# Watchlist Module Guide

This guide is specific to Web SDK 2.0. If you are still using 1.x, you can find documentation [here](https://developer.incode.com/docs/web-sdk-reference). Contact your Incode Representative for upgrade information and check if you are a candidate for this upgrade.

Full rollout to all clients still TBD.

The Watchlist module runs a backend sanctions / PEP / global watchlist screening on the user's identity data already collected in the session. Fire-and-forget — completes regardless of API outcome.

Follows the [backend-process pattern](https://developer.incode.com/docs/web-sdk-2-module-patterns#3-backend-process-modules). See the patterns page for the shared lifecycle.

## Availability

This module is headless-only — there is no public `<incode-watchlist>` web component. Drive it with `createWatchlistManager` from `@incodetech/core/watchlist`. It's typically invoked from an orchestrated flow rather than mounted standalone.

## Configuration

The module takes no configuration:

```typescript
type WatchlistConfig = Record<string, never>;
```

The watchlist sources (OFAC, PEP, etc.) and threshold rules are configured in the Incode Dashboard, not on the client.

## State Machine

`WatchlistState` is a discriminated union over `status`:

| Status    | Description                                       |
|-----------|---------------------------------------------------|
| `idle`    | Initial state.                                   |
| `processing` | Backend screening in progress.                    |
| `success` | Screening completed; data is on `state`.        |
| `finished` | Terminal.                                        |

## Related Modules

- **Custom Watchlist** ( [Module-Custom-Watchlist](https://developer.incode.com/docs/web-sdk-2-module-custom-watchlist)) — checks the user's face against a customer-provided blocklist.
- **Watchlist for Business** ( [Module-Watchlist-For-Business](https://developer.incode.com/docs/web-sdk-2-module-watchlist-for-business)) — collects business name + country and screens against the business watchlist endpoint. Form-based, not pure backend-process.