OFAC Sanctions Screening: A Complete Guide for Fintech Compliance Teams
What the SDN list is, how OFAC screening actually works inside a fintech, where false positives come from, and the 7 mistakes that have cost firms eight-figure settlements since 2023.
If you run a fintech, an MSB, a crypto exchange, a remittance corridor, or any payment surface that touches a US bank — and most do, even indirectly — you are subject to OFAC sanctions enforcement. Not "should consider"; subject. The Treasury's Office of Foreign Assets Control enforces over 30 sanctions programs under strict liability: you do not need to have intended the violation, did not need to know your counterparty was designated, and cannot escape by pleading ignorance of the SDN list.
This guide is the practical version of OFAC compliance — the parts that actually drive enforcement outcomes, separated from the bureaucratic framing. It assumes you have read the OFAC Framework for Compliance Commitments (linked at the bottom); if you have not, do that first.
What OFAC actually does, in one paragraph
OFAC is the financial-sanctions arm of the US Treasury. It maintains the Specially Designated Nationals (SDN) list — the canonical index of individuals, entities, vessels, and aircraft frozen out of the US financial system under presidential authority. It also maintains the Sectoral Sanctions Identifications (SSI) list, the Foreign Sanctions Evaders (FSE) list, the Non-SDN Menu-Based Sanctions (NS-MBS) list, and roughly half a dozen smaller program-specific indexes. When compliance teams say "OFAC screening" they almost always mean SDN screening — but a defensible program covers all of them.
The SDN list, in numbers
As of early 2026, the SDN list contains roughly 12,500 active entries — about 7,800 individuals and 4,700 entities, vessels, and aircraft. The list grows by a net 800–1,200 entries per year and is updated continuously; Treasury publishes the canonical XML at sanctionssearch.ofac.treas.gov with a freshness stamp on every update. Major designation rounds (Russia post-2022, Iran sectoral, drug-trafficking organisations, ransomware affiliates) can add 50–200 names in a single morning.
The screening workflow that actually works
A defensible OFAC program runs three matching layers in sequence. Layer one: exact name and identifier match against the structured fields in the SDN XML (full name, aliases, date of birth, nationality, address, document IDs). Layer two: fuzzy match — Levenshtein distance, transliteration tables, phonetic similarity — to catch transliteration variance ("Mohammed" / "Muhammad" / "Mohammad") and known typo patterns. Layer three: contextual disambiguation — narrow the candidate set by date of birth, nationality, document number, or known business address to eliminate common-name false positives.
The output of these three layers is a candidate set, not a verdict. A human (or an explicitly approved deterministic rule) decides the disposition: clear, escalate, or block. Every disposition is logged with the analyst identity, timestamp, evidence considered, and rationale. That audit trail is the artifact OFAC enforcement asks for during an examination.
The 50% rule — the silent killer
OFAC's 50% Rule (formally OFAC Recent Actions guidance, codified across multiple FAQs) extends sanctions to any entity owned 50% or more, directly or indirectly, by one or more blocked persons — even if the entity itself is not on the SDN list. This is the rule that has produced the largest fintech enforcement actions of the past three years. You can screen a counterparty against the SDN list, get a clean hit, and still be in violation because that counterparty is 60% owned by a designated person you never queried.
Operationally, the 50% rule means that "screen the counterparty" is the minimum, not the standard. The standard is: screen the counterparty, then enumerate UBOs and controlling shareholders, then screen each of them. This is the cascading-DD pattern DueVestor builds into Type C and Type D reports by default.
False positives: where 95% of analyst time goes
A naive name-match screen against the SDN list will produce a false-positive rate north of 90% on common Hispanic, Arabic, and Slavic names. The compliance team's daily reality is not "did we miss a sanction" — it is "we have 400 candidate matches today and 380 are John Doe-equivalents from Iowa." Reducing false positives without raising false negatives is the central challenge.
Four levers cut false positives without sacrificing recall. First: corroborate across lists — a name hit on SDN AND UK OFSI AND EU is HIGH confidence; SDN alone with no other-list hit is MEDIUM and deserves additional context. Second: enforce attribute matching on date of birth or nationality before flagging. Third: build a known-clear list of repeat false positives and re-screen them only on SDN delta updates, not on every transaction. Fourth: use Treasury's own "weak alias" markers — Treasury explicitly tags low-quality aliases that should NOT be the basis for a match.
The seven mistakes that drive enforcement actions
- Stale ingestion — screening against last week's SDN snapshot when Treasury has shipped two updates since.
- Transliteration gaps — no Arabic, Cyrillic, or Chinese normalisation, so screening "Vladimir Putin" against an SDN entry stored as "Путин В.В." returns clean.
- No fuzzy matching on partial-name fields — missing matches when the SDN entry has a middle name the transaction does not.
- No UBO screening — the 50% rule violations described above.
- Forgetting the SSI / FSE / NS-MBS lists — SDN is the famous one, not the only one.
- No audit trail — disposition decisions made verbally or in chat threads that disappear on staff turnover.
- No continuous monitoring — clearing a counterparty at onboarding and never re-screening when SDN updates.
Recent enforcement actions (2024–2026)
Three patterns dominate the OFAC enforcement bulletin since 2024. The first is "sanctions sweep cleanup" — large penalties against payment processors and exchanges that missed Russian-designated counterparties post the February 2022 wave. The second is "crypto rails" — VASPs that processed transactions on behalf of Tornado Cash, Garantex, and other designated mixers. The third is "indirect facilitation" — non-US companies pulled into OFAC jurisdiction because their transactions cleared through correspondent US banks.
Civil monetary penalty maxima are indexed for inflation; the 2024 maximum civil penalty per violation under IEEPA is approximately $356,579, with TWEA-based programs at separate caps. Settlements typically run far higher than the per-violation max because programs aggregate violations across years of transactions.
Automation: where it is necessary, where it is not
Below ~100 onboardings per week and ~500 transactions per day, careful manual screening with a well-organised spreadsheet and a daily SDN diff is plausible. Above that volume, the math stops working: a 95% accurate manual review across 10,000 daily transactions still misses 500 candidates per day, and the false-positive workload exceeds what a small team can dispose of with documented rationale.
Automation is not a substitute for human disposition decisions on flagged matches — every regulator we are aware of treats fully-automated clearing of OFAC matches as a failure mode. Automation is what lets the human spend their time on the 5% of cases that actually need judgment.
“Strict liability applies. OFAC may impose civil penalties for sanctions violations based on strict liability, meaning that a person subject to U.S. jurisdiction may be held civilly liable even if such person did not know or have reason to know it was engaging in a transaction with a person that is prohibited.”
The defensible posture is straightforward: screen continuously against fresh data, document every disposition, escalate ambiguity, and re-screen the back-book on every material list update. The teams that get this right are the ones that treat OFAC as an operating constraint, not a compliance ritual.