A mid-sized trading company operating across three continents receives a call from its correspondent bank. The bank has frozen an outgoing payment. The reason: the company's name, or a variation of it, appears to match an entry on the SDN List (OFAC's list of Specially Designated Nationals and blocked persons). No formal designation order has been issued. No notice arrived. The funds are simply held, and the business relationship is at risk. This is a mistaken-identity removals matter – and it is more common than most compliance teams expect.
Mistaken-identity removals under OFAC arise when a legitimately operating entity is incorrectly treated as blocked because its name, address, or identifying details are close enough to a listed person to trigger a false positive. The remedy is not a delisting petition – the company was never designated. The route is a direct engagement with OFAC, supported by a precisely constructed identity-differentiation package, to obtain written confirmation that the company is not the listed person. Until that confirmation is secured, the practical effect of the block – frozen payments, severed banking, reputational damage – is identical to a formal designation.
This case comment traces one such matter from the first bank call to written confirmation, identifies the risk flags that determined the strategy, and draws the cross-regime comparisons that any business with multi-jurisdictional exposure must consider before it assumes the problem is limited to OFAC.
How the situation arose: the anatomy of a false positive
A false positive of this severity rarely results from a single data point matching a listed name. More often, several fields coincide: a common surname or trading name, a shared country of incorporation or a similar registered address, and a date of birth or identifier that sits in a plausible range. Screening algorithms assign weighted scores; when enough fields converge, a match is flagged and, under many banks' internal policies, the transaction is paused or the relationship placed under review without any independent legal analysis being conducted first.
In the matter we are describing, the client – a commodity trading firm – shared a surname with its sole proprietor, and that surname was identical to the listed individual's primary alias. The city of registration appeared in the SDN entry as a secondary location. The bank's screening tool returned a high-confidence match. The bank did not notify the client; it simply suspended processing and reported internally. The client learned of the situation only when a supplier chased an overdue payment and the firm checked its correspondence bank account online.
Three features made this matter materially harder than the average false positive. First, the client had not maintained a current, consolidated identity-evidence file. Gathering the documentation required to distinguish it from the listed person took time – time during which the payment freeze remained in place and a second correspondent bank, having received an enquiry from the first, imposed its own hold. Second, the listed person operated in an adjacent commodity sector. The sector overlap gave the banks a plausible reason to treat the match with heightened suspicion. Third, the client had a subsidiary in a jurisdiction whose name transliteration from a local script produced a spelling that was, if anything, closer to the listed alias than the parent entity's own registered name.
The lesson from that third feature is one we see repeatedly in our cross-border practice: transliteration generates false positives that an entity can do nothing about unilaterally. What it can do is document the divergence clearly and in advance.
What is the correct legal route for a mistaken-identity removal?
A mistaken-identity removal is not a delisting. A delisting challenges the legal and factual basis on which a person was placed on the SDN List. A mistaken-identity removal asserts that the wrong person is being treated as blocked – that the entity bearing the reputational and financial burden of the designation is not the designated person at all. OFAC handles both routes, but the procedural framing, the evidence standard, and the timeline differ.
The governing authority is OFAC acting under IEEPA and the relevant thematic sanctions regulations. OFAC's guidance on the reconsideration and removal process recognises the mistaken-identity category explicitly. The applicant does not need to show that the underlying designation is flawed; it needs to show that it is a distinct legal and factual entity from the listed person. That requires affirmative, documentary proof of distinctiveness across as many identifying dimensions as possible: legal name and all known aliases, place and date of incorporation or birth, identifiers such as tax numbers and registration codes, addresses historical and current, nationality and document numbers, and sector-of-business description.
The package is submitted to OFAC's Office of Global Targeting – not to the bank, not to a court, not to a government agency in the client's home jurisdiction. Parallel submissions to those bodies may serve other purposes (restoring a specific banking relationship, for instance) but they do not create the OFAC-level written confirmation that is the ultimate objective. Only OFAC can state, in a formal communication, that the entity in question is not the listed person.
In the matter described here, the submission package ran to several hundred pages. The core legal analysis was brief and disciplined: a structured table of distinguishing facts, each cross-referenced to its supporting document, and a narrative summary of why no identifying field – viewed singly or in combination – supported treating the client as the listed person. Supporting that core were certified translations, notarised corporate records, audited financial statements, correspondence history, and sworn declarations from the proprietor and two directors.
What were the cross-regime complications, and why did they matter?
OFAC's response settled the US position. It did not settle the matter. The client's banking relationships spanned the United Kingdom, the European Union, and one Gulf state. Each regime has its own list, its own test, and its own mechanism for clearing a false positive.
Under OFSI – the UK's Office of Financial Sanctions Implementation – the question of whether a person is a designated person is governed by the relevant thematic sanctions regulations made under the Sanctions and Anti-Money Laundering Act ("SAMLA"). OFSI does not automatically recognise an OFAC mistaken-identity determination. A UK correspondent bank applying OFSI's rules will assess the UK Consolidated List independently. In this matter, the listed person did not appear on the UK list at all, which meant the UK bank's hold was driven entirely by its own risk appetite and the OFAC hit rather than by any UK legal obligation. That distinction changed the conversation: rather than a formal OFSI engagement, the client needed only to provide the UK bank with the OFAC confirmation letter and a short legal opinion confirming no UK list entry. The bank released the hold within a defined period after receiving that package.
The EU position required a separate step. The relevant person appeared on the EU Consolidated List, though under a spelling variant the client had not initially checked. That required a brief submission to the relevant EU member-state competent authority – not to the EU Council directly – confirming the identity distinction. The EU mechanism for this kind of submission differs from OFAC's: there is no single EU-wide mistaken-identity process equivalent to OFAC's. Instead, the authority in the member state where the bank or the transaction sits is the first point of contact. In our cross-border practice, the fragmentation of EU contact points is one of the most operationally demanding features of multi-regime false-positive cases.
The Gulf-state bank resolved its hold on production of the OFAC letter and a local counsel opinion. No equivalent formal process existed in that jurisdiction's regime for mistaken-identity cases at the time. The bank exercised its own discretion.
The divergence between regimes on this seemingly narrow question – is this entity the listed person? – illustrates why a mistaken-identity removal is rarely a single-jurisdiction problem for a business with cross-border operations. A business that secures OFAC confirmation but does not check its exposure under OFSI, the EU lists, and any relevant national list may find that one banking relationship is restored while others remain frozen.
What risk flags should counsel watch for in a mistaken-identity matter?
Three categories of risk flag shape the strategy in a mistaken-identity case, and missing any of them extends the timeline and the reputational exposure significantly.
The first is the sector overlap problem described above. When a legitimately operating entity operates in the same sector as the listed person – commodities, shipping, financial services, technology – banks apply heightened scrutiny even after a mistaken-identity determination begins. Counsel must address this directly in the submission package, not leave it to OFAC to assume the sector coincidence is irrelevant. A concise sector-differentiation narrative, supported by commercial records, belongs in the core of the package.
The second is the aggregation risk arising from associated parties. The 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked) does not apply to a mistaken-identity case in the strict sense – the client is not owned by a blocked person. But if the client has shareholders, directors, or commercial counterparts who share names or identifiers with listed persons, the OFAC submission must address those associations explicitly and pre-emptively. Leaving them unaddressed invites a follow-up query from OFAC that restarts the clock.
The third is the disclosure question. Has the bank filed a suspicious-activity or suspicious-transaction report in connection with the freeze? In most jurisdictions that obligation is triggered by the bank's own analysis and the client has no visibility into it. Counsel cannot direct what the bank has reported, but the legal advice given to the client must account for the possibility. A VSD (voluntary self-disclosure to a regulator) by the client may or may not be appropriate depending on whether any actual sanctions exposure – as opposed to a false positive – is identified during the identity review. The two questions must be kept analytically separate.
When should a business involve counsel – and what should counsel do first?
The answer to "when" is: immediately. Every day that passes after a correspondent bank imposes a hold is a day during which the freeze may spread, a second bank may learn of the first bank's action, and the client's trading relationships may suffer damage that a subsequent OFAC confirmation cannot fully repair. In our experience, clients who wait to see whether the bank resolves the issue internally consistently face a longer total resolution period than those who engage specialist counsel on the first or second day.
What does counsel do first? Not draft the submission. The first task is to confirm the legal position precisely: which lists have been triggered (OFAC, OFSI, EU, and others), whether the listed person actually appears on each of those lists, and whether the bank's hold is legally required or is a discretionary risk decision. These are different facts that drive different strategies.
If the listed person does not appear on the UK or EU list, and the bank's hold is a commercial risk decision rather than a legal obligation, a short legal opinion addressed to the bank may release the specific transaction more quickly than an OFAC submission. The two processes can and should run in parallel, but prioritising incorrectly wastes time that a frozen business does not have.
The second task is to scope the documentation. An identity package built under time pressure is an identity package with gaps. The sooner the document-gathering begins, the better the package. In our experience, the single most common reason for an OFAC follow-up request in a mistaken-identity matter is an incomplete or internally inconsistent record of the client's identifiers across different jurisdictions.
The third task is to consider the medium-term. A mistaken-identity confirmation from OFAC is not a permanent safe harbour for future banking relationships. The listed person remains listed. Name overlaps do not disappear. The client will benefit from a standing identity-differentiation file – maintained, updated, and available for rapid production to any bank that raises the question again. Setting that up is counsel's task once the immediate matter is resolved.
Related practices
- Delisting evidence packages – Australia – building the documentary record for Australian autonomous-sanctions challenges.
- OFAC reconsideration: a practitioner view – how an OFAC reconsideration request is framed and submitted.
- OFAC reconsideration (second matter) – a further case comment on reconsideration strategy and timing.
A common myth: "the bank is responsible for fixing this"
The most persistent misconception we encounter from clients in a mistaken-identity situation is that the correspondent bank is both the cause of the problem and the party responsible for resolving it. Neither is entirely accurate, and acting on that assumption consistently delays resolution.
The bank is a gatekeeper, not an adjudicator. Its legal obligation – in most jurisdictions – is to screen transactions against the applicable sanctions lists and to suspend processing where a match arises. It does not have the authority to determine that a listed person's designation is invalid, nor does it have the authority to override OFAC's SDN List entry. What it can do, in its own discretion, is release a specific transaction once it is satisfied – on the basis of legal opinion and documentation – that its customer is not the listed person and that no legal obligation requires the freeze to continue.
That discretionary step requires the bank to be persuaded, not simply informed. A phone call explaining that "we are not that company" does not persuade a bank whose compliance function is under regulatory scrutiny. A formal legal opinion, a structured identity-differentiation document, and an OFAC confirmation letter together can do so. Producing those materials is the client's burden, not the bank's obligation.
The second part of the myth is that a dispute with the bank – framed as a claim for wrongful refusal of service – is the appropriate remedy. In some jurisdictions such claims are legally cognisable. In our experience, they are almost never the right first step, and pursuing them in parallel with an OFAC engagement creates communications complications that slow the OFAC process. The legal relationship with the bank can be addressed separately, and later, if the commercial consequences warrant it.