What evidence do regulators expect from a screening programme?

Detailed Explanation

That the model works, and that you checked. Periodic validation — testing the matching engine against known positives and negatives, and recording the result. Scenario testing against list changes and edge cases such as transliterated names and partial identifiers. And an audit record of alert handling: what fired, who reviewed it, what they concluded, how long it took, and what was escalated. Timing matters as much as outcome. Documented SLAs on triage and escalation are part of the defence, because a correct decision made too late is still a control failure.