Skip to main content

DPIA — Sanctions Screening Provider

Provider: as configured via SANCTIONS_PROVIDER=http + SANCTIONS_PROVIDER_URL. Typical vendors: ComplyAdvantage (UK), Refinitiv WorldCheck (UK/US), Dow Jones RiskCenter (US), or a Uganda-local aggregator (record here if used). Contract owner: ZFA InsureLink (data controller) DPIA owner: DPO Last review: 2026-07-16

What data is transferred​

FieldPurposeRetention at provider
Full nameName-based sanctions matchProvider-dependent; typically transit-only
National IDIdentifier disambiguationContract-dependent; often retained per audit-log SLA (7y)
Date of birthMatch-scoring inputSame as above
Nationality (when known)Jurisdictional filteringSame as above
KYC tier flag (basic / enhanced)Feature toggle (PEP + adverse media)Not persisted

Where the data goes​

Depends on the concrete vendor. Most sanctions providers operate from the UK, EU, or US. Every deployment MUST populate SANCTIONS_LOCAL_HOSTS when the effective vendor terminates in Uganda; otherwise the dispatch service treats every screen as a DPPA §16 cross-border transfer.

DPPA §16 permits cross-border transfer when:

  • AML §17 statutory duty (lawfulBasis='legal_obligation') — every pre-payout, pre-issuance, pre-settlement screen falls here. The obligation itself is the legal basis; no per-subject consent required.
  • Explicit subject consent (lawfulBasis='consent') — ad-hoc admin-triggered screens require a DataTransferConsent row with transferKind='sanctions_offshore'. The dispatch layer enforces this via SanctionsService.assertCrossBorderAllowed().

Safeguards​

  • HTTPS transport; vendor-enforced TLS 1.2+.
  • Bearer-token authentication via SANCTIONS_PROVIDER_KEY; rotated per platform-secrets schedule.
  • Fail-closed on provider misconfiguration / unreachable — the HttpSanctionsProvider.failClosed() path returns a synthetic potential_match so the downstream payout blocks and compliance triages.
  • Startup config gate (Phase 1): production boot refuses when the effective provider is console. Override: SANCTIONS_ALLOW_CONSOLE_IN_PROD=true.
  • Dual-approval on false_positive resolution (Phase 1). One analyst proposes, a distinct analyst confirms.
  • Continuous monitoring via SanctionsRescreenJob (weekly Sunday 03:00 UTC). Any subject-status change pages compliance officers via sanctions.rescreen.status_changed_review.

Data-subject rights routing​

  • Access request (DPPA §17(1)): DPO exports the subject's SanctionsScreening rows via the DSAR module. Provider request
    • response blobs are decrypted only under the (Phase 3) SanctionsPii permission.
  • Rectification (§17(3)): if a wrong national ID or DOB was screened, DPO re-issues the screen through the standard POST /sanctions/screen endpoint after correcting the underlying Client / Agent record.
  • Erasure (§17(5)): the DSAR erase branch scrubs the underlying Client / Agent PII; historical SanctionsScreening rows retain the pseudonymised identifier for AML audit-trail purposes but no new screens can identify the erased subject.
  • Objection (§20): withdrawal of DataTransferConsent for sanctions_offshore blocks any non-transactional future screen (transactional screens continue under the AML §17 statutory carve-out).

Residual risks​

  • Provider retention — most vendors keep screening records for audit-log purposes on their own SLA (typically 7 years). A subject-erasure request cannot compel the provider to purge within Uganda's 30-day DSAR window; the DPO records the request date + the provider's own deletion SLA in the erasure audit event.
  • US surveillance regime — where the vendor is US-based (Dow Jones, or a WorldCheck deployment in the US region), CLOUD Act / FISA §702 apply. Same disclosure as the WhatsApp DPIA.
  • Match-list evolution — new sanctions programme designations (secondary sanctions, targeted-financial-sanctions expansions) broaden the scope of what counts as a match. The provider handles list ingestion; ZFA's exposure is that a subject cleared before a designation is added remains cleared until the weekly rescreen catches up.

Review cadence​

Annual, or on:

  • Provider contract change
  • New endpoint / region routing
  • Regulator query
  • Any incident involving a missed sanctions hit