caught at the order rather than at the loading bay, so nobody is explaining a stopped delivery to a customer
Common questions and objections
The prohibition applies on the day of the transaction, not on the day of the check. A counterparty cleared last year tells you what was true last year; what matters at the payment run is what is true tonight.
It will, if the thresholds are guessed. That is why the rules are back-tested on your own base before anything is blocked, why hits are banded, and why a cleared match is remembered.
A robot never blocks on its own. It scores and presents; a named person decides, and the release path is as short as the block path. For the first weeks the run is alert-only.
When this is not the right solution
- A counterparty base of a few hundred records, where a disciplined monthly routine in a spreadsheet genuinely covers the ground
- Master data too poor to match on: missing countries, missing VAT numbers, names typed differently in each system; cleaning it comes first
- A regulated institution needing supervisor-grade AML and KYC, with commercial watchlist data, PEP and adverse-media coverage and validated tuning; that is a financial-crime platform, and this control is no substitute
A question for the next management meeting
Which of the counterparties we paid last month were last verified more than a year ago, and who would notice if one of them had been listed since?
Implementation approach
The first week looks the same at every client: we look at the data.
We deliver
- A scoping workshop on list sources: which sanctions regimes, registers and tax lists your trade requires
- Extraction of the counterparty base from SAP and a data-quality read on names, identifiers and bank details
- The list acquisition and versioning layer, and the scoring rules, thresholds and decision bands, tuned on your own base
- The review and approval flow in Action Center and Microsoft Teams, the SAP block and release logic, the evidence library with retention and the Power BI compliance report
We need from you
- A read-only SAP extract of active customers and suppliers, and a technical account for writing blocks back
- A named compliance owner who can decide thresholds, list scope and what a block means commercially
- Your current screening evidence, so the back-test can be compared against decisions already made
- The approval matrix: who may block a counterparty, who may release one, and who is told
Stages
Scoping
List sources, jurisdictions, counterparty segments, and what a hit obliges you to do
Rules
Normalisation, scoring, thresholds, decision bands and the cleared-match register
Build
Nightly run, SAP read and write-back, Teams review tasks, evidence library and report
Back-test
Rules run against historical data and known cases; thresholds tuned before anything is blocked
Go-live
Alert-only for the first weeks, then blocking enabled, with hypercare and a weekly rules review
Departmental. Effort is driven by the number of list sources and jurisdictions, the quality of names and identifiers in the master data, and how much a block should do inside SAP.
How much of your counterparty base was last checked more than a year ago?
Send us an anonymised extract of your counterparty master data: names, countries, identifiers and creation dates. We come back with a coverage map, a first count of likely matches, and the list sources for your markets.
Match your partner file to the listsThe neighbouring process usually has the same problem
One convincing email is all it takes to send a six-figure payment to a fraudster's account.
View solution ProcurementSupplier onboarding and due diligence in days, not weeksStop losing three weeks and the compliance evidence every time a plant needs a new supplier.
View solution Legal & complianceSegregation of duties checked weekly, not once a yearThe auditor finds your role conflicts once a year. By then the oldest of them is twelve months old.
View solution Legal & complianceData-subject requests answered in days, not at the deadlineStop answering GDPR requests by hand on day twenty-eight of a thirty-day clock.
View solution Case studyB2B client onboarding in 24 hoursA new client does not stop being “hot” just because your process has nine steps.
View case study Case studyFast, consistent credit decisionsStreamlined credit-limit management — supporting sales without adding risk.
View case studyIndustries we deliver this in most oftenManufacturing & industryTransport & logisticsRetail & e‑commerce