Sanctions Screening for Universities: Students, Tuition Payers and Donors

A student, the person signing a tuition agreement and the person paying the invoice may be three different people. A donation may come through a foundation, while a refund request may name someone who never made the original payment. University sanctions screening needs to preserve those roles so staff can investigate the right relationship before accepting, using or releasing funds.

This guide helps university and education-provider teams plan checks across tuition, sponsorship, donations, agents, partnerships and refunds. It is an operating model for finance, compliance, admissions and fundraising teams—not a rule that every institution must screen every contact, or that only large or international payments can create sanctions exposure.

Start with the institution's obligations and decision owners

Establish which legal entity is entering the agreement, receiving money or providing a benefit. An international university group may have campuses, charities, companies and research arrangements subject to different rules. Sanctions duties, AML-regulated status, charity governance and privacy requirements need separate assessment; a university label does not resolve them.

In the UK, financial sanctions apply to persons within UK territory and to UK persons wherever they operate. OFSI distinguishes a name match from a target match and explains that the next action depends on the restriction involved.¹ This is separate from whether the institution falls within a particular regulated AML category.

Assign a team to collect information, a reviewer to investigate candidates and an accountable person to approve the relevant financial or relationship decision. Admissions staff should not have to interpret an asset-freeze rule, and finance should know when to refer an issue before funds move. An internal operational hold is not itself a legal determination that funds are frozen.

Map students, payers and other counterparties

Start with the roles shown in the agreement and payment records. A parent or employer may pay fees legitimately; a different payer is a fact to explain, not proof of misconduct. Equally, a student-only check can miss the person who signs the agreement or controls the funding arrangement.

For a company sponsor, donor foundation or agent, obtain the relationship information needed under the institution's due-diligence process. Screen supplied owners, controllers or representatives where relevant. Do not assume a chief executive is the beneficial owner, or that a foundation has shareholders simply because a commercial company would.

The matrix below suggests checkpoints and responsibilities. Adapt it to the institution's structure and applicable rules rather than treating every row as a universal legal mandate.

For broader charity operations, use the charity and NGO screening guide. This guide concentrates on the student account, tuition agreement and university gift/refund workflow.

A tuition case that shows why the payer matters

On 12 February 2026, OFAC announced a US$1,720,000 settlement with IMG Academy, a Florida school and sports-training facility, for 89 apparent counternarcotics-sanctions violations. Its tuition agreements involved two designated parents and their children's education. Payments also came through non-designated third parties.²

The lesson for workflow design is to connect the student, agreement counterparty and payment parties. Checking only the name on an incoming transfer may miss the underlying arrangement. The case does not mean the children were designated, nor does it establish that every foreign university transaction is automatically prohibited by US law.

A non-US institution should assess any applicable US jurisdiction, parties, payment route, authorisations or other relevant connections. Distinguish that analysis from secondary-sanctions exposure rather than using the terms interchangeably.

Handle third-party tuition payments without losing the relationship

When an employer, parent, scholarship body or other sponsor pays, record its full name, role and relationship to the student. For an organisation, add its registration details and the agreement or authorisation supporting the payment. Explain split payments or a new payer using the available facts.

Check the supplied parties within policy scope and link the result to the invoice or student account. If more information is needed, specify what question it will resolve: identity, authority, ownership, payment provenance or something else. Avoid asking for a broad collection of personal documents without a defined purpose.

A bank's processing decision is useful context, but does not replace the institution's assessment of its agreement, services or relationship. A payment passing through a bank is not proof that every relevant party or restriction has been cleared.

Keep donor screening separate from gift acceptance

For a donation, identify the donor, any intermediary, the paying entity and any relevant supplied controllers. A foundation's founder, trustee, authorised signatory and person exercising control may have different roles; establish the facts instead of applying a company-ownership template automatically.

Sanctions screening supports identity and list-match review. Gift acceptance may also involve source-of-funds evidence, conflicts, restrictions on use, governance and reputation. A clear screening result does not require the university to accept a gift, and an adverse reputational judgment is not itself a sanctions designation.

For charities in England and Wales, Charity Commission guidance says a suspected donation from an illegal source should not simply be returned or followed by contact with the donor; it sets out reporting and advice steps.³ Apply the relevant sanctions analysis as well. If money has already arrived, an informal refusal or refund can create a separate problem: refer the case before transferring, using or returning the funds.

Review a refund to someone different from the original payer

Connect the refund request to the original payment, proposed recipient and reason for the change. Verify the request and authority using the institution's established financial controls. An email or signed attachment alone may not authenticate the request or prove ownership of the destination account.

Screen a new recipient within the approved process, but keep that result separate from account verification, fraud review, contractual entitlement and refund policy. A refund from a company-funded student account to the student personally remains a change of recipient; it is not automatically simpler because the student is already known.

Where a potential restriction remains unresolved, route the case to the responsible team before release. Decide any statutory freezing, reporting or licensing obligations under the applicable rules. Do not send money back merely because staff believe rejecting it is safer than holding it.

Investigate matches without turning a score into a decision

Use a documented review sequence:

1. Confirm the input and role. Establish who was screened and whether they are the student, payer, donor, representative or proposed recipient.
2. Read the source entry. Compare available names, aliases, dates of birth, entity identifiers, addresses and relationship evidence.
3. Resolve differences with evidence. A different address, spelling or nationality alone may not settle identity. Obtain further information proportionately.
4. Separate identity from legal effect. A possible match needs investigation; a confirmed identity still requires assessment of the applicable measure, ownership/control, exemptions and authorisations.
5. Record and escalate. Preserve the rationale, open questions and person responsible for the next decision.

A result with no candidate means no candidate was returned for those inputs, sources and settings. It does not prove that every indirect ownership connection, geographic restriction or service prohibition has been ruled out. Likewise, delisting may warrant reassessment but does not automatically authorise every previously paused transaction.

PEP information belongs in the relevant due-diligence process. FATF describes its PEP measures as preventive, rather than an assertion that all PEPs are criminals.⁴ Political exposure alone is not a sanctions prohibition or automatic reason to reject a student or donor. Nationality is an identity or jurisdictional fact, not proof of designation; assess any applicable geographic or service restriction separately.

Apply the relevant jurisdiction and keep other controls separate

Use the current UK Sanctions List for UK designations; the former OFSI consolidated list closed on 28 January 2026.⁵ Check the relevant regulations and OFSI guidance for the activity, rather than copying another university's internal payment policy as law.

For Germany, the Bundesbank explains the framework for financial sanctions and the binding role of the published legal texts.⁶ For Spain, the Treasury describes freezing and non-availability measures under the applicable EU framework and the authorisation process.⁷ Establish the competent authority for the particular funds, goods, service or research question. Do not describe an EU directive on criminal enforcement as the original source of every underlying financial restriction.

For UAE operations, assess the UAE framework and relevant local or free-zone arrangements. CBUAE's legal-basis guidance identifies the UN Consolidated List and UAE Local Terrorist List; its supervisory instructions are addressed to licensed financial institutions and must not be transplanted wholesale to universities.⁸

Keep admissions merit, student support, immigration, travel restrictions, identity verification and account authentication with the responsible teams. Export-controlled research, technical collaboration and technology transfer also require their own assessment. Screening can inform those processes, but neither a clear result nor a match score determines educational eligibility or research permissions.

Collect enough data for the question, not every possible document

Data minimisation requires enough relevant information for a defined purpose, without collecting more than necessary.⁹ Do not make passport copies, political-background questions or every donor's full ownership file a universal minimum. Establish the lawful basis, notices, permissions and retention rules with the relevant privacy and legal teams.

Retain a record that another authorised reviewer can understand: who was checked, why, what was found and who approved the action. This guide does not prescribe a blanket five-, seven- or ten-year retention period for every education provider.

Three hypothetical scenarios

A company sponsors a student's tuition

Finance receives a sponsorship agreement naming a company as the tuition counterparty. It records the company separately from the student and obtains the relevant registration and relationship information. A supplied representative returns a possible PEP result, but no sanctions candidate.

The reviewer verifies the person's role rather than assuming the representative owns the company. Any PEP-related assessment follows the applicable framework and policy. Finance records the screening outcome alongside the separate sponsorship and payment approvals; a clear name result alone does not settle the whole arrangement.

A foundation offers a restricted-purpose donation

A foundation offers funding for a university programme. Its documents identify trustees and a person with relevant control rights. A supplied person's name produces a sanctions candidate.

Fundraising refers the identity evidence and governance facts for review before the gift decision. If funds have arrived, staff seek instructions on their handling rather than automatically refunding them. The responsible team determines the applicable restriction, reporting and any authorisation route; the scenario does not assume that a candidate or any foreign-list entry establishes a local prohibition.

A refund is requested to a different recipient

A student's fees were paid by an employer, but a later refund request names a parent's account. Finance records the changed recipient and checks the request and entitlement through its normal verification process.

The relevant supplied recipient is screened, and any unresolved candidate is escalated before release. Even if screening produces no candidate, the refund still needs the required financial approval and account checks. Preserve the original payment, revised instructions, verification and final decision together.

Implementation checklist

Evaluate Checklynx within the university's process

Checklynx screens supplied people, companies and supported identifiers against configured sources. Teams can use the screening portal, CSV batches, API and ongoing monitoring, with review and evidence records.

Evaluate it using representative tuition, donor and refund cases. Confirm source coverage, who reviews candidates and how changed parties are handled. Checklynx does not authenticate documents, verify funding sources, universally discover owners or decide admissions, immigration, reporting or final legal outcomes. Use the software buyer guide to document acceptance criteria.

Frequently asked questions

Must we screen every student in the same way?

This guide does not establish a universal exemption or mandate. Define the population and timing under the applicable rules, risks and policy. Do not assume that only a large payment or foreign nationality can require attention.

Does the bank's screening cover our responsibilities?

Do not assume so. The bank has its own obligations and information. The institution must assess the agreement, parties and activities for which it is responsible, including relevant facts the bank may not hold.

Does a PEP result prevent admission or payment?

PEP status alone is not a sanctions designation or automatic prohibition. Apply the relevant due-diligence policy and keep the decision separate from academic eligibility and any applicable sanctions analysis.

Can we return a payment or gift if a possible match appears?

Do not treat returning funds as the default resolution. Refer the identity question and the handling of any received funds to the responsible team before using, transferring or returning them.

How often should existing relationships be checked again?

Set review triggers and timing around the applicable rules, maintained relationships, relevant source changes and events such as a new payer or recipient. No universal daily, monthly or annual schedule is prescribed here.