Sanctions Screening: OFAC, EU, and UN Lists and the Dynamic Risk Layer

Sanctions screening is distinct from most compliance requirements in one critical way: it is strict liability. In most regulatory frameworks, knowledge or intent is a factor in determining culpability. For US sanctions administered by OFAC, processing a transaction that benefits a sanctioned party is a violation even if the operator had no reason to know the party was sanctioned. The standard is not "did you try to screen?" — it is did you process a prohibited transaction?

This changes the compliance calculus. Sanctions screening is not a best-practice recommendation for responsible operators. It is a legal requirement for any payment operator with US nexus, and increasingly a requirement for operators in other major jurisdictions through equivalent EU, UK, and UN sanctions frameworks.

The Sanctions Landscape

Sanctions are measures applied by governments to restrict economic activity with designated individuals, entities, or countries. They are instruments of foreign policy — tools to pressure regimes, individuals, or groups without military action.

For payment operators, the relevant sanction types are:

Entity sanctions: Specific individuals and organisations placed on lists like OFAC's SDN list. Transactions with SDN-listed parties are prohibited regardless of transaction purpose.

Country/territory sanctions: Comprehensive programmes restricting transactions with entire countries. OFAC maintains comprehensive programmes for Cuba, Iran, North Korea, Syria, and the Crimea/Donetsk/Luhansk regions of Ukraine. These are near-total restrictions — processing any payment from or to these territories requires specific OFAC licences.

Sector sanctions: Restrictions on specific sectors of a designated country's economy rather than the entire country. Russian energy sector sanctions, for example, restrict transactions with specific companies in designated sectors without prohibiting all Russia-related transactions.

Correspondent banking sanctions: For payment operators processing international wire transfers, sanctions apply to correspondent bank relationships as well as end-parties. A USD wire must transit US correspondent banks — and US correspondent banks are required to screen all USD transactions for OFAC compliance.

The OFAC SDN List: Mechanics

The SDN list is available from OFAC in multiple machine-readable formats (XML, CSV) and through an API. The list is updated as designations are added, modified, or removed — update frequency can be multiple times per week during active geopolitical periods.

Each SDN entry contains:

• Name (including aliases, maiden names, alternative spellings)
• Entity type (individual, entity, vessel, aircraft)
• Identification numbers (passport, national ID, company registration, ISIN for securities)
• Addresses (last known, may be incomplete)
• Programme designation (which sanctions programme applies)

The alias field is where most false negative risks live. A sanctioned individual may appear on the list under their formal legal name but operate under a romanised variation, a married name, or a business alias. A payment operator screening only the primary name field would miss the alias matches.

The ID number fields are the most precise matching dimension — a match on passport number or company registration number is a high-confidence positive versus a name match that may be coincidental. Collect and screen on ID numbers wherever the payment context provides them.

The EU and UK Lists

The EU Consolidated Financial Sanctions List is maintained by the European Commission and aggregates all designations from EU Council regulations. Unlike OFAC, where the list is maintained by a single agency, EU designations may come from different Council Regulations — the list consolidates them. The EU list is available via the EU's API.

The UK's OFSI list was identical to the EU list prior to Brexit. Post-Brexit, the UK has maintained its own list under the Sanctions and Anti-Money Laundering Act 2018. The UK and EU lists have diverged since 2021 — the UK has made some designations the EU has not, and vice versa. Operators with UK-regulated operations must screen against OFSI separately.

The UN Security Council Consolidated List represents designations agreed by UNSC member states. It is generally a subset of OFAC and EU designations but is not perfectly coextensive. UN-designated parties should be treated as prohibited under domestic law implementing UN sanctions regardless of whether they also appear on domestic lists.

For multi-jurisdiction operators, the practical approach is to aggregate all relevant lists into a single screening database, deduplicate where the same entity appears on multiple lists, and screen once against the combined database per transaction. Screening redundancy increases false positive load without proportional compliance benefit.

The False Positive Problem

Sanctions screening generates false positives — matches against legitimate parties whose names, ID numbers, or attributes resemble SDN entries. Common sources:

Common names: Individuals with names that are common in regions with high SDN concentration (Middle Eastern names, Russian names) generate frequent false positives. An individual named "Ali Hassan" will match multiple SDN entries with the same name.

Transliteration variation: Arabic, Cyrillic, Chinese, and other non-Latin scripts romanised into Latin characters produce spelling variations that fuzzy matching catches as potential matches. "Muhammad" / "Mohammed" / "Mohamad" / "Mohamed" are the same name in different romanisations.

Business name similarity: Legitimate businesses with names similar to sanctioned entities — particularly state-owned enterprises in countries with large SDN lists — generate frequent matches on partial business name segments.

False positives create operational cost. Each potential match requires human review to determine whether the match is a true positive (confirmed sanction hit) or false positive (legitimate party). At scale, without tuned algorithms and efficient review workflows, the review queue can exceed the team's capacity to process — creating either compliance backlogs (risk of delayed true positive identification) or threshold loosening (risk of increased false negatives).

The calibration trade-off: lower similarity threshold = more false positives but fewer false negatives. Higher threshold = fewer false positives but more false negatives. The right calibration depends on the operator's risk appetite, the volume of transactions screened, and the review queue capacity.

The Dynamic Risk Layer: Beyond List Screening

List screening catches designated parties — entities that have been formally identified and listed. It does not catch:

• Parties operating under entities not yet listed (companies recently formed, shell structures created after the last list update)
• Parties in sanctioned territories operating under non-listed local entities
• Obfuscated beneficial ownership (a designated individual whose sanctioned assets are held by a non-listed nominee)
• Transactions designed to circumvent sanctions through layered jurisdictions (using a legitimate third-country entity to process payments for a sanctioned party)

The dynamic risk layer addresses these gaps through behavioural and contextual signals:

Jurisdiction risk: Transactions involving addresses, IP addresses, or bank identifiers in high-risk jurisdictions (sanctioned countries, FATF grey-listed countries) receive elevated scrutiny even where no specific SDN match exists.

Beneficial ownership: For business-to-business transactions above certain thresholds, obtaining and screening beneficial ownership information (who owns >25% of the business) against sanctions lists catches sanctioned individuals operating through corporate structures.

Negative media screening: Automated screening against news databases for parties associated with sanctions-related enforcement, corruption, or PEP (Politically Exposed Person) status provides a dynamic signal layer beyond static lists.

Structuring patterns: Transaction patterns designed to avoid reporting thresholds (transactions just below $10,000 in jurisdictions with CTR requirements) are a compliance signal independent of sanctions list status.

Building a Defensible Programme

A defensible sanctions compliance programme has five components:

1. Real-time list access: Automate SDN and consolidated list updates using OFAC's API and equivalent EU/OFSI APIs. Do not screen against manually maintained, periodic-update copies of lists — an SDN entry added between your update cycles is a liability exposure.

2. Screening integration point: Screen at the transaction processing point — before authorisation or payment execution — rather than post-processing. Screening early does not remove the reporting duty — under the US rules a blocked payment and a rejected one are both reportable. What it changes is that you are stopping a payment rather than unwinding one that has already cleared.

3. Calibrated matching algorithm: Use fuzzy matching with algorithm tuning for your specific transaction population. Tune the similarity threshold to produce a false positive rate your review team can handle. Document the tuning rationale.

4. Clear reviewer workflow: Define the decision criteria for reviewing potential matches — what evidence is required to clear a false positive, how true positive escalation works, who has authority to release a transaction held on a potential match, and what documentation is required for each decision. That authority ends at clearing a false positive — releasing property that has actually been blocked is not an internal decision, as the next section sets out.

5. Audit trail: Maintain records of all screening decisions — matches flagged, reviews conducted, false positive clearances, and true positive escalations — for at least five years. OFAC enforcement examinations will request this documentation.

Those five components all stop at detection. The sixth is what the programme does once a match is confirmed — which stop applies, where the money goes, which report is owed on which clock, and who has the authority to let it move again. That is a separate discipline, and it is set out in the two sections below.

After the Match, Under US Rules: Block, Reject, and Where the Money Sits

A confirmed match starts a second process with its own clock. The first question is not whether to stop the payment — it is which stop.

Under the US regime, blocking and rejecting are different legal outcomes, not two words for the same action. OFAC's guidance describes rejection as what applies when the underlying transaction is prohibited but no blocked party holds an interest in the funds: "In these cases, the transaction is simply rejected, or not processed and returned to the originator." The reject-reporting rule puts the same test the other way: 31 CFR 501.604 covers a US person that rejects a transaction "that is not blocked under the provisions of this chapter, but where processing or engaging in the transaction would nonetheless violate a provision contained in this chapter".

Blocking applies where a designated party does have an interest in property that has reached you. OFAC ties the duty to possession, not intent: "Once the ball starts moving, you must stop it if it comes into your possession." In OFAC's example, an SDN-matching applicant arrives with an opening deposit: the account cannot be opened, and "you are obligated to block the funds."

On the ledger the two look nothing alike. A reject fails the payment and returns the money to the originator; nothing of yours is holding it, and what you owe afterwards is the report. A block keeps the money and stops it being anyone's to move — not the sender's, not the beneficiary's, not yours to hand back as a goodwill refund. In a payout investigation, this is the compliance leg.

Blocked funds do not sit wherever treasury finds convenient either. The requirement lives in each sanctions programme's own part rather than in a chapter-wide rule, so read the part governing your match — but the account-location requirement in paragraph (a) is worded identically in the Global Terrorism Sanctions Regulations (31 CFR 594.203), the Russian Harmful Foreign Activities Sanctions Regulations (587.203) and the Weapons of Mass Destruction Proliferators Sanctions Regulations (544.203). The neighbouring investment restriction is not identical across them, so do not carry it across: 594.203(f) and 544.203(f) bar an immediate benefit, while the Russia rule sits at 587.203(h) and omits "immediate" — a broader prohibition on the programme most payment operators will actually hit. Taking the account rule, 31 CFR 594.203(a) requires a US person holding blocked funds to "hold or place such funds in a blocked interest-bearing account located in the United States" — at a federally-insured US bank, thrift or credit union at a commercially reasonable rate, or an SEC-registered broker-dealer in a money market fund or Treasury bills. The same section, at 594.203(f), bars holding them in any manner "that provides immediate financial or economic benefit or access to any person whose property or interests in property are blocked". Two exceptions matter before you move anything: the requirement applies except as OFAC directs otherwise or as paragraphs (c) and (d) provide, and (d) lets blocked funds already held outside the United States when they became blocked stay in the same type of account, provided they earn a commercially reasonable rate.

Then the clocks — all three US filings under 31 CFR part 501, submitted through the OFAC Reporting System:

• Blocked property, initial report. "Reports shall be filed within 10 business days from the date that property becomes blocked." (§ 501.603(b)(1)(i))
• Rejected transaction report. "Reports shall be filed within 10 business days of the rejected transaction prohibited by the provisions of this chapter." (§ 501.604(c))
• Annual blocked property report. "A report on all blocked property held as of June 30 of the current year shall be filed annually by September 30." (§ 501.603(b)(2)(i)) Blocked funds may sit in omnibus accounts, but the annual report must disaggregate them, asset by asset.

Release is what operators most often get wrong, because it is not their decision. Unblocking or transferring blocked property carries its own 10-business-day report under § 501.603(b)(3), with carve-outs — one for an unblocking or transfer "explicitly authorized by a specific or general license", though not where that licence itself conditions the authorisation on a separate unblocking report, and another for property unblocked because OFAC removed the person from the SDN List. Those carve-outs are about which report is owed, not a complete list of how money gets released. Release comes from OFAC — a licence or a delisting — or from a valid order of a US Government agency or court, which § 501.603(b)(3)(i) contemplates alongside them. It never comes from the operator's own judgement: a reviewer's authority runs to clearing a false positive and stops there.

These are US obligations. Section 501.603(a)(1) places them on any US person, including a financial institution, holding, unblocking or transferring blocked property; a non-US operator is pulled in by its own US nexus, not by the fact of a match. What you may tell the customer is a separate question these sources do not settle — do not read a permitted disclosure out of their silence.

The UK Layer: Freeze, Report, Licence

The UK regime is built on an asset freeze rather than a block-or-reject split, and OFSI's general guidance is explicit that freezing is not custody: "The funds and economic resources are to be frozen immediately by the person in possession or control of them. An asset freeze does not involve a change in ownership of the frozen funds or economic resources, nor are they confiscated or transferred to OFSI for safekeeping." The money stays where it is and remains the designated person's property; it just cannot move.

Where you know or have reasonable cause to suspect that you hold or are dealing with a designated person's funds or economic resources, the guidance sets three duties: freeze them; "not deal with them or make them available to, or for the benefit of, the designated person, unless there is an exception in the legislation that you can rely on or you have a licence from OFSI"; and report them to OFSI.

The UK reporting clock has a different shape — no business-day count. Relevant firms must "inform OFSI as soon as practicable" when, in the course of carrying on their business, they know or reasonably suspect that a person is designated or has breached a prohibition; where the designated person is a customer, the report must also state the nature and amount of funds or economic resources held for them. A relevant institution — a firm with Part 4A FSMA 2000 permission — "must inform OFSI without delay whenever it credits a frozen account, where it receives funds transferred to it for the purpose of crediting that account". The guidance carves out the obvious false positive: a relevant institution does not need to tell OFSI when it credits the account with interest or other earnings. OFSI's list of relevant firms, which each regime's regulations define, includes those Part 4A permission holders, businesses that transmit money or run a currency exchange office, and cryptoasset exchange and custodian wallet providers.

The Russia regime adds an annual return on different dates, and it is narrower than it first looks: a relevant firm holding funds or economic resources for a "prohibited person" under regulation 18A(1) of the Russia (Sanctions) (EU Exit) Regulations 2019 must report their nature and amount as at 30 September to OFSI by no later than 30 November each year. "Prohibited person" is not a synonym for "designated person" — it is the narrower Russia-regime category — so this return neither binds every UK holder nor stops at designations.

Release, again, is not yours to grant. An OFSI licence is "a written permission from OFSI allowing an act that would otherwise breach prohibitions imposed by financial sanctions", issued as a specific or a general licence — and the guidance adds a line worth writing into your procedure: "It does not compel any party, including the financial institutions involved in the payment route, to take any action." A counterparty waving a licence at you does not oblige you to move money.

Two regimes, two registers. An operator with both a US nexus and UK-regulated activity runs two post-match processes, not one with two templates: different triggers, deadlines, annual dates, definitions of who is caught. Which applies depends on your licensing footprint and where the payment legs sit — and, as OFSI's guidance puts it, "If you are unsure of your reporting obligations, you should seek independent legal advice."

Enforcement: What the Exposure Looks Like

OFAC publishes enforcement actions — penalties assessed against operators who processed prohibited transactions. Recent enforcement patterns:

• Penalties for screening programme failures are substantially reduced when the operator had a functioning screening programme that failed due to a systematic gap, versus an operator with no screening programme at all.
• Voluntary self-disclosure — reporting a sanctions violation to OFAC before they discover it — typically results in a 50% reduction in civil penalty.
• OFAC considers programme factors: whether the operator had appropriate policies, adequate systems, sufficient training, and management commitment to compliance.

The lesson: sanctions screening is not a binary pass/fail. It is a risk-managed programme where documented, good-faith compliance effort materially affects enforcement outcomes when violations occur. An operator who discovers they processed a sanctions-adjacent transaction and self-discloses with evidence of a functioning programme faces very different exposure than one with no screening infrastructure and no disclosure.

The floor for any payment operator processing international transactions is list screening against the relevant OFAC, EU, UK, and UN consolidated lists, at every transaction, in real time. The ceiling is a full dynamic risk programme incorporating behavioural signals, beneficial ownership screening, and negative media monitoring. Where an operator falls on that spectrum should be proportionate to their transaction volume, jurisdictional exposure, and the customer segments they serve.