Sanctions Screening
Sanctions screening is the checking of customers, counterparties and payment messages against sanctions lists and watchlists — at onboarding, repeatedly afterwards, and on payments while they are still in flight — and the holding or rejecting of anything that genuinely matches.
Also called: watchlist screening · sanctions filtering
Sanctions screening runs in two places. Customer screening compares the names, dates of birth, addresses and identifiers held on file against the lists that apply to the firm, at onboarding and again as those lists change. Payment screening inspects messages in flight, testing not only the two parties but countries, cities, banks, vessels and free-text references that can carry a designated name.
Matching is deliberately fuzzy, because the person being looked for is trying not to be found. Transliteration, name order, abbreviation and common surnames all generate alerts that turn out to be somebody else entirely. An alert is a candidate for investigation and nothing more: the firm decides whether a match is real, while only the sanctions authority decides who is designated. Many firms run politically exposed person lists through the same engine, though a PEP hit and a sanctions hit have entirely different consequences.
What happens to a genuine match depends on the regime. Some require the funds to be blocked, held and reported; others require the payment to be rejected and returned. Which lists apply is a separate question again, driven by where the firm is established, where its customers are, and which currency is being cleared — a dollar payment brings OFAC into scope even between two non-US parties.
In practice
Sanctions screening is not a one-time check at onboarding. Lists change without notice, so existing customers have to be rescreened and payments have to be screened while they can still be stopped.
Example
A payment to “Mohammed Ali” alerts against a designated individual of the same name. Investigation shows a different date of birth and a different country of residence, so the payment is released and the decision written up. Two weeks later a genuine match arrives: same name, matching identifiers. That one is not released — it is held, reported to the sanctions authority, and the customer is told only what the firm is permitted to tell them.
Commonly confused with
| Term | How it differs |
|---|---|
| Transaction Monitoring | Monitoring looks for suspicious patterns in behavior over time; screening looks for a name or identifier on a published list, usually in real time. |
| OFAC | OFAC is one of the authorities whose lists are screened; screening is the process, and most firms run several list sources through it at once. |
See also
- OFACThe Office of Foreign Assets Control is the US Treasury office that administers and enforces US economic sanctions. It writes the programs, designates the people and companies caught by them, publishes the lists that firms screen against, and grants the licenses that permit otherwise prohibited dealings.
- Transaction MonitoringTransaction monitoring is the ongoing review of customer activity — automated rules and models plus human investigation — against what the firm expected that customer to do and against known laundering patterns. Activity that does not fit produces an alert for someone to work.
- Politically Exposed PersonA politically exposed person is someone entrusted with a prominent public function, together with their close family and known associates, who is treated as higher risk because such positions create opportunity for bribery and corruption. The label is a risk classification, not an accusation.
- De-riskingDe-risking is a bank exiting a whole category of customer, such as money services businesses, crypto firms or particular corridors, rather than assessing and pricing each relationship on its own facts. Accounts close because of what the customer is, not what the customer did.