Umbragarde Confidential enquiry
Home/Intelligence Alerts
Ongoing monitoring

Know when something changes — before it becomes a problem.

Intelligence alerts combine structured data monitoring with OSINT to deliver actionable notifications on the subjects that matter: new sanctions designations, court filings, corporate changes, adverse media and open-source signals — delivered when they are triggered, not on a reporting schedule.

Event-drivenAlerts triggered by material developments, not fixed schedules.
OSINT-augmentedCovers developments not yet captured in structured databases.
ActionableEach alert sourced, contextualised and assessed for materiality.
The discipline

Ongoing intelligence is not the same as periodic screening.

Automated compliance screening works on a schedule: run your customer list against the current sanctions and PEP databases, log the results, repeat. It tells you what the database contains at the moment of the run. What it does not tell you is what has changed about a specific subject — the development that happened yesterday, the court filing that was processed this morning, the local-language news article that will not reach an English-language aggregator for three weeks.

Intelligence alert monitoring fills the gap between the automated platform and the next periodic review. For subjects who warrant it — counterparties in active litigation, co-investors in significant transactions, clients with complex political or legal exposure — ongoing intelligence monitoring means you know material developments as they occur, not when they surface in a quarterly screening cycle.

What intelligence alerts monitor

The monitoring scope is configured per subject based on risk profile and the specific concerns the client wants tracked. Standard monitoring categories include:

  • Sanctions and designations — additions to or removals from OFAC, OFSI, EU, UN and other applicable lists; changes in designation status for related parties and entities
  • Court and legal proceedings — new filings, judgments, enforcement actions, freezing orders, insolvency proceedings and regulatory actions in relevant jurisdictions
  • Corporate registry changes — new directorships, shareholder changes, dissolution, restructuring, new connected entities, changes to registered address or agent
  • Adverse media — new coverage across global and local-language sources, with particular attention to sources not included in standard monitoring platforms
  • Open-source signals — OSINT indicators of change in status, activity, location or associations not captured in structured databases
  • Asset and property changes — significant property transactions, new registered assets, changes in observable asset holdings

The difference between monitoring and screening

Automated screening platforms — ComplyAdvantage, World-Check, Dow Jones Risk & Compliance and their peers — are designed for throughput: matching large customer populations against large structured databases at high speed. They are excellent at what they do. What they are not designed to do is conduct ongoing, source-diversified intelligence monitoring of a specific high-risk subject.

The distinction matters for three reasons:

  • Structured data lag — a sanctions designation appears in the OFAC SDN list immediately; it takes time to propagate through commercial databases. A court filing is public from the day it is issued; a monitoring platform may not surface it for weeks. OSINT-based monitoring captures developments at source, before aggregation.
  • Source coverage — standard platforms cover English-language, globally-distributed media. Adverse coverage in a regional Ukrainian newspaper, a Russian legal gazette, or a Kazakh commercial registry is not monitored by any standard compliance platform. It is the kind of material that matters most in high-risk mandates.
  • Context and interpretation — a monitoring platform produces alerts. Intelligence monitoring produces assessments: what the development means, whether it is material, what the client should consider doing about it. The difference between a flag and an answer.

Who benefits from intelligence alert monitoring

Law firms managing complex litigation or arbitration proceedings need to know when counterparties take steps — asset transfers, corporate restructurings, jurisdictional moves — that could affect enforcement prospects. Waiting for the next periodic review is not adequate when the counterparty is active.

Family offices and private investors with significant co-investment relationships or advisory arrangements need ongoing oversight of the individuals and entities in their network. A co-investor's designation, undisclosed litigation or change in political exposure is material to the relationship regardless of when the periodic review was last run.

Corporate compliance teams managing high-risk supplier or customer relationships that require enhanced ongoing monitoring beyond the standard automated platform.

Financial institutions with high-risk clients who require enhanced ongoing due diligence under MLR 2017 or equivalent regulation — where the periodic review cycle is insufficient for the risk level and relationship complexity.

How Umbragarde delivers intelligence alerts

Monitoring is established per subject list, with scope and alert thresholds agreed at the outset. Each alert is delivered as a brief written report: the triggering development, the source, the relevant context, and our assessment of whether it is material to the client's specific relationship with the subject.

Alerts are delivered as triggered — not on a weekly or monthly schedule — because material developments do not arrive on schedule. For subjects with complex risk profiles, monitoring is reviewed on a standing basis, with a periodic summary provided even when no individual alerts are triggered.

Monitoring programmes are scoped and priced individually. There is no minimum subject count and no long-term commitment: monitoring can be established for a single subject for the duration of a specific transaction or proceeding, or maintained on an ongoing basis for a standing subject list.

Common questions

Intelligence alerts, answered.

What are intelligence alerts?

Intelligence alerts are notifications triggered by material developments affecting a subject under monitoring — new sanctions designations, court filings, corporate changes, adverse media, and OSINT signals. They are delivered as they occur, with sourcing and context, not on a fixed reporting schedule.

What triggers an alert?

Any material development within the agreed monitoring scope: sanctions list additions or removals, new legal proceedings, corporate registry changes, significant adverse media, and open-source signals indicating change in status or activity. Alert thresholds are agreed per subject based on the client's risk tolerance and relationship type.

How is this different from automated screening?

Automated screening runs a customer list against a structured database on a schedule. Intelligence monitoring tracks a specific subject across structured data, local-language media, court records and OSINT sources — and delivers an assessed alert when something material changes, before it appears in a standard database.

Can monitoring be set up for a single subject?

Yes. Monitoring is available per subject, with no minimum list size. It is frequently established for the duration of a specific transaction, litigation proceeding, or business relationship — and discontinued when the matter is resolved.

Related

Intelligence alerts in context.

Need ongoing monitoring for a high-risk subject or relationship?

One confidential message is enough. We take it from there.

Make a confidential enquiry