Sanctions Screening: The Complete Guide

Sanctions screening is the process of checking a person, company, or transaction against government-published lists of parties who are legally restricted from doing business — most importantly the OFAC Specially Designated Nationals (SDN) list, the OFAC Consolidated list, and the UN Security Council Consolidated list. If you onboard customers, move money, or work with counterparties anywhere near the US or international financial system, some form of sanctions screening almost certainly applies to you, whether you've built a formal programme around it or not. This guide covers what it is, why it exists, how the matching actually works, and how to build (or buy) a programme that holds up under scrutiny.

Key takeaways

• Sanctions screening checks names against legally binding restriction lists — a true match is a legal fact, not a risk score to weigh up.
• It's required, directly or indirectly, for a far wider set of businesses than banks alone: fintechs, marketplaces, payment processors, exporters, and even small businesses that take international payments.
• Matching relies on fuzzy logic and alias checks, not exact-string search — names get transliterated, misspelled, and abbreviated, so a rigid search misses real hits.
• A defensible compliance programme needs more than a search box: risk assessment, internal controls, testing, and training all matter.
• Most of the common failures are process failures, not technology failures — stale list data, one-off checks with no re-screening, and ignoring aliases.

Is sanctions screening a legal requirement?

In most cases, yes — though the exact obligation depends on your jurisdiction and sector. In the US, the legal basis sits with the Office of Foreign Assets Control (OFAC), which administers sanctions programmes under presidential executive orders and acts of Congress. US persons, and in many cases anyone transacting in US dollars or through the US financial system, are prohibited from dealing with parties on OFAC's lists. OFAC's own guidance, A Framework for OFAC Compliance Commitments, sets out what the agency expects a sanctions compliance programme to contain, and notes that "there is no one-size-fits-all" risk assessment — the right level of screening depends on your size, customer base, and geographic exposure.

Internationally, the Financial Action Task Force (FATF) sets the standard through Recommendation 6, which requires member countries to implement targeted financial sanctions without delay against parties designated under UN Security Council resolutions. You can read FATF's own best-practice paper on this at fatf-gafi.org. Most national regulators then translate that standard into domestic law, which is why sanctions screening shows up as an explicit requirement in banking regulation, payments regulation, and export control law across dozens of countries, not just the US.

Who actually has to run sanctions screening?

The obvious answer is banks and other regulated financial institutions, and that's correct — but it understates how wide the net has grown. Payment processors, money transmitters, crypto exchanges, marketplaces that hold or move funds on behalf of sellers, insurers, and export-facing businesses of almost any size all carry some sanctions exposure. FinCEN's Customer Due Diligence rule (see fincen.gov) requires covered financial institutions to know who they're dealing with well enough to assess this kind of risk, and sanctions screening is the most direct tool for doing that.

Even businesses with no formal AML obligation often screen anyway, because their banking partners, payment processors, or investors require it as a condition of the relationship. A software vendor selling internationally, for instance, doesn't want to discover after the fact that an "enterprise customer" was a shell entity acting for a sanctioned party.

The main types of sanctions screening, briefly

Screening tends to happen at three points: against a customer during onboarding and periodic review, against a transaction as funds move, and against a payment message as it passes through the banking network. Each has a different trigger and a different tolerance for latency — a transaction screen at the point of a wire transfer has to run in milliseconds, while a customer screen at onboarding can afford a few seconds. We cover the differences, and where each fits in a compliance stack, in our dedicated breakdown of the different types of sanctions screening. For most organisations building a programme from scratch, customer screening is the natural starting point, since it's the check that happens before any transaction risk exists at all.

How does sanctions screening actually work?

At its core, screening compares a name (and, where available, supporting details like date of birth or country) against every primary name and every listed alias across the sanctions lists you're checking. A naive exact-string match would miss almost every real hit, because sanctioned parties rarely appear in your system with the exact spelling used on the list. Names get transliterated differently from Arabic, Cyrillic, or Chinese script. People use nicknames, maiden names, or partial names. Company names get abbreviated or reordered.

That's why real screening tools use fuzzy matching — algorithms that score similarity between two strings rather than requiring an exact match — combined with phonetic matching (how similar two names sound) and alias expansion (checking against every known alternate spelling on file for a designated party). The output isn't a binary yes or no; it's a match score, and a well-designed tool groups that score into bands: a clear result, a possible match worth a human look, and a high-confidence match that needs escalation before you proceed.

Getting the sanctions screening threshold right matters more than people expect. Set it too loose and a compliance team drowns in false positives — chasing down every "John Smith" in the customer base against every sanctioned John Smith on the list. Set it too tight and you miss a genuine hit because a middle name was omitted or a surname was transliterated slightly differently from the listed spelling. Most mature programmes tune thresholds by list and by risk tier rather than using one setting for every check.

The gap between manual and automated sanctions screening shows up most clearly once volume grows past a handful of names a week:

A realistic scenario

Picture a mid-sized payments fintech onboarding a new merchant — an online electronics retailer applying to accept card payments through the platform. The onboarding form captures the usual details: company name, registered address, and the name of the beneficial owner listed on the incorporation documents. An automated screen runs against the OFAC SDN list, the OFAC Consolidated list, and the UN Security Council list the moment the form is submitted.

The company name comes back clear. The beneficial owner's name, however, returns a possible match against an entry on the OFAC Consolidated list — a similar name, listed under a sectoral sanctions programme tied to a different country's oil sector. The compliance analyst pulls up the listed entry: different date of birth, different nationality, and the listed individual has no plausible connection to a consumer electronics business. The analyst documents the review, notes the distinguishing details, and clears the hit as a false positive within minutes — instead of days spent chasing the same question manually across three separate government websites, or worse, missing the alias entirely because the search only checked the exact legal name on file.

That's the practical value of automated screening: not that it replaces judgment, but that it surfaces the right question quickly enough for a human to answer it properly.

What does a proper sanctions screening compliance programme look like?

Running searches is only one part of a sanctions compliance programme. OFAC's own framework describes five components that regulators expect to see, whatever the size of the organisation: management commitment, a documented risk assessment, internal controls, testing and auditing, and training. Screening itself sits inside "internal controls" — it's the mechanism, not the whole programme.

• Management commitment — senior leadership reviews and signs off the programme, not just the compliance team.
• Risk assessment — a documented, periodically updated view of where the organisation's sanctions exposure actually sits: which customers, which countries, which products.
• Internal controls — the actual procedures, including what lists get screened, what thresholds are used, and who escalates a possible match.
• Testing and auditing — independent checks that the controls work as designed, not just that they exist on paper.
• Training — staff who understand why the checks matter and what to do when a screen returns a hit.

A tool that produces a timestamped, list-versioned audit certificate for every screen — the kind you'd want to hand a regulator or an auditor without having to reconstruct the history afterwards — makes the "testing and auditing" component far easier to satisfy in practice.

Common pitfalls in sanctions screening

• Screening only the SDN list. Many teams treat "OFAC check" and "SDN list check" as synonyms and miss the Consolidated list and UN Security Council list entirely — see our full walkthrough of a proper OFAC check for what a complete sanctions screening check actually covers.
• Treating screening as a one-time event. A customer who's clear at onboarding can be designated the following month. Without ongoing monitoring, that gap only surfaces at your next manual review, if there is one.
• Ignoring aliases. Sanctioned entities are listed with every known alternate name and spelling for a reason. Searching only the exact legal name on a form defeats much of the point of the list.
• Poor threshold calibration. Sloppy tuning either drowns analysts in sanctions screening false positives or sets the bar so high that real hits slip through unnoticed.
• No documented decision trail. Clearing a possible match without recording why leaves nothing to show an auditor, and nothing to learn from the next time a similar name comes up.
• Using stale list data. Lists change; a screening tool or in-house script that isn't pulling fresh data on a defined schedule is checking against yesterday's world.

As one AML lead at a mid-sized payments firm put it when describing a failed internal audit: the tooling wasn't the problem — the team had a perfectly good matching engine — the problem was that nobody had re-screened a batch of long-standing merchant accounts in over a year, so a designation from eight months earlier sat undetected until the audit found it.

Do small businesses need sanctions screening too?

Often, yes, even without a direct regulatory mandate. Any business taking international payments, working with overseas suppliers, or onboarding merchants and vendors carries some sanctions exposure, and banking partners increasingly push that obligation down the chain by requiring evidence of screening as a condition of holding an account. The good news is that the barrier to entry has dropped: free ad-hoc screening tools mean a small business can screen a name against the OFAC and UN lists for free without buying enterprise compliance software, and only needs to pay for automation, batch checks, or ongoing monitoring once volume actually justifies it.

Should you build sanctions screening in-house or buy it?

Building your own screener is possible — the underlying list data from OFAC and the UN is public — but the work that actually matters is rarely the download step. It's building and maintaining fuzzy and phonetic matching that performs well across scripts and transliterations, keeping list refreshes reliable and auditable, tuning thresholds so analysts aren't drowning in noise, and producing a defensible audit trail for every check. Most teams underestimate that ongoing maintenance cost until they've lived with a brittle in-house script through its first list-format change.

Buying a purpose-built tool or API trades that maintenance burden for a subscription, and gets you match-scoring, alias handling, and audit certificates out of the box. If your team is technical and wants to wire screening directly into an existing onboarding flow, our developer guide to the sanctions screening API covers integration in detail, and the pricing page lays out what's free versus what needs a paid plan as volume grows.

Sanctions screening isn't a box to tick once at onboarding — it's an ongoing discipline built on decent list coverage, sensible fuzzy matching, and a paper trail you can stand behind later. Start simple if you need to: run a free screen right now to see what a properly scored result looks like, then build the rest of the programme around it as your volume grows.