A sanctions incident opens the moment someone confirms a screening match is a real hit, not a name collision. It freezes the client immediately and walks a two-person sign-off before that freeze can be resolved.
When You'd Use This
Open this when a screening surfaces a sanctions, PEP, or adverse-media match you believe is genuine, or when you're the one clearing an incident a colleague already triaged. It's not for a match you can dismiss at a glance - that's handled from the alerts page or the screening itself.
What Opens an Incident
Filing an incident against a contact freezes them immediately, in the same step - the client's status becomes frozen before anything else happens. It records the match type (OFAC, UN, LPEPR, SEMA, JVCFOA, OFSI, PEP, or adverse-media), which list it came from, and your rationale for treating it as real. Compliance setup has to be finished first, and you can only file against a client on a team you can write to.
What a Freeze Stops
A frozen or freeze-pending client can't move: any deal tied to them is refused at lender submission, they're skipped from equity-report enrollment and renewal outreach, and EDD or PEP attestation actions on their file are blocked. Nothing lifts automatically - only a clearance decision changes it.
Triage, Then the Second Sign Off
While the incident is frozen, anyone with write access to the client's team can triage it: write a rationale - a different date of birth, or a known false positive - and send it to senior management. That moves the incident to pending review, the first of two sign-offs.
Clearance is the second, and it's a separate, elevated action available only to an Owner/Admin or a Compliance Officer, once the incident is pending review. It deliberately ignores team boundaries - a compliance officer can clear an incident anywhere in the brokerage, not only on teams they belong to, because the sign-off authority the role carries doesn't stop at a team line. Clearing needs its own rationale plus an explicit choice: leave the client frozen, or lift the freeze. The default is to stay frozen even once the incident is marked resolved, so lifting it is a decision you make on purpose, not a side effect of closing the case.
Recording a Disclosure to the Authorities
Separately from triage and clearance, the incident tracks the filings a real hit usually requires: whether an RCMP or CSIS disclosure was filed and its reference number, whether an LPEPR was filed (the Listed Person or Entity Property Report, replacing the old TPR in 2025), and whether an STR was filed, with a rationale. These fields can be updated at any point, independent of where triage or clearance stand.
What To Watch Out For
- Clearance can't be skipped to - an incident has to pass through triage first.
- Lifting the freeze only happens as part of clearance. There's no separate unfreeze action, so clearing without checking that option leaves the client frozen.
- The STR rationale field is worth filling in even when you decide not to file - it's your documented reasoning either way.
What to Do Next
- Work the Compliance Alerts Page to see where a match like this usually surfaces first.
- Run a Screening on a Client for how the underlying match gets found in the first place.
- Open an enhanced due diligence case if the client's risk profile needs a deeper review beyond this incident.