# Watchlist Module

<WebSDK2 />

The Watchlist module runs a backend sanctions / PEP / global watchlist screening on the user's identity data already collected in the session. Fire-and-forget — completes regardless of API outcome.

> Follows the [backend-process pattern](doc:web-sdk-2-module-patterns#3-backend-process-modules). See the patterns page for the shared lifecycle.

## Availability

This module is headless-only — there is no public `<incode-watchlist>` web component. Drive it with `createWatchlistManager` from `@incodetech/core/watchlist`. It's typically invoked from an orchestrated flow rather than mounted standalone.

## Configuration

The module takes no configuration:

```typescript
type WatchlistConfig = Record<string, never>;
```

The watchlist sources (OFAC, PEP, etc.) and threshold rules are configured in the Incode Dashboard, not on the client.

## State machine

`WatchlistState` is a discriminated union over `status`:

| Status       | Description                              |
| ------------ | ---------------------------------------- |
| `idle`       | Initial state.                           |
| `processing` | Backend screening in progress.           |
| `success`    | Screening completed; data is on `state`. |
| `finished`   | Terminal.                                |

## Related modules

* **Custom Watchlist** ([Module-Custom-Watchlist](doc:web-sdk-2-module-custom-watchlist)) — checks the user's face against a customer-provided blocklist.
* **Watchlist for Business** ([Module-Watchlist-For-Business](doc:web-sdk-2-module-watchlist-for-business)) — collects business name + country and screens against the business watchlist endpoint. Form-based, not pure backend-process.

## See also

* [Module Patterns → backend-process](doc:web-sdk-2-module-patterns#3-backend-process-modules)
* [Individual Modules](doc:web-sdk-2-individual-modules)