The short answer
A held transfer is almost never a judgement about you. It is a rule firing. Every institution that touches a cross-border payment screens it against sanctions lists and behavioural rules, and both systems are deliberately tuned to produce false positives — because the cost of missing a real hit is a regulatory penalty, and the cost of a false one is an annoyed customer.
The reason nobody will tell you why is usually legal rather than evasive. In most jurisdictions, telling a customer that their payment triggered a suspicion report is itself an offence. The silence is a legal constraint, not customer service failure.
The two systems that stop payments
They are frequently confused, and they behave completely differently.
Sanctions screening is a name-matching check that runs on every single payment, in real time, before it moves. It compares the sender, the beneficiary, the banks involved, and often the free-text reference against consolidated lists of sanctioned individuals, entities, vessels and jurisdictions. A hit blocks the payment immediately.
Transaction monitoring is a behavioural check that runs on patterns, usually after the fact. It asks whether this payment is consistent with what this customer normally does. It generates alerts for human review rather than instant blocks, though a high-scoring alert can freeze an account.
Sanctions screening is a legal absolute — there is no risk appetite, no threshold and no commercial discretion. Monitoring is a risk model, and every institution tunes it differently. That is why the same payment can sail through one provider and stall at another.
Why sanctions screening produces so many false hits
The lists contain names transliterated from Arabic, Cyrillic, Persian and Chinese into Latin script, often with multiple accepted spellings and frequently without reliable dates of birth. Matching is therefore fuzzy — the engine scores similarity rather than demanding an exact string match, because an exact match would be trivially defeated by changing one letter.
The consequence is that ordinary people with common names collide with listed ones constantly. A name that shares a root with a sanctioned individual will generate an alert every time, at every institution in the chain, for the rest of that person’s life.
Free-text fields make it worse. Screening runs on the payment reference too. A reference mentioning a sanctioned country, a dual-use good, or in some systems merely a city name, will alert — even in a completely innocent context. “Payment for Havana Club rum” and “invoice re Cuba trip” are both capable of stopping a payment stone dead.
The chain multiplies this. A payment crossing four institutions is screened four times against four list configurations with four thresholds. Clearing your own bank’s check does not clear the correspondent’s.
What monitoring is actually looking for
Monitoring models are proprietary, but the patterns they are built around are well documented in regulatory guidance:
- Structuring — several payments just below a reporting threshold, where one larger payment would have been natural.
- Sudden change in profile — an account that has moved €300 a month for two years suddenly moving €14,000.
- Pass-through behaviour — money arriving and leaving quickly, especially to a different party, which is what a mule account looks like.
- Corridor and counterparty risk — jurisdictions with weak controls, or counterparties in sectors the institution has classified as high risk.
- Inconsistency with stated purpose — the “source of funds” and “purpose of payment” you gave at onboarding not matching what the account does.
Every one of these has an entirely ordinary explanation available. Selling a car, receiving an inheritance, paying a deposit on a flat, or sending unusually large support to family after a crisis will each trip a rule. The model cannot tell the difference. A human is supposed to.
Why “we cannot tell you”
If an institution files a suspicious activity report, disclosing that fact to the customer is prohibited in most jurisdictions — commonly called tipping off. The prohibition covers the report itself, and staff are trained to avoid anything that would reveal one exists, which in practice means front-line staff are trained to say very little about holds in general.
You can usually distinguish the situations by the shape of the answer:
- A sanctions hit normally produces a specific, answerable request — confirm your date of birth, confirm the beneficiary’s full legal name, clarify the reference. Staff can discuss it because a name collision is not a suspicion.
- A monitoring alert produces vague requests — proof of source of funds, purpose of payment — and evasive answers about timing.
- A report having been filed produces near-total silence and no timeline.
What actually helps
Send documents before you send the money. If you know a large transfer is coming — a property deposit, a vehicle sale, an inheritance distribution — call your bank first and ask what evidence they will want. Pre-clearing a payment is routine and it converts a week-long hold into nothing.
Write dull, accurate references. The reference should say what the payment is for in plain terms. Do not include country names, political commentary, jokes, or anything you would not want a screening engine to read literally. “Invoice 2026-114” is a good reference. Anything witty is a liability.
Give full legal names exactly as they appear on the document. Abbreviations and missing middle names widen fuzzy matching and make collisions more likely, not less. If your name genuinely resembles a listed one, expect repeat friction and ask your bank whether they can record a documented clearance to reduce re-alerting.
Keep the paper. Sale contracts, probate letters, invoices, loan agreements. If you can answer “where did this come from” with a document the same day, most holds resolve in a day. Without one, the burden sits with you and the clock runs.
Escalate through the formal complaint route, not the branch. Front-line staff often genuinely do not know and cannot find out. A written complaint enters a process with regulatory deadlines attached, which is a different mechanism from asking again more loudly. If the complaint is not resolved, most European jurisdictions have a financial ombudsman that handles this at no cost.
Do not resend the payment. Sending it again through another provider while the first is under review is itself a monitoring pattern — it looks like avoidance, and it can escalate a mild alert into a serious one. Wait, or withdraw the first instruction properly.
The uncomfortable part
There is no right of appeal against a bank deciding it no longer wants your business. De-risking — closing accounts belonging to whole categories of customer because monitoring them is expensive relative to their value — is a documented, widely criticised practice that disproportionately affects money service businesses, charities operating in conflict zones, and people with connections to high-risk jurisdictions.
If your account is closed rather than a payment held, you are usually entitled to notice and to move your money, but not to an explanation. The practical defence is redundancy: do not keep your only banking relationship at a single institution, particularly if your profile is one that models find interesting.
Related reading: how a cross-border transfer actually moves explains why so many institutions get to screen a single payment, and how to check an app is a licensed AISP covers verifying who you are dealing with in the first place.