What is sanctions screening? Definition, lists and how it works

What is sanctions screening?

Sanctions screening is the process of checking customers, beneficial owners, counterparties and transactions against the sanctions lists published by governments and international bodies, so that a firm does not provide funds, services or economic resources to a designated party. It applies to individuals, companies, vessels, aircraft and, increasingly, cryptocurrency wallet addresses that authorities attach to a designation.

Screening is one of the four kinds of checks regulated entities conduct, alongside PEP screening, adverse media screening and trade-risk screening. It differs from the others in one important way: a PEP or adverse media result usually changes how much scrutiny a customer receives, while a confirmed sanctions match usually ends the conversation. Our comparison of sanctions and PEP screening covers that distinction in detail.

Why is sanctions screening a legal obligation?

Economic sanctions are a foreign policy and national security tool. Governments restrict dealings with named parties to pressure states, disrupt terrorist and proliferation networks, and respond to corruption, cybercrime and human rights abuses. Financial institutions are where those restrictions are enforced in practice, because almost every prohibited dealing needs a payment, an account or a credit line to happen.

Screening became a formal compliance discipline as the legal exposure for getting it wrong grew:

• United States. The Treasury's Office of Foreign Assets Control (OFAC) administers most US sanctions programs under the International Emergency Economic Powers Act (IEEPA). Civil penalties apply on a strict liability basis. For 2025, OFAC set the IEEPA maximum at $377,700 per violation or twice the value of the transaction, whichever is greater. Since April 2024, the statute of limitations for IEEPA violations has been 10 years rather than five, and OFAC's recordkeeping rule was extended to 10 years to match in 2025.
• European Union. Directive (EU) 2024/1226 made the violation and circumvention of EU restrictive measures a criminal offence across member states, with a transposition deadline of May 20, 2025. In July 2025 the European Commission opened infringement proceedings against 18 member states for incomplete transposition.
• United Kingdom. The Sanctions and Anti-Money Laundering Act 2018 is the legal basis for UK sanctions after Brexit. OFSI, part of HM Treasury, enforces financial sanctions and can impose civil penalties on a strict liability basis.
• The global baseline. FATF Recommendations 6 and 7 require countries to implement targeted financial sanctions against terrorism and the financing of proliferation without delay, which is why screening obligations look similar from one jurisdiction to the next.

The practical consequence is that sanctions screening cannot be a review that happens after the fact. It has to run before an account opens, before a payment is released and whenever a list changes.

Who issues sanctions lists?

There is no single global sanctions list. Each authority publishes its own designations under its own legal framework, and a firm screens against the regimes that apply to where it operates, which currencies it moves and who it serves.

The Financial Action Task Force also publishes two jurisdiction lists, commonly called the black list and the grey list. They are not sanctions lists and carry no asset freeze, but they feed customer and country risk ratings. For a deeper treatment of how the regimes differ and what an entry contains, see sanctions lists explained. Trade restrictions sit alongside sanctions: lists such as the US BIS Entity List and the Canada Export Controls List matter whenever goods, especially dual-use goods, are involved.

How does sanctions screening work?

A sanctions screening program has five working parts. Weakness in any one of them shows up as missed matches, unmanageable alert volumes or decisions nobody can explain later.

• Scope: what gets screened. Customers, their directors and beneficial owners, authorized signatories, counterparties, and the originator, beneficiary and intermediary parties named in payments. For trade and shipping, vessels, ports and goods. For crypto, the transfer addresses and the travel-rule counterparty data that accompany them.
• Timing: when screening runs. At onboarding, before each payment is released, whenever a list is updated, and whenever customer data changes. Re-screening the book against list changes is often called delta screening; our guide to screening frequency and ongoing monitoring covers the cadence.
• Matching: how names are compared. Exact matching misses transliterations, reordered names and misspellings, so screening uses fuzzy matching, phonetic comparison and alias tables. Secondary identifiers such as date of birth, nationality, registration number and address separate a true match from a namesake.
• Ownership: who stands behind a name. OFAC's 50 Percent Rule treats an entity owned 50% or more in aggregate by one or more blocked persons as blocked, even if it is not named on a list. The EU and UK apply ownership and control tests of their own. A program that screens only the customer's name misses this exposure entirely; entity resolution is how the structure behind a company gets mapped.
• Disposition: what happens to each alert. An analyst confirms or clears the alert, records the reason and the evidence, and escalates confirmed matches under the firm's policy. The record matters as much as the decision, because an examiner will ask why each alert was closed.

What happens when there is a true match?

The answer depends on the regime and the type of dealing, but the pattern is consistent. The firm stops the activity, freezes any property it holds for the designated party, and reports to the authority that administers the regime. In the United States, a blocked property report or rejected transaction report is due to OFAC within 10 business days. Other regimes set their own reporting routes and timelines, and the firm's procedures should name them for every jurisdiction it operates in.

A designated party is rarely a one-off. When a confirmed match appears, the related exposure usually sits across linked accounts, owners and counterparties, so the investigation has to look past the single alert that raised it.

How do sanctioned parties try to evade screening?

Designated parties know that financial institutions screen names, and they arrange their affairs around it. A screening program is designed against these techniques, not against an honest customer who happens to share a name with a listed person.

• Front companies and ownership splitting. Assets move into companies held by relatives, associates or nominees, or ownership is split so that no single designated person holds 50% or more. Aggregate ownership tests and control assessments exist for exactly this reason.
• Name variation and false identifiers. Alternative transliterations, reordered names, dropped middle names and altered dates of birth defeat exact matching. Alias data and fuzzy matching tuned to the script and naming conventions of the region close much of this gap.
• Stripping payment information. Removing or altering originator or beneficiary details in payment messages hides a designated party from payment screening. Intermediary banks look for missing, inconsistent or generic party data as a signal in its own right.
• Transshipment and third-country trade. Restricted goods, including dual-use items, are routed through intermediary jurisdictions before reaching a sanctioned destination. Trade restriction lists, goods descriptions and end-user checks are the relevant controls.
• Vessel tactics. Ships disable location transponders, transfer cargo ship to ship at sea, change names and flags, and use layered ownership through single-ship companies. Screening vessels by IMO number, rather than name, and screening the owners and managers behind them addresses the most common of these.
• Virtual asset techniques. New wallet addresses cost nothing to create, and funds can pass through mixers, cross-chain bridges and exchanges with weak controls. Address screening catches designated addresses where authorities publish them; identifying the entity that controls a cluster of addresses needs blockchain analytics alongside it.
• Location masking. VPNs and proxy services hide a customer's location in a comprehensively sanctioned jurisdiction. IP, device and geolocation signals at onboarding and login complement list screening.

OFAC's own enforcement actions are a practical reference. Its published penalty notices describe the specific control failure in each case, and many involve one of the techniques above.

How is sanctions screening different from transaction monitoring?

Sanctions screening asks who a party is: whether a customer, owner, counterparty or address appears on a list or is owned or controlled by someone who does. Transaction monitoring asks how a customer behaves over time: whether patterns of activity suggest money laundering, structuring or other financial crime. Screening is a point-in-time prohibition check; monitoring is a behavioral review that can lead to a suspicious transaction report. A complete program runs both, and the two should feed the same case record. Our guide to transaction monitoring vs AML screening sets out where each starts and stops.

What makes a sanctions screening program defensible?

OFAC's 2019 Framework for OFAC Compliance Commitments describes five components it expects to see: management commitment, a risk assessment, internal controls, testing and auditing, and training. Supervisors in other jurisdictions apply similar expectations. In practice, examiners read four things closely:

• A documented rationale for list coverage that ties the regimes screened to the firm's geographies, currencies, products and customer base.
• Matching thresholds that were tested, with evidence that they catch known true matches and that changes were approved and recorded.
• Alert decisions with reasons, so a reviewer years later can see what was compared and why a match was cleared or escalated. With a 10-year US limitations period, that record has to last.
• Control over false positives. The vast majority of alerts in most programs are false positives. When analysts face thousands of near-identical alerts, true matches get missed through fatigue rather than through a gap in the list. See AML screening false positives for the causes and fixes.

How our screening platform handles sanctions screening

Our screening engine checks customers, businesses and payment parties in real time against OFAC, Canada, EU, UK, Australia and APAC sanctions regimes, including comprehensively sanctioned geographies, vessels, ports and restricted securities, plus trade restriction lists such as the US BIS lists and the Canada Export Controls List. Agentic entity resolution collapses duplicate matches into one scored identity with a plain-language reason, and deep-tier ownership mapping applies the 50% Rule to the structure behind a company name. Material decisions stay under human review, and every decision is kept as audit-ready case history. It is designed to deliver a significant reduction in false positives. For the product view, see our sanctions screening software and API.

FAQ