Between 28 September and 2 October 2026, the Office of Foreign Assets Control (OFAC) published six separate notices. They included new designations under counter narcotics, counter terrorism, Iran-related and non-proliferation programmes; the designation of the A7 Network as a transnational criminal organisation; removals under the Belarus, counter narcotics and Libya programmes; amended Venezuela general licences; and regulatory amendments that reorganised OFAC's regulations and changed the Cuba sanctions rules. Another notice on 5 October brought further removals and entry updates.
For a screening team, that week was not one event repeated six times. Each notice type asks for a different control response, and a programme that treats every list change as ‘new names added’ will handle some of them badly. This article sets out a governance model for list updates: what to do with each type of change, how quickly, and what evidence to keep.
Why list-update governance is its own control
Most screening discussions focus on match quality and false positives. Those matter, but they assume the right list version is already in the system. List-update governance covers the step before matching: how quickly a published change reaches your screening data, whether existing customers and counterparties are rescreened against it, and whether you can later prove both happened.
High-volume weeks expose the gaps. When several regimes publish changes close together, ingestion delays stack up, rescreening jobs compete for capacity, and reviewers face a surge of potential matches at the same time as routine work.
Matching the response to the type of change
| Type of change | Example from the week | Control response | Evidence to keep |
|---|---|---|---|
| New designation | Counter narcotics, counter terrorism and Iran-related designations on 29 and 30 September; the A7 Network on 1 October | Ingest promptly; rescreen the existing customer and counterparty base against the new entries; screen pending payments | Publication time, ingestion time, rescreen run identifier, matches generated and their dispositions |
| Update to an existing entry | Entry changes accompanying the 29 September and 5 October notices | Rescreen against the changed fields, because new aliases, identifiers or addresses can create matches against an unchanged name | List version before and after; which fields changed; rescreen results |
| Removal | Belarus, counter narcotics and Libya removals on 30 September; further removals on 5 October | Update the list; review open alerts and holds tied to removed entries; confirm whether any other regime still lists the party | Decision record linking the closure of each alert or hold to the removal and to checks against other regimes |
| General licence issued or amended | Amended Venezuela general licences on 28 September | Assess whether held or rejected activity is now authorised; update decision guidance for reviewers | Licence reference cited in each decision that relies on it |
| Regulatory amendment | Reorganisation of OFAC's regulations and new Cuba sanctions rules, effective on Federal Register publication on 30 September | Legal and policy review; update procedures, risk assessments and any rule-based screening logic | Policy change record and approval |
The digital asset dimension is growing as well. Some of the entries added on 30 September include digital currency addresses. Organisations with digital asset exposure need list ingestion that carries those identifiers through to wallet screening, not only to name screening.
Setting service levels for ingestion and rescreening
A list-update standard should define three times and measure each one.
- Publication to ingestion. How long after a regime publishes a change does it reach your screening data? If you rely on a data provider, this includes the provider's processing time, so agree and monitor it contractually.
- Ingestion to rescreen. How long after ingestion is the existing book rescreened against the change? Delta rescreening, which checks the whole base only against what changed, is usually faster than a full rerun and easier to evidence.
- Alert to disposition. How long do potential matches generated by a list change take to resolve? Surges after large designations are predictable and can be resourced.
Set targets by risk. A designation affecting a corridor where you have heavy exposure warrants a faster response than a removal under a programme with no link to your customers.
Handling several regimes at once
OFAC is one source among several. The United Nations, the European Union, the United Kingdom and national regimes such as Australia's each publish on their own schedules, and the same party can be added under one regime and removed under another. Three practices help.
- Track the legal source of each obligation. An Australian reporting entity's binding sanctions obligations come from Australian law. OFAC changes may still matter through US dollar exposure, contracts or risk appetite, and the decision record should state which applies.
- Do not close a match because one regime removed the party. Check every regime your programme covers before releasing a hold.
- Keep one change log across regimes so reviewers and auditors can see what changed, where and when.
What auditors will ask for
When a regulator or auditor tests list-update governance, the questions tend to be specific. Which list version screened this customer on this date? How long after publication did the change reach the system? Was the existing book rescreened, and what did that produce? Who decided each resulting alert, and on what basis? A programme that logs publication, ingestion and rescreen times against a list version can answer all four from records rather than recollection.
Our article on sanctions screening best practice covers coverage and matching calibration. List-update governance is the operational layer that keeps both current.
How MemberCheck can help
MemberCheck provides sanctions and PEP screening with match scoring and an audit trail behind every decision, together with ongoing monitoring that rescreens customers as list data changes. Compliance teams can use the matrix above to set service levels and evidence requirements for each type of list change.
Request a demo to see how ongoing monitoring and screening audit trails support list-update governance.
