There's a useful distinction between a compliance exercise and a risk programme. A compliance exercise asks: are we doing what the regulator requires? A risk programme asks: are we catching the things most likely to go wrong? They're related questions, but they lead to different programme designs.

Most screening programmes are built on compliance logic. The structure follows from the regulatory framework. Sanctions screening because the regulator mandates it. Criminal record checks because due diligence requires it. Financial history verification because the fit-and-proper assessment demands it. These requirements are specific, measurable, and auditable. Providers build standard packages around them. Organisations adopt the packages.

The challenge is that regulatory requirements tend to concentrate on a narrow set of risk dimensions, specifically whether a person appears on a particular list or register. They're less prescriptive about verifying the things candidates claim about themselves: their employment history, their qualifications, the shape of their career. That verification layer, when it's included at all, is often treated as an add-on.

What the data shows

Across the Veremark Screening Benchmark 2026 dataset, database checks (sanctions, criminal record, ID verification, financial history, right to work, adverse media, bankruptcy, civil) account for 58% of all screening volume. In Financial Services, the proportion reaches 80%.

Education verification checks flag at 21.1%. Employment verification at 15.3%. CV gap analysis at 51.7%.

The checks that regulators mandate and providers build packages around are the ones that produce findings least often. The checks that catch the most common type of discrepancy, whether a candidate told the truth about their career, occupy a smaller share of most programmes and frequently sit in the optional tier.

"Screening programmes tend to get built around what's auditable. Sanctions checks, criminal records, ID verification. These are important, and regulators expect them. But they don't tell you whether someone actually held the role they claimed or finished the qualification they listed. That's the part that falls into the add-on category, and it's the part that People teams end up dealing with when a hire doesn't work out. The discrepancies we see most often aren't on sanctions lists. They're in career histories." Elaine Ooi, VP of People & Culture, Veremark

How programmes end up this way

It's a consequence of how screening gets procured.

Procurement teams evaluate providers against a requirements list. That list is shaped by regulatory obligations: does the provider cover sanctions? Criminal record? Right to work? Financial history? These are the questions that appear in RFPs and vendor evaluations. The checks that verify career claims (employment dates, academic credentials, career continuity) are harder to mandate because no single regulation requires them in the same specific, auditable way.

Over time, the programme becomes weighted towards the checks the provider includes by default, which are the checks regulations require, which are the checks that flag least often. The programme satisfies compliance. It may not satisfy risk.

External research is consistent with this picture. A 2024 StandOut CV survey found that 64% of applicants had misrepresented themselves on their CV at least once. Altered employment dates (50%), exaggerated responsibilities (32%), and misrepresented employment status (21%) were the most common types. A Resume.org study of 9,133 adults found that 96% of those who intentionally lied said their employer never discovered it. The misrepresentations candidates make most frequently sit in the employment and education layer, precisely the layer that compliance logic deprioritises.

The Financial Services example

Financial Services provides the clearest illustration. It's the largest vertical in the Veremark dataset by check volume and runs one of the deeper programmes at 4.6 checks per hire, rising to 13.1 in Capital Markets sub-sectors. The FCA's fit-and-proper requirements under SM&CR are among the most prescriptive regulatory obligations in the screening landscape.

80% of Financial Services screening volume goes to database checks. The regime mandates them, and programmes are built around them. The 21.1% education discrepancy rate and 15.3% employment discrepancy rate apply to the remaining 20% of volume.

This is a programme well configured for what the FCA explicitly requires. What it's less well configured for is detecting the type of misrepresentation that the external evidence shows is most common: candidates who exaggerate, fabricate, or omit parts of their career history.

The FCA's December 2025 guidance on non-financial misconduct (PS25/23, effective September 2026) is relevant here. It expands what firms must consider in their fitness-and-propriety assessments beyond financial conduct. As the scope of what regulated firms need to screen for widens, the question of whether programme design is keeping pace becomes more pressing.

Closing the gap

The distinction between compliance and risk doesn't require choosing one over the other. Database checks serve a clear purpose. Regulatory requirements exist for good reason. The question is whether the programme's design reflects the full spectrum of risk, or whether compliance logic has become the default without anyone revisiting whether it's sufficient.

Three things worth looking at:

• Map the current check mix by category. What proportion goes to database lookups vs employment and education verification? If the split is 80/20 or steeper, the programme is likely compliance-optimised.
• Ask the provider for discrepancy data by check type. A breakdown of flagged issues over the past 12 months will show where the programme's detection capability actually sits.
• Review what's included as standard vs what's an add-on. If employment and education checks only trigger for certain roles, most hires may be passing through without the checks that flag at 15 to 21%.

The data behind this article comes from the Veremark Screening Benchmark 2026. The full report includes industry screening profiles, discrepancy rates across check types, and a framework for assessing programme depth, detection balance, and regulatory alignment.

{{the-2026-veremark-screening-benchmark="/components"}}