Sanctions Screening: How Firms Check Customers Against Sanctions Lists

Sanctions screening is the process of checking customers, business counterparties and payment parties against official sanctions lists before and throughout a business relationship. Banks, payment firms, insurers, marketplaces and other regulated or internationally active businesses use it to identify people, companies, vessels and other parties subject to asset freezes, trade restrictions or related measures.

The purpose is not simply to find an identical name on a list. A sound process determines whether a customer or transaction involves a sanctioned person or entity under the laws that apply to the firm. Those laws can differ by jurisdiction, activity, currency, location and the parties involved.

When sanctions screening takes place

Screening normally starts at onboarding, when a firm is deciding whether to establish an account, provide a service or enter a commercial relationship. It should also occur when material customer details change, such as a new director, address, nationality or beneficial owner.

It continues after onboarding because sanctions lists change frequently. A customer that did not match yesterday may become listed later, or an existing listing may be updated with new aliases or identifying information. Firms therefore rescreen their customer and counterparty populations when relevant list updates are received, using a risk-based operating model.

Payments require a further, time-sensitive check. Before processing a transfer, payment screening systems typically examine the originator, beneficiary, intermediaries and, where available, information in payment messages. The objective is to stop or hold a payment for review before it is completed when it may involve a restricted party, destination or activity.

How matching and alert review work

Sanctions lists contain names, aliases and identifying data, but records are rarely perfectly consistent. A person may use multiple surnames, a company may trade under a different name, and names written in Arabic, Cyrillic, Chinese or other scripts can have several Latin-character transliterations. Screening tools consequently use exact name matching and fuzzy matching, which looks for likely variants, reordered words, abbreviations and spelling similarities.

Fuzzy matching improves the chance of finding a real match, but it also produces alerts for unrelated people. Analysts investigate alerts by comparing secondary identifiers, including date and place of birth, nationality, address, passport or national identification details, registration numbers, country of incorporation and known associates. The list entry and the firm’s customer record must be assessed in context, rather than treating a similar name as proof.

Why false positives are a persistent problem

False positives are potential matches that prove to concern a different person or entity. They are especially common for widely used names, short company names and names that have many transliterations. An alert on a customer named Mohammed Ali, for example, may be appropriate to investigate but cannot by itself establish that the customer is the listed individual.

Too many low-quality alerts can slow onboarding and delay legitimate payments. Setting matching thresholds too loosely may miss risk, while setting them too broadly can overwhelm review teams. Firms try to improve precision with better data, calibrated matching rules, documented analyst decisions and quality assurance. They should retain evidence showing why a possible match was cleared or escalated.

Ownership matters, not just the customer name

A company may not appear on a sanctions list in its own name yet still be subject to restrictions because of who owns it. This is why firms identify and screen beneficial owners, meaning the natural persons who ultimately own or control a customer, as well as directors, signatories and relevant connected parties. Ownership can be direct or indirect through several companies.

In the United States, the Office of Foreign Assets Control, or OFAC, applies its 50 Percent Rule. An entity owned, directly or indirectly, 50 percent or more in the aggregate by one or more blocked persons is itself treated as blocked, even if it is not separately named on OFAC’s Specially Designated Nationals and Blocked Persons List. Ownership analysis is therefore essential to US screening.

EU sanctions also require firms to consider ownership and control, but the legal tests and consequences depend on the applicable EU measure and national implementation. Control can be relevant even where a numerical ownership threshold is not decisive. Businesses operating across the US and EU need procedures that reflect the specific regimes applicable to them.

What happens after a confirmed match

A true match triggers an escalation under the firm’s sanctions policy and the relevant law. The immediate action may include rejecting a proposed relationship, stopping a payment, freezing funds or other economic resources, or blocking property. The terminology and required action differ by jurisdiction. Under US rules, for example, blocking generally means placing property in a blocked account rather than returning it to the sender.

• Confirm the identity, ownership and transaction facts, and determine which sanctions regime applies.
• Prevent prohibited activity from proceeding and take any required hold, freeze, block or rejection action.
• Report to the relevant authority within the required timeframe, such as OFAC in the United States or the competent national authority in an EU member state.
• Keep records of the alert, investigation, decision, reports and any funds or transactions affected.

A confirmed match does not always mean the same operational response. Licences, exemptions, reporting rules and deadlines vary. Firms should involve qualified sanctions and legal specialists where a case is complex or a restriction may apply.

The link to identity verification

Identity verification, or IDV, supports more accurate sanctions screening by establishing who a customer is before their data is compared with sanctions information. Document checks, biometric verification where appropriate, address validation and company verification can provide reliable identifiers that help analysts distinguish a real match from a namesake. For businesses, verifying corporate registration data and beneficial ownership information is particularly important.

IDV does not replace sanctions screening, and screening does not replace legal analysis. Together, however, reliable identity data, current list data, ownership research and documented human review form the basis of a defensible sanctions control framework. This explainer is general information, not legal advice.