Sanctions Screening Best Practice: What Financial Institutions Get Wrong

Sanctioned individuals and entities are frequently listed under variant name spellings, transliterations from Arabic, Russian, Chinese, or Persian scripts, and a range of aliases. A screening programme that performs only exact-match comparisons will miss these variants. Fuzzy matching — using algorithms such as phonetic matching, edit-distance scoring, or n-gram comparison — is required to catch them.

The challenge with fuzzy matching is calibration. Too aggressive, and the programme generates alerts for common names with superficial similarity to sanctions list entries. Too conservative, and genuine matches are missed. Most compliance teams set fuzzy matching thresholds based on initial configuration, then never revisit them as the customer base, transaction volumes, or list contents evolve. Regular back-testing —comparing the screening output against manually validated ground truth — is necessary to maintain calibration over time.

A fundamental limitation of name-based screening is that it identifies directly sanctioned individuals and entities but may miss beneficial ownership exposure. OFAC's 50% rule states that any entity owned 50% or more (directly or indirectly) by a sanctioned party is itself treated as sanctioned, even if not explicitly listed. This means that a screening programme limited to direct name matching will systematically miss sanctioned beneficial owners who operate through legal structures.

Addressing this requires either manual investigation of entity ownership chains for higher-risk customers, or deployment of an entity resolution tool that enriches customer data with beneficial ownership information from registry and commercial data sources. For financial institutions with large corporate customer portfolios, manual investigation at scale is not feasible — technology-assisted UBO screening is the only practical approach.

A sanctions match — or a potential match requiring investigation — requires a defined escalation and response process. The process must be documented, staff must be trained to follow it consistently, and all decisions (including decisions to clear a false positive) must be recorded with the rationale. OFAC, OFSI, and DFAT all emphasise that the ability to demonstrate a documented, consistent investigation process is a key factor in penalty determinations.

Record keeping requirements vary by jurisdiction but typically require that all screening results, alert investigations, and escalation decisions be retained for a defined period (five years is common). These records must be accessible to regulators on demand and must be stored in a format that preserves the evidentiary chain — including the list version screened against, the match score, the analyst's investigation notes, and the outcome.

The applicable lists depend on the institution's jurisdictional footprint and the currencies and counterparties it deals with. As a baseline, institutions should screen against OFAC's SDN list (for USD transactions), the UN Consolidated List, the EU consolidated list (for EUR transactions and EU-nexus activity), and DFAT's list (for Australian entities). UK OFSI and additional bilateral lists may also apply. Regulatory guidance from your primary regulator should be the definitive source.

Best practice is to update lists as soon as they are published by the relevant authority, using automated list ingestion rather than manual download. Sanctions designations can occur without warning in response to geopolitical events; daily updates are a minimum for most institutions, with real-time or near-real-time ingestion increasingly expected for higher-risk business lines.

OFAC's 50% rule states that any entity owned 50% or more, directly or indirectly, by one or more SDN-listed parties is itself treated as an SDN, regardless of whether it appears on the list. This means that name-based screening alone is insufficient to identify all OFAC exposure — institutions must also assess beneficial ownership chains for corporate customers.

A potential match should trigger a defined escalation process: the alert is reviewed by a qualified analyst, supporting information is gathered (public records, customer information), a match determination is made, and the outcome is recorded with the rationale. If a genuine match is confirmed, the institution must block or reject the transaction as required and, in many jurisdictions, file a blocking or rejection report with the relevant authority.

False positive reduction requires careful calibration of fuzzy matching thresholds, transliteration settings, and alias coverage. Institutions should conduct periodic back-testing to compare screening outputs against validated results, and adjust configuration where false positive rates are high without reducing sensitivity to genuine matches. Segmenting the customer base and applying different matching parameters by risk tier is a common approach for managing volume while maintaining accuracy.

A defensible sanctions screening programme is not one that simply runs a screening tool — it is one where coverage is complete, lists are current, matching is accurately calibrated, and every decision is documented. As sanctions regimes become more complex and enforcement agencies more active, the quality of an institution's sanctions screening is increasingly a direct indicator of its broader compliance culture.