Sanctions screening and AML name screening: how matching works
How OFAC sanctions screening and AML name screening work — fuzzy matching, aliases, OFAC’s six steps for reviewing a hit, and what to do when a match is real.
Sanctions screening means checking the names of your customers, their business owners and the other parties to a transaction against government sanctions lists before you deal with them. In the U.S., the core lists come from the Treasury’s Office of Foreign Assets Control (OFAC), and all U.S. persons must comply with OFAC sanctions — not just banks.
AML name screening is the same name-matching step run inside an anti-money laundering (AML) program. The search itself is easy. The hard part is deciding which “hits” are real, because names are spelled, translated and shortened in many ways. This guide explains how matching works, the steps OFAC publishes for reviewing a potential match, and what to do when a match is confirmed.
What is sanctions screening, and who must comply?
OFAC’s sanctions reach further than many businesses expect. Its frequently asked questions (FAQ) page on compliance covers U.S. citizens and permanent residents wherever they are, anyone in the United States, and U.S.-incorporated companies and their foreign branches — so a small online business is covered just as a bank is.
The liability standard is strict. OFAC states that it “may impose civil penalties for sanctions violations based on strict liability,” meaning a person subject to U.S. jurisdiction can be held civilly liable even without knowing a transaction was prohibited.
At the same time, OFAC says its regulations don’t explicitly require any specific screening regime. Instead, A Framework for OFAC Compliance Commitments (May 2019) strongly encourages a risk-based sanctions compliance program built on five parts: management commitment, risk assessment, internal controls, testing and auditing, and training. Sanctions screening — sometimes written “sanction screening” — is the internal control that does the day-to-day work of finding listed names.
What is an OFAC check?
An OFAC check usually means searching a name against OFAC’s lists. The main one is the Specially Designated Nationals and Blocked Persons List (SDN List): property of listed persons within U.S. jurisdiction is blocked, and U.S. persons are generally prohibited from dealing with them.
OFAC also publishes non-SDN lists, combined in its Consolidated Sanctions List — among them the Sectoral Sanctions Identifications List and the Non-SDN Menu-Based Sanctions List, the latter covering sanctions that are “less than full blocking sanctions.” Because each non-SDN list carries its own prohibitions, OFAC’s guidance says a match may call for blocking or rejecting, depending on the regulations.
OFAC’s free Sanctions List Search tool covers both the SDN and Consolidated lists and uses fuzzy logic on the name field. It’s built for individual lookups: OFAC says it shouldn’t be used by automated systems that search continually, and points those users to its downloadable list files.
The 50 Percent Rule for business customers
A company can be blocked without appearing on any list. Under OFAC’s 50 Percent Rule guidance (August 13, 2014), an entity owned 50 percent or more, directly or indirectly, by one or more blocked persons — individually or in the aggregate — is itself blocked. For example, OFAC’s 50 Percent Rule FAQs explain that if two blocked persons each own 25 percent of a company, the company is blocked. The same FAQs say an entity controlled, but not majority-owned, by blocked persons isn’t automatically blocked, though OFAC urges caution. That’s why business verification should record each owner and their ownership percentage, and screen every owner.
How AML name screening matches names
Exact and fuzzy matching
Exact matching flags only names that match character for character. It’s simple, but it misses a listed person whose name is entered with one letter changed. Fuzzy matching scores how similar two names are and flags anything above a threshold you set.
OFAC’s own tool shows how this works. Its fuzzy logic combines character, string and phonetic matching, including the Jaro-Winkler string-difference algorithm and the Soundex phonetic algorithm (OFAC added another algorithm in a 2021 upgrade), and a score of 100 means an exact match. OFAC doesn’t recommend a specific threshold; it says each user should set one based on their own risk assessment. A lower threshold catches more variants but produces more alerts to review.
Spelling variants, transliteration and aliases
Names written in Arabic, Cyrillic or Chinese script can be transliterated into English letters several ways, and people use nicknames, shortened names and former names. OFAC’s framework lists, among the root causes of past violations, screening that did not account for alternative spellings — one of its examples is “Habana” instead of “Havana.”
SDN entries also list aliases, known as AKAs (“also known as”), and OFAC marks some of them as “weak aliases” — broad or generic names that generate many false hits. OFAC says it generally doesn’t expect screening against weak aliases, but they can help confirm whether a hit based on other information is real.
Using other details to cut false positives
A false positive is an alert on a name that belongs to someone else. Common names produce many of them. OFAC notes that a match on only a first or last name, with few other similarities, may not be valid. Comparing the date of birth, nationality, address and identification (ID) numbers from the customer’s documents with the list entry is how you tell them apart — and OFAC treats several matching details, such as a name plus a date of birth, as worth further review.
How to evaluate a potential match
OFAC’s FAQ on assessing name matches (updated September 9, 2026) lays out six steps, which in plain English are:
- Identify the list. Is the alert from an OFAC list, or a list kept by another agency or organization? OFAC doesn’t advise on matches unrelated to its sanctions.
- Identify the link to sanctions. Is it a listed name, or a sanctioned country, region or government? For anything other than a listed name, escalate and check the rules that apply.
- Evaluate the match. Compare every detail in the list entry — names, aliases, dates of birth, ID numbers, nationality, addresses — with what you have. You may need more information from the customer, such as a driver’s license or a company’s registration documents. If you can reasonably decide it’s not a match, you may proceed.
- Handle likely matches. For an exact or close match with several similarities, follow your internal procedures and check whether an OFAC general or specific license, or an exemption, applies.
- Block or reject. Block property when the regulations require it; reject a prohibited transaction when no blocked person is involved.
- Keep records and report. Document your investigation and report any blocking or rejection to OFAC within 10 business days.
OFAC says it does not confirm potential matches or false positives, so the decision — and the record of why you made it — stays with you.
When should name screening be performed?
Screen at onboarding, before transactions and whenever the lists change. The Federal Financial Institutions Examination Council (FFIEC) manual for bank examiners says new accounts should be compared with OFAC lists before opening or shortly after, that existing customers should be checked when the list changes, and that funds transfers should be checked before they’re executed.
The lists change often: OFAC’s Recent Actions page listed sanctions list updates on seven different days in the first half of October 2026 alone. In guidance written for insurers, OFAC warns that screening only when a policy is issued “may expose insurers to sanctions risk” and suggests also screening whenever its lists are updated. It also makes sense to rescreen when your customer’s details change — for example, when a new owner joins a business customer.
What to do with a confirmed match
- Block or reject. OFAC’s chart puts SDN-listed people and companies, blocked governments and 50 Percent Rule entities on the “block” side. OFAC says blocked funds go into a segregated, interest-bearing account at a U.S. federally insured institution.
- Report within 10 business days. Blocked property must be reported within 10 business days of blocking, through the OFAC Reporting System, and holders must file an annual report of blocked property held as of June 30 by September 30. Rejected transactions are also due within 10 business days.
- Keep records for 10 years. OFAC’s rule now requires records of transactions subject to its regulations for at least 10 years, and blocked-property records for 10 years after unblocking. The change took effect March 12, 2025 and was finalized without changes in a rule effective March 21, 2025. Some older guidance, including the FFIEC manual’s OFAC section as of October 16, 2026, still says five years, so check your written procedures.
Bring in your compliance team or counsel as soon as a match is confirmed.
What sanctions screening doesn’t cover
Politically exposed person (PEP) screening and adverse-media screening are different checks. PEP screening looks for people who hold or held prominent public roles; adverse-media screening searches news for negative coverage. Neither tells you whether someone is sanctioned, and sanctions screening doesn’t replace them.
Securely Verify’s AML screening checks every identity verification against the OFAC SDN and non-SDN lists, the United Nations Security Council list, the UK Sanctions List and the European Union consolidated list, refreshed daily, using the name and date of birth read from the ID. It catches transliterations and spelling variants, uses date of birth to cut false positives, and sends possible matches to a reviewer who clears or confirms them with a reason. On the Growth plan and up, customers are re-screened when the lists change, and you can screen any person or business on demand, including through the application programming interface (API). PEP and adverse-media screening are on our roadmap but not available yet.
If you want to try this on your own customers, start a 7-day free trial — 20 verifications, no card required.
Related guides
Sources: FAQ 11: Who must comply with OFAC sanctions? (OFAC, updated August 21, 2024); FAQ 65: How frequently is an insurer expected to screen its databases for OFAC compliance? (OFAC, updated November 13, 2024); FAQ 91: What lists does OFAC maintain? (OFAC, updated August 21, 2024); Assessing OFAC Name Matches (FAQ 5) (OFAC, updated September 9, 2026); How to Search OFAC’s Sanctions Lists (OFAC FAQs, 2013–2021); Weak Aliases (OFAC FAQs, 2011–2015); Sanctions List Search Tool (OFAC, accessed October 16, 2026); Additional Sanctions Lists (OFAC, accessed October 16, 2026); Revised Guidance on Entities Owned by Persons Whose Property and Interests in Property Are Blocked (OFAC, August 13, 2014); Entities Owned by Blocked Persons (50% Rule) (OFAC FAQs, 2014–2020); A Framework for OFAC Compliance Commitments (OFAC, May 2019); Code of Federal Regulations (CFR), 31 CFR 501.601, 501.603 and 501.604 (Electronic Code of Federal Regulations, current as of October 2026); Reporting, Procedures and Penalties, interim final rule (Federal Register, September 13, 2024); Reporting, Procedures and Penalties Regulations, final rule (Federal Register, March 21, 2025); Recent Actions (OFAC, accessed October 16, 2026); Office of Foreign Assets Control — Overview (FFIEC Bank Secrecy Act/Anti-Money Laundering Examination Manual, accessed October 16, 2026). This article is general information, not legal or compliance advice.
