Sanctions Screening: A Practical Guide for Compliance Teams

Sanctions screening is often described as a name check: compare a customer or counterparty with a list, then clear or escalate the result. That is incomplete. Sanctions can restrict funds, economic resources, services, trade, investment, transport and other activity. Some restrictions extend to unlisted entities through ownership or control. A name screen can identify a question; it cannot decide every legal issue.

The practical task is to connect law, data and operations:

Map legal perimeter → identify applicable regimes and restrictions → define the screening population and data → select trigger points → investigate potential matches → assess ownership, control and the relevant prohibition → apply the authorised disposition → retain evidence → test and improve the control.

This guide explains that model for compliance, financial-crime, product and operations teams.

What sanctions screening is—and what it is not

Sanctions screening is a control that compares relevant identifying information with sanctions data so that a firm can identify possible exposure and investigate it. The subject may be an individual, organisation, vessel, aircraft or another object represented in official data. The relevant question may arise at onboarding, when a counterparty is introduced, during a transaction, after an ownership change, or when an authority changes a designation or programme.

The UN Security Council Consolidated List brings together individuals and entities subject to Security Council sanctions measures, but the measure that applies depends on the relevant regime and its implementation by Member States.¹ In the United States, OFAC publishes the SDN List and consolidated non-SDN data; those sources do not represent one uniform restriction, and the SDN List is not the whole OFAC sanctions framework.² In the United Kingdom, the UK Sanctions List is the current source for UK designations, but firms still need the applicable regime legislation and guidance to understand the legal effect.³

Screening is not the same as complete sanctions compliance. A clean name result does not resolve sectoral restrictions, prohibited services, restricted goods, geographic measures, ownership or control, or attempts to evade sanctions. FCA supervisory findings make the same operational point: customer and payment screening may not identify trade restrictions, sectoral sanctions or evasion, so other controls may be needed.⁴

Screening is distinct from adjacent controls:

• KYC and KYB maintain identity, business and ownership information that can support a sanctions investigation, but the controls have different purposes.
• PEP screening identifies political exposure for risk-management and enhanced-due-diligence purposes. PEP status does not by itself mean that a person is sanctioned. See the separate PEP screening guide.
• AML transaction monitoring looks for suspicious patterns. Sanctions analysis asks whether a restriction affects a party, property or activity. The controls may exchange data, but neither replaces the other. See the AML compliance guide.
• Adverse-media screening can provide risk context and investigative leads. It is not an official designation source.

The first design principle follows: do not ask only, “Which list should we load?” Ask, “Which legal restrictions can apply to our legal entities and activities, and what control evidence is needed to identify and manage that exposure?”

Separate binding rules from guidance and implementation choices

Compliance procedures become unreliable when every source is described as a “requirement.” A control owner should be able to classify each important statement in a policy, rulebook or configuration decision.

FATF describes its Recommendations as international standards that countries should implement and adapt to their legal, administrative and financial systems.⁵ Recommendations 6 and 7 address countries’ implementation of targeted financial sanctions concerning terrorism and terrorist financing, and proliferation respectively.⁶⁷ They influence national frameworks; they are not self-executing private-sector legislation.

The Council of the EU describes its sanctions best-practices document as non-binding and non-exhaustive.⁸ It is useful implementation material, but it should not be cited as if it were an EU regulation. OFAC’s Compliance Framework similarly presents a risk-based model built around management commitment, risk assessment, internal controls, testing and auditing, and training.⁹ It does not replace programme-specific US rules.

Start with legal perimeter, not a global list

The sanctions perimeter is the set of regimes and restrictions that can apply to the organisation, people, property and activity. Establish it before configuring matching.

Map the legal entities, branches and people involved; incorporation and operating locations; customer and counterparty locations; products, services, assets and transaction types; currencies, payment rails and intermediaries; ownership, control and agency relationships; and any contractual or policy controls beyond the legal minimum.

UK financial sanctions apply to persons and activities within UK territory, and to UK nationals and legal entities established under UK law wherever they operate.¹⁰ That is a UK scope statement, not a shortcut for deciding UK nexus in every cross-border case. US sanctions analysis is programme-specific; avoid reducing it to slogans about a currency, server location or customer nationality. EU measures apply according to their own scope provisions and the facts of the activity.

Build a regime-and-programme matrix with legal input where needed. Separate legally applicable sources from those adopted under risk appetite, customer commitments or policy. Risk assessment can shape additional coverage, workflow and testing; it does not change the effect of an applicable rule.

Authority, nexus and source matrix

The Commission’s overview links EU sanctions resources and national competent authorities.¹¹ Use it as a route to authoritative material, not a substitute for the legal act. OFAC’s Sanctions List Service provides SDN and non-SDN data.² Use the UK Sanctions List with the applicable regulation and OFSI material.³

Assign an owner to monitor each official source and identify affected populations. The UN publishes additions, amendments and removals.¹² OFAC states that its SDN List has no predetermined update timetable.¹³ Authorities do not follow one universal schedule.

Decide who and what enters the control

The screening population follows the legal perimeter and business model. It can extend beyond the named customer to counterparties, owners/controllers, payees, suppliers, intermediaries and relevant assets. Map when each subject becomes known, which identifiers are available, what decision can still be paused and which legal entity owns it.

Not every identifier is appropriate in every relationship. Know which data is reliable at each decision point and where thin data prevents a defensible resolution.

Choose screening and reassessment moments

There is no universal global rule that every customer must be screened daily, continuously or at every transaction.¹⁴¹⁵ Define timing from applicable law and a documented control model.

Useful trigger categories include:

A narrow payment example

Payment controls illustrate why cadence should follow the exact rule. Article 5d of Regulation (EU) No 260/2012 requires PSPs offering instant credit transfers to verify their payment service users immediately after relevant targeted financial restrictive measures enter into force or are amended, and at least once each calendar day.¹⁵ During execution, the payer’s and payee’s PSPs do not perform an additional Article 5d verification of those payment service users; the provision preserves other restrictive-measures and Union AML/CFT obligations.¹⁵ That specific model should not be generalised to every payment, product or jurisdiction. The detailed workflow belongs in the specialist guide on sanctions screening for payment institutions.

Assess ownership and control beyond the listed name

A clean company-name result may not close the sanctions question. Depending on the applicable regime, an unlisted company can be affected through ownership or control by a designated or blocked person. The legal tests are not a single global “50 percent rule,” and an AML beneficial-owner threshold should not be substituted for a sanctions test.

For corporate subjects, record the source date, direct and indirect holdings, voting and appointment rights, relevant agreements, intermediate entities and any uncertainty. A generic UBO record is evidence, not a legal conclusion. The analyst needs to know which jurisdictional test is being applied and why.

This is also where KYC and sanctions controls should exchange information without becoming the same process. Corporate records collected for KYB may reveal an owner or controller that changes sanctions exposure. Conversely, a sanctions alert may show that the ownership record needs refreshing. See the beneficial ownership and UBO guidance for the underlying corporate-data context.

Design matching to generate explainable candidates

Matching should generate candidates for investigation with enough context to resolve them. A score is not a legal result, and no universal 90%, 95% or 99% threshold establishes compliance.

The design usually needs to address:

• normalisation of case, punctuation, spacing and common legal-form differences;
• aliases, former names, reordered names and transliteration;
• non-Latin scripts and language-specific name structures;
• dates and places of birth, nationality and address;
• passport, tax, registration, vessel, aircraft and other stable identifiers;
• subject type, because a person, entity, vessel and aircraft require different comparison fields;
• data quality, truncation, field length and missing identifiers; and
• treatment of weak aliases and broad generic terms.

OFAC’s potential-match guidance tells reviewers to compare the complete sanctions entry with available identifiers, including name, address, nationality, passport or tax ID, place and date of birth, former names and aliases, and to obtain additional information where needed.¹⁸ OFAC also recognises “weak AKAs” as broad or generic aliases that can create substantial false hits.¹⁹ These are useful investigation principles; they do not prescribe one algorithm or threshold for every organisation.

FCA’s 2026 supervisory findings identified weaknesses involving inaccurate or outdated lists, configuration, delayed updates, reference data, name variants, non-Latin names, titles, character limits, alert rationale, testing and over-reliance on vendors.⁴ Convert those observations into test cases rather than generic policy language.

Build a representative test pack

Test exact names, aliases, spelling changes, transliteration, non-Latin scripts, common names with conflicting identifiers, missing dates of birth, truncated entity names, weak aliases, asset identifiers and ownership chains. For each case, record the source/version, input and transformation, expected and actual behaviour, downstream workflow, and remediation owner. Test the complete path from official update through ingestion, population selection, candidate creation, analyst access, disposition and evidence—not only the matching engine.

Investigate the alert before deciding the legal action

An alert says that configured logic found a similarity or rule condition. It does not prove identity, establish ownership or control, identify the applicable prohibition, or decide whether activity should be released, refused, frozen, blocked or rejected.²⁰¹⁰

Use a staged investigation so that identity resolution remains separate from legal disposition.

OFAC’s US guidance distinguishes transactions that involve blockable interests from transactions that are prohibited but should be rejected rather than blocked.²⁰ Do not export that terminology as a universal model: EU and UK measures have their own freezing, prohibition, licensing and reporting structures. Under UK asset-freeze guidance, funds or economic resources that are in fact subject to an asset freeze are to be frozen immediately by the person possessing or controlling them.¹⁰ That statement applies after the relevant legal criteria are established; it does not turn every unresolved fuzzy alert into confirmed frozen property.

Where UK reporting rules apply to a defined relevant firm, OFSI says the firm is to inform OFSI as soon as practicable when the specified knowledge or reasonable-suspicion conditions are met.¹⁰ OFSI also explains that reporting to another regulator or submitting an NCA suspicious activity report does not replace an applicable OFSI reporting duty.¹⁰ Keep jurisdiction-specific reporting procedures separate and current.

The operating lesson is simple: configure separate states for candidate, under investigation, identity resolved, ownership/control review, legal escalation and final disposition. A single “hit” status conceals both uncertainty and authority.

Retain evidence that makes the decision reproducible

A defensible case record should allow a reviewer to reconstruct what the organisation knew, which source and rule it considered, how the analyst compared the subject, who approved the decision and what happened next.

For a material alert, retain the subject and identifiers; the underlying customer, counterparty, transaction, ownership or asset record; authority, programme, source version and retrieval time; fields supporting and contradicting the candidate; relevant ownership/control and activity context; analyst rationale; escalation, reviewer and timestamps; final disposition and any advice, exception, licence or reporting reference; operational outcome; and later QA or review.

Link evidence to configuration. If an alert was created under a particular matching rule, source version or threshold, preserve that context. If it was cleared through a reusable false-positive rule, record the distinguishing identifiers and conditions under which that rule remains valid.

Weak audit trails do more than frustrate an auditor. They prevent the firm from identifying affected cases after a source correction, ownership change or control defect. FCA findings emphasise documented alert rationales, quality assurance, escalation and sufficient resources.⁴

Govern, test and oversee the complete control

Technology can support screening, but governance determines whether the control stays aligned with legal scope and operational reality. OFAC’s compliance framework describes five components—management commitment, risk assessment, internal controls, testing and auditing, and training—as part of a risk-based sanctions compliance programme.⁹ FCA guidance likewise stresses senior-management responsibility and oversight of screening resources supplied by group functions or third parties.²¹

Assign clear accountability for:

• legal-perimeter and regime interpretation;
• official-source monitoring and update ingestion;
• population and data mapping;
• matching configuration and change approval;
• alert queues, ageing and escalation;
• ownership/control review;
• disposition, licensing and reporting procedures;
• quality assurance and independent testing;
• incidents, outages and missed updates; and
• management information and policy maintenance.

Outsourcing does not remove control ownership

A provider may supply data, technology or review support. The organisation still needs to understand delegated scope, sources, data, configuration, alert ownership and outage handling.

Test vendor output with cases drawn from your own products and data. Reconcile source updates, sample cleared candidates, inspect unresolved queues, review service failures and maintain an exit or recovery path. FCA supervisory material warns against uncritical reliance on group or vendor resources without sufficient internal understanding, oversight and testing.²¹⁴

The OFSI Bank of Scotland enforcement discussion provides a concrete reminder: the authority described an automated-screening failure involving a spelling variation and highlighted contingency, escalation, training and prompt reporting.²² The lesson is not that automation is ineffective. It is that a screening system needs tested matching, people who can recognise failure, and an owned response when the automated path does not work.

Management information should show control health

Report candidate volumes and ageing by product and source; outcomes; cases awaiting data or legal review; overrides; source-update completion; failed jobs; QA and test exceptions; ownership/control escalations; and overdue remediation. Interpret the figures with sampled evidence: fewer alerts can indicate better calibration or missing data, while a fast queue can conceal weak rationale.

Teams evaluating sanctions screening software should therefore assess data lineage, configuration transparency, explainable candidate evidence, workflow ownership, auditability, source-change handling and testing support. Product selection is one control decision inside the wider framework; it is not a compliance conclusion.

Practical sanctions-screening checklist

Use this checklist as a control-design aid, not as a substitute for legal analysis.

Frequently asked questions

What is sanctions screening?

Sanctions screening is a control that compares relevant party or object data with sanctions information to identify possible exposure for investigation. It can apply to people, entities, vessels, aircraft and other data represented in official sources. It is not the legal prohibition itself, and it does not identify every sectoral, geographic, service, ownership or evasion restriction.

Is sanctions screening legally required for every company?

There is no accurate universal yes-or-no answer. Substantive sanctions prohibitions can apply broadly within a jurisdiction, while explicit screening-system, reporting and supervisory requirements vary by jurisdiction, sector and activity. For example, UK financial sanctions apply to persons in UK territory and UK persons wherever they operate, while particular OFSI reporting duties apply to defined relevant firms under specified conditions.¹⁰ Establish the organisation’s legal perimeter rather than copying another firm’s list or frequency.

Which sanctions lists should a company screen?

Start with regimes legally relevant to the organisation’s legal entities, locations, products and activity. Then document additional sources adopted because of risk, policy or contractual commitments. Do not assume that every company worldwide is legally required to screen UN, EU, UK and all OFAC lists. OFAC itself provides SDN and multiple non-SDN datasets, and programme restrictions cannot always be reduced to list membership.²

Who should be included in sanctions screening?

The relevant population can include customers, organisational entities, authorised users, counterparties, payees, suppliers, owners/controllers, intermediaries, vessels or aircraft, depending on the applicable regime and business model. Map how each party enters the relationship and what decision the control supports. This is a perimeter and risk question, not a universal command to screen every possible party identically.

How often should customers be rescreened?

There is no universal global cadence. Combine applicable legal requirements with event triggers such as official list changes, corrected identifiers, ownership changes and new relationships, plus a documented periodic backstop. EU Article 5d provides a deliberately narrow counterexample: it sets immediate-after-change and at-least-daily verification for payment service users of in-scope instant-credit-transfer PSPs.¹⁵ Do not generalise that cadence beyond its scope.

Does a company have to appear on a sanctions list to be restricted?

No. An unlisted entity may be affected through ownership or control, but the tests differ. OFAC’s automatic rule uses direct or indirect aggregate ownership of 50% or more by blocked persons.¹⁷ UK guidance uses separate ownership and control criteria.¹⁰ EU analysis starts with the applicable regulation and may use expressly non-binding Council best practices as interpretive implementation material.¹⁶⁸

How should a potential false positive be investigated?

Compare the complete official entry with reliable identifiers available for the subject. Check subject type, aliases, date and place of birth, nationality, address, document or tax identifiers, registration data and other relevant descriptors. Obtain more information where the available data cannot resolve the candidate. OFAC publishes this comparison approach and separate guidance on weak aliases.¹⁸¹⁹ Document why conflicting identifiers are sufficient—or insufficient—to clear the case.

Does an alert mean a transaction must be frozen?

No. An alert is a candidate. Resolve identity, ownership/control, legal nexus, programme and restriction before applying the authorised action. Under US rules, OFAC distinguishes blocking from rejection depending on the programme and whether a blockable interest is involved.²⁰ UK freezing duties apply where the applicable asset-freeze criteria are met.¹⁰ Other jurisdictions use their own legal structures, exceptions, licences and reporting paths.

What evidence should be retained for a screening decision?

Retain enough to reproduce the decision: screened data, subject and relationship identifiers, authority and source version, candidate fields, conflicting descriptors, ownership/control evidence, activity context, analyst rationale, escalation, approver, timestamps, final disposition and later QA or review. The exact record depends on the case and retention framework, but a bare “clear” or “hit” status is not an adequate investigation history.

Can sanctions screening be outsourced?

Data, technology and review work can be supported externally, but the organisation still needs to govern its control. Document provider scope, sources, data flow, configuration, update handling, service failures, alert ownership, testing and recovery. FCA material specifically warns against over-reliance on vendors or group resources without sufficient internal understanding and oversight.²¹⁴

Closing perspective

A strong process begins with legal perimeter and ends with evidence an accountable team can explain. Map the regimes, parties and data; reassess when exposure changes; separate identity, ownership and legal analysis; apply the jurisdiction-specific decision path; and test the complete chain. Use the sanctions screening guide hub for related authority, process and industry resources.

References