Sanctions Screening
Sanctions screening is the checking of customers, counterparties and payments against the lists of persons, entities, vessels and countries that governments and the UN have prohibited dealing with — OFAC's, the EU's, the UK's — so a match is stopped, frozen and reported before money moves. It is strict liability in most regimes: a payment to a listed person is a breach whether or not the firm knew.
- Also known as
- Sanctions checks, Watchlist screening, OFAC screening
- Used at
- onboarding (customer and owners), every payment (sender, receiver, banks in the chain, free-text fields), and periodic rescreening of the whole customer base whenever a list changes
- Binding
- yes — sanctions law in every jurisdiction the firm operates in or whose currency it uses (US dollar payments bring OFAC jurisdiction); penalties are administrative and criminal; the 2022 Russia sanctions multiplied the lists and the enforcement
- Typical mechanism
- fuzzy name matching against the lists with a tunable threshold; secondary identifiers (date of birth, nationality, identifiers) to clear false matches; screening of payment messages for listed names, countries and ports; "50% rule" logic for entities owned by listed persons; real-time holds on matches
- Typical volumes
- a payments firm sees name matches on 0.5–2% of transactions, almost all false; a true match is rare and must be acted on the same day
- Parties
- the firm's compliance and screening teams, the list providers and screening vendors, the sanctions authorities (OFAC, the EU, the UK's OFSI), and the correspondent banks that will end a relationship after a miss
How sanctions screening works in practice
A remittance fintech receives an instruction: €2,000 from a customer to a beneficiary abroad. Before the payment is released, the screening engine checks the beneficiary's name, the bank, the country and the payment reference against the consolidated lists, with fuzzy matching to catch transliterations and misspellings. No match: the payment goes. A partial match — the beneficiary shares a surname and a first initial with a listed person — puts the payment on hold; an analyst compares date of birth, nationality and address, clears the match in minutes, and the payment goes with a delay the customer notices. A true match — the beneficiary is the listed person — freezes the funds, blocks the account, and produces a report to the sanctions authority within the required days; the customer is not told why.
The engineering is in the threshold and the lists. Too loose a match and analysts drown in false positives; too tight and a transliterated name gets through. Lists change daily — the Russia designations of 2022 added thousands of names in weeks — and a firm screening against last week's list is exposed for every day between. The 50% rule (an entity majority-owned by listed persons is itself sanctioned, whether or not it is listed) means screening the ownership, not just the name.
For fintechs the exposure is existential rather than financial: a correspondent bank that learns of a sanctions miss ends the relationship, and without it there are no cross-border payments to screen.
Example
A payments fintech processes 3 million transactions a year. Its screening: real-time against UN, EU, UK and OFAC lists refreshed every four hours; fuzzy matching tuned to a 1.1% alert rate — 33,000 alerts a year, cleared by a team of six at a median of 40 minutes; 11 true matches in the year, all frozen and reported; ownership screening on all corporate beneficiaries. An inspection tests the engine with 200 synthetic names including transliterations and finds 197 caught. A competitor screening only sender names, with lists refreshed weekly, misses a €40,000 payment to a company 60%-owned by a person listed nine days earlier; its correspondent bank gives notice, its dollar corridor closes, and it is sold six months later for a fraction of its last round.
Common mistakes
- Screening customers at onboarding and payments never, or senders and not beneficiaries. - Lists refreshed on a schedule that leaves days of exposure after each designation. - Fuzzy matching that catches "Ivanov" and not "Ivanoff". - Ignoring ownership — the 50% rule — because the entity's own name is clean. - Clearing matches on name similarity alone, without secondary identifiers, because the queue is long.