Adversarial-Cost Screening

Counterparty screening programs in export control, sanctions, and defense supply-chain compliance are validated almost exclusively by process metrics — alert volume, clearance rate, list-coverage currency, screening latency. None of these measure whether the program detects the conduct it exists to detect. This paper identifies three structural defects common to these programs and specifies a validation framework that corrects them.

The defects are: (1) endogenous label generation, in which outcome data is observable only for counterparties the program already flagged, making measured performance a function of the screening policy rather than of the threat; (2) entity resolution as the unmeasured binding constraint, in which screening accuracy is capped by the ability to recognize that nominally distinct counterparties are one operation, a capability no program reports on; and (3) adversary-controlled attribute dependence, in which screening weight concentrates on attributes the screened party can change at negligible cost while structurally costly attributes go unused.

The framework specifies an exogenous sampling requirement, an entity-resolution maturity measure, an attribute-cost tiering scheme, and an evaluation battery that produces defensible estimates of screening effectiveness. It applies the result to reasonable-care determinations under EAR Part 732, to sanctions-compliance testing under OFAC’s Framework, and to scienter and materiality analysis under the False Claims Act, including cybersecurity certification under the Civil Cyber-Fraud Initiative, where recent settlements supply worked illustrations of each failure mode.