A sanctions screening alert does not always mean that someone is on a sanctions list. Sometimes, a customer simply has the same name as a sanctioned person. Other times, the match is real, and the business must take action.
The difficult part is knowing which one you’re dealing with. You cannot reject every customer whose name triggers an alert, but you also cannot ignore a potential match. So, how do you check the details, rule out false positives, and decide what to do when a match is confirmed?
Most sanctions regimes name their targets on a list. Sanctions screening checks a client, its owners and the people who control it against those official lists. Its purpose is to stop dealings that sanctions forbid, and to freeze what you hold for blocked people.
Teams also call it watchlist screening or name screening. Sanctions list screening starts with the lists that bind you. They depend on where your firm is incorporated and where it does business.
|
Where you are incorporated or do business |
List to screen against, and who keeps it |
|---|---|
|
United States |
The Specially Designated Nationals (SDN) List and the other sanctions lists of Treasury’s Office of Foreign Assets Control (OFAC) |
|
European Union |
The European Commission’s consolidated list of EU financial sanctions |
|
France |
DG Trésor’s national asset freeze list (registre national des gels), with EU, UN and national freezes |
|
United Kingdom |
The UK Sanctions List of the Foreign, Commonwealth and Development Office, the only source of UK designations since 28 January 2026 |
|
Any UN member state |
The UN Security Council Consolidated List, kept by its sanctions committees |
Sanctions screening regulations cover more people than the client. Under OFAC rules, a company is blocked if one or more blocked persons own 50 percent or more of it. Direct and indirect stakes count, and they are added together.
That holds even if the company itself is not on any list (OFAC 50 Percent Rule guidance). This is why a company’s beneficial owners need screening too, and why smaller stakes held by listed people still matter.
From 10 July 2027, EU firms covered by the AML rules must check whether sanctioned people control a company client. They must also check whether those people own more than half of it, alone or together (Regulation (EU) 2024/1624).
In the US, OFAC’s rules bind all US persons, not only banks (OFAC FAQ 11). There is no single list of OFAC screening requirements, so each business sets its own risk-based checks (OFAC framework).
Sanctions lists can change at any time, so a check you completed yesterday may not be enough today. OFAC, for example, has no fixed schedule for updates to its SDN List. Names can be added or removed whenever necessary (OFAC FAQ 20).
Some changes also require immediate action. For UN terrorism and proliferation sanctions, FATF standards call for assets to be frozen without delay, ideally within hours of a new listing (FATF Glossary).
In the EU, the anti-money laundering authority (AMLA) has drafted new customer due diligence standards. It sent the final draft to the European Commission in a report dated 30 September 2026. The Commission has not adopted them yet.
Under draft Article 25, businesses would need to screen customers when they first become customers, whenever sanctions lists change, and when important customer details change, such as a name or nationality. They would also need to repeat these checks regularly, based on the customer’s risk level.
At onboarding, the sanctions check is one step in the KYC process, before the risk rating.
Each alert needs a reason in the file, even a false positive. OFAC’s guidance splits the work after an alert into six steps (OFAC FAQ 5, updated 9 September 2026). The first five end in a decision, and the sixth covers reports and records.
These steps need trained reviewers, and their training is part of a sanctions and AML compliance program.
The first question is whose list the name sits on. OFAC screening covers OFAC’s lists, but many tools also check other agencies’ lists, such as the Commerce Department’s Entity List. For those hits, ask the agency that keeps the list, because OFAC gives no guidance on them.
Some alerts point to a sanctioned country, a government or an unlisted blocked company rather than a listed name. Consider escalating those before acting, because OFAC rules may still prohibit the transaction or require blocking (OFAC FAQ 5).
US banks have a second list rule. The list check in a bank’s customer identification program is separate from OFAC sanctions screening. As of June 2026, Treasury had not designated any list for this purpose.
Compare the whole list entry with everything you know about the client, not only the name. Entries can include aliases, nationality, ID numbers, date of birth, addresses and names in non-Latin script. An address match alone may not be enough, because several businesses can share one.
A hit on a famous listed person can be ruled out when public photos plainly differ from your client’s ID. If you can reasonably decide the match is not valid, you may proceed (OFAC FAQ 5).
For EU payment providers (banks included) and crypto firms, names should be screened in the original alphabet, transliterated, or both. Fuzzy matching should catch close spellings. Record how it is set and why (European Banking Authority, EBA/GL/2024/15).
These firms may also whitelist a client who keeps triggering false alerts (EBA/GL/2024/15). They should document why, and review the list as soon as sanctions or the client’s details change.
When several identifiers match and nothing rules the person out, treat the alert as a likely match.
Follow your procedures for likely matches, then check whether a general or specific license, or an exemption, applies. If none does, decide whether the property must be blocked or the transaction rejected (OFAC FAQ 5). OFAC may weigh an effective sanctions compliance program when it decides on a penalty (OFAC framework; Enforcement Guidelines, General Factor E).
The EBA guidelines add one step for EU payment providers, banks included, and crypto firms. If a match stays unclear after extra checks, these firms should not serve that party to a transfer before an informed decision (EBA/GL/2024/15).
If your screening runs in another tool, Clustdoc can build the review steps around it and keep each reviewer’s conclusion on record.
A confirmed match brings reporting deadlines. Blocked property is frozen, not seized, and reported to OFAC within 10 business days from the date it becomes blocked. A prohibited transaction that is not blocked is rejected and reported within 10 business days of the rejection (31 CFR 501.603 and 501.604).
Transaction records must be kept for at least 10 years after each transaction (31 CFR 501.601, in force since 12 March 2025). For blocked property, the 10 years start when it is unblocked. Keep your notes on how you checked the match too, because OFAC may ask for them (OFAC FAQ 5).
EU financial sanctions freeze the funds of listed people and companies, and forbid making funds available to them. The regime on threats to Ukraine’s territorial integrity is one example (Regulation (EU) No 269/2014, Article 2). Under that regime, firms report frozen funds to their national authority immediately, and within two weeks at the latest (Article 8).
In France, individuals and companies must apply asset freezes without delay and inform the Minister of the Economy immediately (Code monétaire et financier, Article L562-4). This covers freezes decided by the UN, the EU or France itself, as DG Trésor’s list page notes.
Sanctions and PEP checks often run together in a firm’s AML screening. Each kind of match leads to a different response.
A confirmed sanctions match is usually a legal stop. You cannot deal with the person, and anything you hold for them is frozen.
A politically exposed person (PEP) is someone who holds or has held a prominent public role. A PEP match means more checks, not an automatic refusal (FATF PEP guidance, paragraph 2).
Adverse media works differently again. A credible news report can raise the risk, and a reviewer judges how much.
Our KYC onboarding software includes AML screening for sanctions, PEP and adverse media.
Book a demo call and walk us through the last alert your team cleared. We will show how that review could run, step by step, in Clustdoc.
OFAC screening checks clients, their owners and other parties against the SDN List and OFAC's other sanctions lists. Names can be checked by hand or with software (OFAC FAQ 23). Each business builds its own screening into a risk-based sanctions compliance program, as OFAC recommends.
Screen at onboarding, when a list changes, when a client's details change and on a regular cycle set by risk. OFAC sets no timetable for list updates, and for UN terrorism and proliferation listings, the FATF expects freezes within hours where possible. AMLA's draft EU standards list the same four moments, but they are not adopted yet.
A false positive is an alert on a name that turns out to belong to a different person or company. You clear it by comparing details such as date of birth, nationality and ID numbers with the list entry. Keep a record of what you checked and why you cleared it (OFAC FAQ 5).
In practice, yes. OFAC sanctions bind all US persons, whatever their business, and EU restrictive measures bind anyone under EU jurisdiction. Many firms screen new clients and their owners to check that they are not dealing with a listed person.
Still stitching emails, files, and approvals together?
Clustdoc gives teams one place to run client-facing work, boost customer engagement and increase compliance.
Claire writes about customer onboarding, digital processes, and the day-to-day challenges faced by operations teams. At Clustdoc, she focuses on practical insights: how organizations collect information, guide customers through complex steps, and improve service delivery with automation.
