Alert Disposition

The process of reviewing and resolving sanctions screening alerts, determining whether a match is a true positive requiring action or a false positive to be dismissed.

TL;DR

TL;DR: Alert disposition is the step where a screening alert is reviewed and resolved, either escalated as a true positive or dismissed as a false positive. A clear disposition trail is essential for audits.

What disposition means

A screening tool flags a counterparty when it resembles an SDN List entry. Disposition is the decision that follows: does the alert represent a real match or a lookalike? A true positive is escalated, the transaction stops, and reporting or blocking obligations kick in. A false positive is dismissed with a reason, and the transaction proceeds. Every alert must end in one of these two states.

Why the record matters

The disposition is the evidence that the alert was actually reviewed rather than ignored. Regulators want to see not just that alerts were generated, but that each was resolved with a documented reason and the name of the person who resolved it. An undifferentiated queue with no disposition history is a compliance gap, even if the screening tool itself was working.

Disposition in an agent workflow

Agents make this decision in software rather than by hand. The clean path is automatic: screening returns ALLOW and the payment proceeds. The flagged path stops the payment and routes to review, where a human or a policy decides disposition. The key is that the flagged path must never silently fall through to approval.

Bottom line

Alert disposition is where screening either protects the organization or fails it. sanctionsai.dev's SCREEN, SCORE, STOP, STAMP protocol encodes this: flag, stop, and record the outcome so the disposition trail exists before OFAC ever asks for it.