Interview with Matt Mills, CEO, Ripjar
1. Ireland just launched its first national AML strategy, while the US scrapped beneficial ownership reporting in the same week. What does this divergence tell us about global compliance today?
The updates in the US and Ireland are a clear indication that regulatory regimes are diverging by jurisdiction, moving away from having a common global standard, and that divergence is likely to continue.
The onus is on compliance teams now to establish a baseline standard for validating who they are doing business with so they can manage not only regulatory risk but also reputational risk. From a regulatory perspective, what is good enough in one region might not be good enough in another.
In the US for example, scrapping beneficial ownership reporting takes away an important check for financial institutions and enterprises. The risk might still exist and so they still need another way to prove ownership.Â
When nobody outside a narrow circle can verify who the real owner is, that opacity gets used by the people who most need it hidden. This is where continuous, intelligence-led screening becomes crucial, filling the gap left by regulation with a proactive approach, rather than relying on regulators to provide the mandate.
None of this is likely to be a permanent position either. Regulatory requirements will keep shifting in both directions, tightening in some markets and loosening in others, so organisations can’t build a strategy around today’s specific rules alone. The institutions that manage this well are the ones balancing two things at once: staying responsive to whatever a regulator currently mandates, and maintaining their own pragmatic, risk-based view of who they should be doing business with, independent of that mandate.
2. Your research found 93% of financial leaders call adverse media screening critical, yet 58% still rely on manual searches. Why does that gap exist?
The research shows that financial services leaders understand the importance of adverse media screening as part of their risk management processes. However, as you point out, there is a clear gap between intent and capability. The reason comes down to understanding the complexity of adverse media screening in practice and what is required to perform accurate and efficient checks.
Manual searching relies on typing a name into a search engine and simply reading what comes back. The problem is that a name on its own is ambiguous. Common names will return thousands of results, many of which will be related to the wrong person, while aliases and misspelling will often be missed entirely.
What’s needed is a way to resolve all of the data you have into a single, accurate entity, ensuring the thousands of returned articles across multiple languages are properly filtered, deduplicated and assigned back to the person actually being screened. Manual screening doesn’t do this and so, that gap between intent and capability highlights a tooling issue and the need for institutions to move away from periodic, incomplete checks to continuous, intelligence-led screening.
3. When regulation moves at different speeds across countries, how should institutions think about screening as a baseline standard rather than a checkbox?
Compliance is crucial. However, the problem is if a firm aligns its screening function to the minimum regulatory requirement in any region, they are prioritising pure compliance over the reality of truly understanding the risk associated with who they are doing business with.
Continuous screening, applied consistently across customers and regions, provides a baseline that not only addresses regulatory risk but also the broader reputational and financial risks associating with onboarding.Â
It also means that if regulation evolves and becomes stricter in any particular market, a firm’s screening operation is already built to meet the new requirement and the firm is not having to retool their processes to catch up.
4. Even where regulation lags, institutions still have to know who they’re doing business with. How should compliance teams think about that responsibility independently?
Regulation exists to set a minimum, enforceable standard that the regulator can then audit against. However, an institution’s own risk appetite exists to protect against financial and reputational risk. Depending on the regulatory mandate, compliance alone might not fully mitigate against those risks.
The potential for risk exposure exists regardless of the regulatory requirement and so financial services leaders need to think more broadly about duty of care and not just compliance. They need to know who they are onboarding and they need to continuously monitor for the lifetime of a relationship to identify any new risks that emerge and, crucially, they need to be able to record and explain their decisions.
Regulation should inform how an institution screens but it is not the only reason to screen in the first place and it shouldn’t be taken in isolation as the minimum requirement.
5. What does “continuous, intelligence-led screening” actually look like in practice?
All too often, adverse media screening processes – particularly if they are manual – take a snapshot in time, so deliver a series of incomplete and periodic checks.
Continuous, intelligence-led screening firstly means resolving a name to the right entity. A search engine returning an article with an apparent name match is not the same as an intelligent system analysing and verifying that the person mentioned is person being onboarded.
It also involves ongoing monitoring for the lifetime of a relationship, beyond the initial onboarding check. If a new risk appears in adverse media further down the line, the screening function needs to surface that risk and assign it to the right entity automatically, without analysts having to continually repeat manual searches.
Explainability is also crucial. Analysts need to be able to show what was checked, when, against which sources, and why an alert was escalated or closed. Ultimately, a platform should be able to read large volumes of data continuously, resolve it to a single entity profile rather than exist as a mass of unverified alerts, and then record every decision so it is traceable back to its source.
6. What risks are institutions carrying by relying on manual internet searches instead of technology-led screening?
The main risk is that manual searches appear to be conducting due diligence but they fall short of providing a robust means to fully protect against risk.
The problem is the process depends largely on which search terms an analyst happens to choose and also how a search engine then surfaces the results on any given day. Often, important results might have been buried or even removed so will be missed.
A manual search also stops when an analyst stops performing the searches. It doesn’t continually monitor for new risks and so it’s not built to identify new adverse coverage that might appear further into the customer relationship.
Many important adverse media mentions will also be in different languages. Another problem is that manual searches typically don’t handle multilingual sources.
7. With sanctions and regulations shifting fast in 2026, how is screening technology helping institutions keep pace?
The risk environment can move quickly, whether that is the US Treasury lifting oil sanctions on Russia or imposing new restrictions on Venezuela, and periodic, single point-in-time approaches are not built to keep pace.
What screening technology can enable is a move away from just checking if a counterparty is on a sanctions list today to identifying early warning signals that a counterparty might become a risk, or even appear on a list, tomorrow.
Intelligence-led screening can sometimes spot those signals in adverse media before a name lands on a sanctions list. In these instances, it then becomes far easier to make an informed decision and protect against that risk early, before it becomes a problem further into the relationship.
8. Ripjar’s roots trace back to national security and intelligence work. What does that bring to financial crime screening that traditional tools don’t?
Ripjar was founded by a team of GCHQ technologists. They came from a world where critical decisions around national security were made based on intelligence gathered from an overwhelming volume of open information.
The team applied this same philosophy and a specific engineering standard to enable a similarly high standard approach to financial institutions and enterprises tackling financial crime and reputational risk.Â
Systems built for national security have to be explainable, they have to scale and they have to produce a record that holds up to intense scrutiny. Many compliance tools were never designed to meet that bar as they were not held to it in the first place. Ripjar was built by people who were, which is the standard the company holds itself to even today.
9. If regulatory fragmentation continues, what should compliance teams be doing now to future-proof their approach?
The most important principle is this: build your screening process around accurate and efficient entity resolution and not just around a single regulatory mandate.
In practice, which sanctions list an institution screens against is already a combination of the regulator’s guidance and the institution’s own risk appetite. An international bank operating in the UK, for example, would typically need to screen against the OFSI, OFAC, EU and UN lists in parallel, and that combination looks different again for an institution based elsewhere.
A screening programme engineered around today’s specific set of lists and mandates has to be rebuilt every time a jurisdiction is added or a mandate changes. A platform built for continuous monitoring and that is able to identify who a business is dealing with accurately, for the lifetime of that relationship, in a way that is truly explainable, will be able to absorb a new list or flex to new mandates.
That means investing in a platform that can integrate different screening processes, including sanctions, PEPs and other watchlists plus adverse media screening, into one unified, dynamic profile so analysts get a consistent, 3D view of risk.
10. What’s one shift you’d want every compliance leader to make in how they think about screening technology this year?
The biggest shift compliance leaders can make is to move from periodic checks with fragmented technology or manual searches to intelligence-led screening that is continuous, AI-native by design and delivers a unified, dynamic view of risk.
This shift is underpinned by AI doing the heavy lifting: resolving who and what is actually being screened, filtering out the noise and surfacing only the alerts that carry genuine risk. Done well, that means a significant drop in false positives and a corresponding rise in true positive detection as compared to manual investigation, which means analysts spend less time and effort chasing false alerts and more time on the decisions that actually need a human judgement call.
About Matt Mills:
Matt Mills is CEO of Ripjar, the provider of smarter screening and risk intelligence solutions, and has over fifteen years of experience scaling high-growth technology companies in banking, payments, automation and security. Previously, he spent a decade at Featurespace as Chief Commercial Officer and General Manager, where he helped grow the organisation from twelve to more than four hundred employees before the company’s acquisition by Visa in 2024. Matt also led Innovation, Sales and Partnerships for Aurasma, later acquired by HP, where he expanded the business to over 10,000 commercial customers and partners during his three-year tenure.
