Conflicts and AML checks as data pipelines, not just compliance steps

The scene: 9:47 AM, new matter intake

A partner emails the intake team: new client, a mid-market industrial company wants representation on an acquisition. Before anyone opens a file, two systems have to run: a conflicts check (does this engagement put the firm against an existing client, or create a business conflict) and an AML screen (anti-money laundering, the regulatory regime requiring firms to verify who they are actually dealing with).

Both checks feel like compliance boxes to tick. Underneath, they are data pipelines: a query against a database, matched against reference data, refreshed on some cadence, returning results that a human then has to interpret. If the pipelinepipelineAlle aktiven Verkaufschancen über die Phasen des Vertriebsprozesses hinweg, zusammen mit ihrem gesamten potenziellen Wert und ihrer Abschlusswahrscheinlichkeit.Vollständige Definition ansehen → is stale, mismatched, or scoped wrong, the check passes when it shouldn't. That is how firms end up disqualified from matters, or worse, representing a sanctioned entity.

This lesson treats conflicts and AML as data engineering problems first, legal process second.

What a conflicts check actually queries

A conflicts database is not a separate app bolted onto the firm. It is a view built from the practice management system (PMS), the software of record for matters, clients, and billing parties (examples: Intapp, Elite 3E, Aderant).

Every new matter search runs against:

• Client and related-party names: the new client, its parent company, subsidiaries, directors, and the counterparties in the deal.
• Matter history: every matter the firm has ever opened, including matters where the firm acted adversely.
• Timekeeper conflicts: lawyers who worked on related matters, even at previous firms (lateral hire conflicts are a major source of risk).

The search logic matters enormously. A conflicts system that does exact-string matching will miss "Smith Industrials Ltd" when the new party is listed as "Smith Industrials Limited" or "Smith Industrials (UK)." Firms use fuzzy matching (algorithms that catch near-matches, misspellings, and name variants) and entity resolution (linking records that refer to the same real-world company despite different names in different systems).

Example: if the acquisition target's ultimate parent is a company the firm represented three years ago under a different registered name, a naive search misses it entirely. A well-built pipelinepipelineAlle aktiven Verkaufschancen über die Phasen des Vertriebsprozesses hinweg, zusammen mit ihrem gesamten potenziellen Wert und ihrer Abschlusswahrscheinlichkeit.Vollständige Definition ansehen → resolves both names to the same entity ID before searching.

AML screening: a different pipelinepipelineAlle aktiven Verkaufschancen über die Phasen des Vertriebsprozesses hinweg, zusammen mit ihrem gesamten potenziellen Wert und ihrer Abschlusswahrscheinlichkeit.Vollständige Definition ansehen →, external feeds

AML checks pull from a different data source: third-party watchlist and sanctions feeds, not the firm's own history. Relevant lists include:

• OFAC's Specially Designated Nationals list (US Treasury's Office of Foreign Assets Control, the sanctions list for individuals and entities barred from US transactions).
• The EU's consolidated sanctions list and UK's OFSI list (Office of Financial Sanctions Implementation).
• PEP databases (Politically Exposed Persons, people holding prominent public roles, screened for corruption risk).

Firms rarely query these lists directly. They subscribe to a vendor (examples: LexisNexis, Refinitiv World-Check, Dow Jones Risk & Compliance) that aggregates, cleans, and updates these feeds, then plugs into the firm's intake workflow via APIAPIApplication Programming Interface: eine standardisierte Schnittstelle, über die Anwendungen kommunizieren und Daten austauschen, ohne die interne Funktionsweise der jeweils anderen zu kennen.Vollständige Definition ansehen →.

Data freshness is the whole game here. Sanctions lists change constantly, OFAC updates its SDN list multiple times a month, sometimes overnight in response to geopolitical events. If a firm's vendor feed syncs weekly, there is a window where a newly sanctioned party clears screening. The official OFAC list is free and public: sanctionssearch.ofac.treas.gov.

Client Due Diligence (CDD), the broader process of verifying beneficial ownership, is where the pipelinepipelineAlle aktiven Verkaufschancen über die Phasen des Vertriebsprozesses hinweg, zusammen mit ihrem gesamten potenziellen Wert und ihrer Abschlusswahrscheinlichkeit.Vollständige Definition ansehen → gets harder. Beneficial ownership (who actually controls or profits from an entity, not just whose name is on paper) often requires chasing through shell structures. In the US, the Corporate Transparency Act (enacted 2021, reporting obligations phased in through 2024-2025) created a beneficial ownership registry via FinCEN (Financial Crimes Enforcement Network) aimed at exactly this problem, though its scope and enforcement have been subject to ongoing legal and regulatory changes, so firms should not treat it as a substitute for their own diligence.

Where hits get caught, and where they get missed

A hit gets caught when:

• Entity resolution correctly links the new party to a name variant already in the PMS.
• The AML vendor feed is synced daily or near-real-time and covers the right jurisdictions.
• The search scope includes related parties (directors, ultimate beneficial owners, parent/subsidiary chains), not just the named client.

A hit gets missed when:

• Search logic relies on exact match only, and a name has a transliteration difference (common with entities from non-Latin-script jurisdictions).
• The AML feed lags the sanctions list update, common with lower-tier vendors or infrequent sync schedules.
• The check runs only on the named client and skips beneficial owners two or three layers up the ownership chain.
• Matter data in the PMS itself is dirty: duplicate client records, inconsistent naming conventions, matters logged under a lawyer's shorthand instead of the legal entity name.

This last point is a data governancedata governanceData Governance umfasst die Regeln, Rollen und Prozesse, die sicherstellen, dass Daten in einer Organisation korrekt, sicher, klar definiert und verantwortungsvoll genutzt werden.Vollständige Definition ansehen → issue, not a legal one. Garbage in the PMS produces garbage conflicts results, no matter how good the search algorithm is.

A simplified view of the pipelinepipelineAlle aktiven Verkaufschancen über die Phasen des Vertriebsprozesses hinweg, zusammen mit ihrem gesamten potenziellen Wert und ihrer Abschlusswahrscheinlichkeit.Vollständige Definition ansehen →

New matter intake form
        │
        ▼
Entity extraction (client, parent, subs, counterparties, directors)
        │
        ├──> Conflicts query: fuzzy match against PMS matter/client history
        │         │
        │         └──> Human review of "possible matches" queue
        │
        └──> AML query: match against vendor-aggregated sanctions/PEP feeds
                  │
                  └──> Risk score + human review for any hit

Two separate pipelines, same intake trigger, different data sources, different refresh cadences. Both need a human review step because false positives are common (a common name, a coincidental match) and false negatives are the real danger.

Why this matters for firm-wide data architecture

Conflicts and AML data cannot simply flow into a general-purpose analytics warehouse alongside billing and time data. Two structural constraints:

Privilege and confidentiality. A conflicts search result that reveals "the firm previously represented Company X" can itself be sensitive, especially on unannounced deals. Access to conflicts data is typically restricted to the conflicts/OGC (Office of General Counsel) team and relevant matter partners, not open to whoever has a business intelligencebusiness intelligenceTechnologien und Prozesse, die Rohdaten über Reporting, Dashboards und Analysen in verwertbare Insights überführen, damit Teams auf Basis von Fakten statt Intuition entscheiden.Vollständige Definition ansehen → login.

Matter-level access control. Most law firm data systems, including PMS and document management systems (DMS, e.g. iManage, NetDocuments), enforce ethical walls (information barriers between lawyers on adverse matters). A data warehousedata warehouseEin zentrales Repository, das Daten aus vielen Quellsystemen in einem strukturierten, abfrageoptimierten Speicher zusammenführt, ausgelegt für Analytics, Reporting und Business Intelligence.Vollständige Definition ansehen → or lakehouselakehouseEine hybride Architektur, die die Flexibilität eines Data Lake mit den analytischen Fähigkeiten eines Data Warehouse auf einer einzigen Storage-Schicht verbindet.Vollständige Definition ansehen → layer built on top of these systems for reporting purposes has to preserve those same access boundaries, not flatten them. This means row-level security tied to matter and client identifiers, replicated faithfully from the source system, not reinvented in the warehouse.

Firms building modern data platforms (a lakehouselakehouseEine hybride Architektur, die die Flexibilität eines Data Lake mit den analytischen Fähigkeiten eines Data Warehouse auf einer einzigen Storage-Schicht verbindet.Vollständige Definition ansehen → pattern combining raw data storage with structured query layers, using tools like Databricks or Snowflake) increasingly want conflicts and AML metadata available for firm-wide risk reporting, without exposing the underlying sensitive detail. The common approach: aggregate to the level of "conflict check completed, risk tier assigned" rather than replicating full name-matching detail into a general reporting layer.

🎬 [VIDEO: "What is Know Your Customer (KYC) and AML?" — youtube.com/results?search_query=what+is+kyc+aml+explained — a short explainer on the core screening concepts that underpin law firm intake tools, useful for non-technical viewers]

Key Takeaways

• Conflicts checks query the firm's own practice management history; AML checks query external, vendor-aggregated sanctions and PEP feeds. They are separate pipelines with separate risk profiles.
• Search logic (fuzzy matching, entity resolution) determines whether name variants and related parties get caught. Exact-match-only search is a known blind spot.
• Data freshness is critical for AML: sanctions lists like OFAC's SDN list update frequently, and a vendor feed synced weekly creates a real exposure window.
• Dirty data in the practice management system (duplicate or inconsistent client records) undermines conflicts checks regardless of how good the search algorithm is.
• Any warehouse or lakehouselakehouseEine hybride Architektur, die die Flexibilität eines Data Lake mit den analytischen Fähigkeiten eines Data Warehouse auf einer einzigen Storage-Schicht verbindet.Vollständige Definition ansehen → layer built over these systems must preserve matter-level access control and ethical walls, typically by reporting on aggregated risk status rather than replicating sensitive match detail.