We checked. Nothing came up.

An audit doesn't ask what your system says today. It asks what it said on the transaction date — sometimes a year or two after the fact, when the person asking has no reason to take your word for it. "We checked, it was clean" is not evidence; it's a memory. Evidence is a timestamped record of what the list actually contained at that moment, one you can produce on demand.

This is where negative results are structurally harder to defend than positive ones. A hit leaves a paper trail — a match, a review, a decision. A clean result leaves nothing behind, by default, unless something was built specifically to preserve it.

Sanctions lists aren't static documents; they're live feeds that change on their own schedule, sometimes with several updates a week across dozens of regimes. A name added last month didn't exist in the list you screened against eighteen months ago — and a name delisted last week is invisible if you only keep the current version. Overwrite the old data with the new sync, and you've destroyed the only record that could show what you actually saw.

That's not a hypothetical edge case; it's the default behaviour of any system that treats a sanctions list as a single table to keep up to date, rather than a history to preserve. Keeping up to date and keeping proof are two different engineering problems, and solving the first doesn't solve the second.

Every source load needs to land as its own dated version, not overwrite the last one. That turns "we checked" from a sentence someone has to trust into a record someone can inspect: which list, which version, what it contained, when it was fetched.

The other half is being able to re-run the same query against a specific past date and get the answer that was true then — delisted records included — not today's answer with today's date stamped on it. "What did we know about this counterparty on 14 March 2025?" has to be an answerable, reproducible question, not a reconstruction exercise.