Sanctions Screening: OFAC, EU, UK, and Global Watchlist Compliance

Sanctions screening is one of the highest-stakes parts of compliance. A business can have a clean customer profile and still violate sanctions if the customer, beneficial owner, counterparty, bank, vessel, product route, or transaction destination is restricted. Sanctions risk also changes quickly because governments update lists, issue general licenses, expand sectoral measures, and change geopolitical priorities.

This guide sits under the KYC and AML Compliance pillar in the Kurums Law department. It explains list coverage, screening timing, false positives, escalation, blocking, ownership rules, data quality, and how sanctions controls connect to customer due diligence and UBO verification.

What is sanctions screening?

Sanctions screening is the process of comparing names, entities, locations, and transaction attributes against sanctions lists and restricted-party data. The goal is to prevent prohibited dealings with designated persons, entities, governments, sectors, vessels, aircraft, banks, or territories.

Screening is not limited to customer names. A payment may involve an originator, beneficiary, intermediary bank, vessel, port, country, invoice party, or crypto wallet. A trade transaction may involve goods, shipping routes, insurers, freight forwarders, and end users. Sanctions compliance must therefore match the business model.

Which sanctions lists matter?

When should screening occur?

Screening should occur at onboarding, periodically, when customer data changes, and at transaction points where the product creates sanctions exposure. Static onboarding screening is not enough because sanctions lists change and customers may begin transacting with risky counterparties later.

A fintech may screen customers at onboarding and payments in real time. A marketplace may screen sellers, payout recipients, and restricted geographies. A trade business may screen buyers, end users, vessels, banks, and shipment routes. A crypto platform may screen customers and wallet addresses. The program should map screening points to actual sanctions risk.

How are false positives resolved?

A false positive occurs when a screened party resembles a listed party but is not actually the listed party. False positives are common because names, transliterations, dates, aliases, and address data overlap. The compliance problem is not the existence of false positives; it is clearing them without a documented rationale.

Match resolution should compare full name, aliases, date of birth, nationality, address, identification number, company registration, ownership, geography, and contextual facts. High-confidence matches require escalation. Low-confidence matches can be cleared if the reason is recorded. Repeat false positives should be whitelisted only under controlled rules.

What is the 50 percent ownership rule?

Some sanctions regimes restrict entities owned 50 percent or more by sanctioned persons, even if the entity itself is not listed. This makes beneficial ownership data essential. Screening only the customer name may miss an entity controlled by a sanctioned owner.

Ownership aggregation is difficult where multiple sanctioned persons hold minority interests. Businesses should integrate sanctions review with beneficial ownership and UBO verification, especially for entities in high-risk jurisdictions, holding-company structures, and opaque ownership chains.

Sanctions screening workflow

Common sanctions screening mistakes

• Screening only customers and not UBOs or counterparties.
• Using outdated list data.
• Clearing matches without evidence.
• Ignoring ownership and control rules.
• Failing to screen transactions or geographies where risk requires it.
• Letting business teams override compliance blocks informally.

How should sanctions screening tools be tuned?

Screening tools must balance sensitivity and usability. If matching is too loose, compliance teams drown in false positives and may clear alerts mechanically. If matching is too strict, the system may miss aliases, transliterations, spelling differences, and partial identifiers. Tuning should consider name quality, language, geography, customer type, list risk, and product risk.

A good tuning process tests historical data, known true matches, false-positive samples, and edge cases. It should document threshold changes, approval, testing results, and expected impact. For high-risk products such as cross-border payments, trade finance, crypto transfers, or high-value goods, the business may need stronger matching than for lower-risk domestic services.

How should sanctions governance work?

Sanctions governance should define list ownership, escalation authority, legal review, transaction holds, customer communication, and reporting duties. Frontline staff should not decide whether to process a likely match. Compliance should have authority to stop activity while the match is reviewed.

The policy should also define how quickly list updates are loaded, who reviews unresolved alerts, when outside counsel is needed, and how blocked or rejected transactions are recorded. Sanctions decisions can be time-sensitive, so the workflow must be clear before a high-risk alert appears.

What records should be retained?

Sanctions records should prove what was screened, when it was screened, which lists were used, what the system found, who reviewed the alert, and why the decision was made. This includes screening inputs, list version, match score, identifiers compared, investigation notes, escalation messages, legal decisions, and any report or license analysis.

Recordkeeping is especially important for cleared alerts. A true match that was incorrectly cleared can look reckless if the file contains only “false positive” with no explanation. Clear notes should identify the differentiating facts, such as date of birth, address, registration number, nationality, or ownership evidence.

Sanctions implementation playbook

A sanctions program should begin with a written risk assessment. Identify products, customer types, transaction flows, currencies, countries, counterparties, delivery channels, and ownership structures that create sanctions exposure. A domestic subscription business has different risk from a trade finance platform, crypto exchange, logistics company, payment processor, or marketplace with global sellers.

Then define screening points. At minimum, screen customers and beneficial owners at onboarding and when lists update. Higher-risk businesses may also need real-time transaction screening, counterparty screening, vessel screening, wallet screening, bank screening, and geography controls. Each screening point should have a system owner and escalation owner.

The program should also define what happens when a potential match appears. Can the transaction continue while under review? Who can release a hold? When is legal consulted? When is a report required? What communication can be sent to the customer? These decisions should be pre-approved because true matches often require fast action.

How should sanctions risk be handled in contracts?

Commercial contracts should support sanctions compliance. Include representations that the counterparty and its owners are not sanctioned, covenants to comply with sanctions laws, rights to request information, suspension rights, termination rights, audit cooperation, and restrictions on resale or diversion where relevant.

These clauses do not replace screening, but they give the business contractual tools when risk changes. If a customer becomes sanctioned, if ownership changes, or if a transaction route becomes prohibited, the company needs the right to stop performance without breaching the contract.

Sanctions audit evidence

Audit evidence should prove both system operation and human decision quality. Keep list update logs, screening inputs, match settings, alert queues, reviewer notes, escalation records, blocked transaction records, legal opinions, and reports to authorities where applicable. For cleared alerts, record the identifiers that distinguished the customer from the listed party.

Periodic quality testing should sample cleared matches and missed-risk scenarios. If reviewers are clearing alerts too quickly or with identical language, the process may need retraining, tuning, or second-level review.

Sanctions metrics and quality controls

Sanctions screening should be measured through alert volume, true-match rate, false-positive rate, clearance time, escalation time, blocked or rejected transactions, list update timeliness, and quality review findings. These metrics show whether the system is effective and whether reviewers can handle the workload.

A high false-positive rate may mean fuzzy matching is too broad, customer data quality is poor, or list coverage is not appropriate for the risk. A low alert rate may look efficient but can also indicate weak matching. Compliance should periodically test the system with known list entries, aliases, transliterations, and ownership scenarios.

Quality review should focus on cleared alerts because that is where hidden risk often sits. Review whether the analyst compared enough identifiers, documented the rationale, escalated close matches, and considered ownership or control. Sanctions testing should be documented and reported to senior management.

What should happen after a sanctions remediation finding?

Sanctions remediation should be treated as urgent because the control failure may involve prohibited activity. If testing finds missed matches, stale lists, weak ownership screening, or undocumented clearances, the business should assess whether any transactions require blocking, reporting, customer review, or legal advice.

The remediation plan should identify root cause: poor data quality, weak matching thresholds, missing list coverage, analyst training gaps, vendor failures, or unclear escalation rules. Each action should have an owner and deadline. For high-risk failures, senior management should receive direct reporting until closure.

Final compliance note

Sanctions compliance should be designed for speed and defensibility. When a likely match appears, the business may need to stop activity immediately, preserve evidence, consult legal counsel, and report or block according to the applicable regime. A slow or improvised workflow can create exposure even when the final decision is correct.

The safest programs make the stop, review, and release process explicit. No one should need to negotiate authority during a live sanctions alert.

Documented authority also protects business teams, because they can point to a pre-approved compliance process rather than making ad hoc commercial judgments under pressure.

That discipline is especially important for payments, crypto, trade, logistics, marketplaces, and any business with fast-moving cross-border counterparties.

For these businesses, sanctions review should be treated as a transaction-control function, not a back-office compliance formality.

Speed, authority, and evidence all matter.

So does documented reviewer training.

Without training, escalation rules decay quickly and alert handling becomes inconsistent across reviewers and business units.

Train reviewers quarterly.

Frequently Asked Questions