There is no regulation that says you must scan the CONS list. It is a risk based decision. The regulation only specifies what the penalties are for conducting business with a party subject to certain sanctions lists.
_________________________
CRCM, CAMS