Adverse Media

Adverse media means published information that links a client to crime or serious misconduct. It is also called negative news. A firm searches for it when it takes a client on, then again during the relationship, as part of customer due diligence.

The material is wider than newspapers. It can include court judgments or announcements by regulators. What makes it relevant is the subject: fraud, bribery, tax evasion, organised crime, terrorist financing.

It is a different check from two that sit next to it. Sanctions screening compares a name with official lists of designated persons. Screening for politically exposed persons asks whether someone holds a prominent public function. Adverse media has no official list.

Not by name. The words "adverse media" and "negative news" do not appear in the Anti-Money Laundering Regulation (AMLR). Adverse media screening is a practice that firms use to meet duties the regulation does set.

The first is the individual risk analysis. Article 20(2) requires a firm to set the extent of its due diligence by analysing the risks of each client, taking into account the risk variables in Annex I. One of those variables is the reputation of the customer and of the customer's beneficial owner. A firm cannot assess reputation without looking at what has been published.

The second is monitoring. Under Article 26(3) a firm must review client information when it becomes aware of a relevant fact about the client. A report that a client is under investigation can be such a fact. The third is enhanced due diligence. Article 34(3) requires a firm to take into account indicators of higher risk beyond those listed in Annex III.

How far to search is a question of risk. Article 20(3) set 10 July 2026 as the deadline for the EU's Anti-Money Laundering Authority to issue guidelines on the risk variables and factors firms take into account.

A source is credible when its origin is known, its facts can be checked, its date is clear. The AMLR sets no test for news sources. Its annexes speak of credible sources only for information about countries, with evaluation reports as the example.

One provision does set a standard that applies here. Where a firm processes data about criminal offences, Article 76 requires that the data originate from reliable sources and are accurate and up to date.

A court judgment, a regulator's published decision or a report by an established news organisation carries more weight than an anonymous blog or a social media post. Ten articles that copy one original are one source, not ten. An allegation is not a conviction, so an acquittal changes what an earlier report is worth.

By testing two things before it draws any conclusion: whether the report is about the client, then whether it matters. A false positive is a search result that matches the client's name but concerns someone else, or concerns the client but has no bearing on money laundering risk.

Identity comes first. The firm compares the details in the report with what it holds on file, such as date of birth, nationality, place of residence, occupation or company roles. Relevance comes second. The firm asks what the conduct was, how long ago, what the outcome was.

A result that survives both tests is information for the risk assessment, not a verdict. It may raise the client's risk, which leads to enhanced due diligence under Article 20(2). It may contribute to a suspicion that has to be reported under Article 69. Where software does the matching, a person still decides. Article 76(5) requires meaningful human intervention in any automated decision to refuse a client, end a relationship or change the extent of due diligence.

The search, the results, the decision. Article 21(3) requires a firm to keep a record of the actions it takes to apply customer due diligence, including the decisions taken, the supporting documents and the justifications.

For adverse media that means the date of the search, the names searched, the sources or tool used, and what came back. For each result the firm discounts, the file gives the reason. For each result it accepts, the file shows what changed: the risk rating, the level of due diligence, a referral to the person responsible for reporting. A search that finds nothing is recorded too. Without these records a firm cannot show its supervisor that its measures were appropriate, as Article 20(4) requires.

Where adverse media contains personal data about criminal offences, a firm may process it only as far as is strictly necessary to prevent money laundering and terrorist financing. That is often the case. Article 10 of the GDPR allows such data to be processed only under the control of official authority, or where EU or national law authorises it with safeguards.

Article 76 of the AMLR is that authorisation for firms covered by the regulation. It comes with conditions. The firm must tell clients that such data may be processed. The data must relate to money laundering, its predicate offences or terrorist financing. The firm must have procedures that distinguish between allegations, investigations, proceedings and convictions, with regard to the presumption of innocence. It must not take decisions that lead to biased or discriminatory outcomes.

Two further limits follow. The data may be used only for anti-money laundering purposes, never for commercial ones (Article 76(4)). Under the data minimisation principle in Article 5 of the GDPR, the file should hold what is relevant to the risk, not everything a search returned.