A freight forwarder in Singapore receives an automated rejection from its US correspondent bank. The reason: a beneficial owner's name – a common one across multiple regions – matches an entry on OFAC's SDN List (OFAC's list of Specially Designated Nationals and blocked persons). The correspondent freezes the payment. The forwarder's client is not sanctioned. The match is wrong. What happens next, and who bears the burden of proving it?
Mistaken-identity removals under OFAC rules explained: when a financial institution or counterparty incorrectly identifies a non-listed person as a designated party, the affected person may approach OFAC directly to establish that they are not the SDN List entry in question. OFAC administers this process under IEEPA and the relevant thematic sanctions regulations. No regulatory deadline is codified for a response, but the practical and commercial costs of delay are immediate.
This briefing sets out who administers the process, the legal basis, the key prohibitions and obligations that flow from a mistaken-identity flag, the route to resolution, how the OFAC position compares with OFSI and EU procedures, and the risk flags that signal when specialist counsel is necessary.
Who administers mistaken-identity removals under OFAC, and what is the legal basis?
OFAC – the Office of Foreign Assets Control, a bureau of the US Treasury Department – is the sole authority for administering the SDN List and for ruling on whether a given person is, or is not, an entry on it. OFAC's authority derives principally from IEEPA (the International Emergency Economic Powers Act) and, for certain programmes, from TWEA (the Trading with the Enemy Act). The relevant thematic sanctions regulations implement these powers programme by programme.
A mistaken-identity situation arises when a screened name, identifier, or address closely resembles an SDN entry but belongs to a genuinely distinct person. This is not a delisting – the SDN entry remains. What changes is the relationship between the screening hit and the specific individual or entity before the correspondent, bank, or counterparty. OFAC's guidance encourages affected parties to contact the agency directly to supply identifying information that distinguishes them from the listed person.
The distinction between a mistaken-identity removal and a formal delisting petition matters enormously in practice. A delisting challenges the designation itself – it asserts that the listed person should not be on the list at all. A mistaken-identity removal asserts only that the person presenting the transaction is not the listed person. The legal standard, the evidentiary burden, and the timeline differ sharply between the two routes. In our experience, confusing the two routes at the outset is the single most common error in handling a false-positive enforcement block.
What does OFAC prohibit, and how does a mistaken-identity flag trigger those prohibitions?
OFAC's core prohibition is the freezing of transactions and property in which a blocked person has an interest. A financial institution that receives a payment instruction involving what it believes to be an SDN is obliged to block the transaction – it has no discretion once a match is reasonably identified. That obligation falls on US persons and, through the extraterritorial reach of certain programmes, on non-US persons dealing in US dollars or involving US nexus.
This is the practical mechanism by which a mistaken-identity situation creates immediate commercial harm. The correspondent bank is not acting wrongly when it blocks the payment: it is complying with its own OFAC obligations. The harm to the non-listed person is a by-product of that compliance, not a sanctions violation. That distinction shapes the remedy – the non-listed person's recourse is administrative clarification, not a sanctions challenge.
What should a business or individual do in the immediate term? First, do not attempt to restructure the transaction to avoid the block. Any restructuring designed to work around a compliance hold – even where the underlying party is genuinely not sanctioned – can itself attract regulatory scrutiny. The correct route is transparent engagement: supply identifying information directly to OFAC and, in parallel, to the institution that applied the block.
A secondary prohibition risk also applies. Under certain programmes, a non-US person that causes a US person to violate OFAC rules may itself be exposed. Where the mistaken identity arises from poor documentation – for example, where a beneficial owner's identification data is incomplete or inconsistent across records – that gap can make it harder to resolve the block and, in an enforcement context, harder to demonstrate that the underlying relationship was clean.
How does the resolution process work in practice?
Resolution follows a defined administrative sequence, though no statutory deadline binds OFAC to respond within a fixed number of days. The sequence in our practice runs as follows.
- Gather distinguishing identification. Collect every piece of identifying data that differentiates the affected person from the SDN entry: full legal name, all name variants and transliterations, date of birth, nationality, passport numbers, national identification numbers, place of birth, and current and historical addresses. Cross-check each item against the SDN entry's identifiers as published.
- Submit directly to OFAC. Contact OFAC's Compliance Programs division, providing the gathered identification data and a clear statement of the request – not a delisting petition, but a clarification that the person is not the SDN entry. The submission should be in writing and should identify the specific SDN entry causing the block by its OFAC-assigned identifiers.
- Notify the blocking institution in parallel. Provide the same identification package to the correspondent bank or other institution that applied the block. Institutions are generally willing to accept a contemporaneous OFAC response as the basis for releasing the hold, but they may also act on robust identifying documentation before OFAC responds formally.
- Follow up systematically. OFAC responses on mistaken-identity matters vary in timing. Maintain a log of all submissions, acknowledgements, and responses. If the commercial pressure is acute – for example, a time-critical trade-finance payment – that urgency can and should be communicated to OFAC explicitly.
- Obtain a written clearance or non-action statement. A written confirmation from OFAC that the affected person is not the SDN entry provides the clearest basis for the institution to release the block and for the person to operate without repeated disruption.
The process sounds administratively straightforward. In practice, it is not. OFAC's workload is substantial, and mistaken-identity queries sit alongside licensing applications, enforcement matters, and sanctions-policy work. Delays of weeks to months are not unusual. For a business with ongoing transaction flow, repeated false-positive matches against the same SDN entry – because the root cause (incomplete or inconsistent identification data) has not been addressed – are the norm rather than the exception until the matter is resolved definitively.
The position above covers the standard case. Your facts – the specific SDN entry, the identification data available, the institution applying the block, and the urgency of the commercial timeline – change the analysis. For a confidential review of your situation, contact Calder & Vance at info@caldervance.com.
How does the OFAC process compare with OFSI and EU mistaken-identity procedures?
The cross-border dimension matters here. A multinational facing a dollar-payment block by a US correspondent may simultaneously face a parallel hold by a European correspondent acting under EU sanctions regulations, or by a UK institution acting under OFSI's regime. The resolution routes diverge in ways that create real operational complexity.
Under OFSI – the Office of Financial Sanctions Implementation, which administers UK financial sanctions under SAMLA (the Sanctions and Anti-Money Laundering Act) – the conceptual equivalent of a mistaken-identity request is a direct query to OFSI with supporting identification. OFSI's published guidance describes a process for affected persons to establish that they are not the listed person. The evidentiary standard is similar: supply documentation that clearly differentiates you from the listed entry. However, OFSI also has a licensing function that OFAC parallels, and the interaction between a mistaken-identity query and any licensing route is managed differently under the two regimes. A detailed comparison of the OFSI approach is set out in our briefing at Mistaken-identity removals under OFSI: scope and obligations and in the related analysis at Mistaken-identity removals under OFSI: further guidance.
Under the EU regime, the relevant Council regulations designate persons by name, with associated identifiers. An EU-based institution that matches a payment instruction to a Council list entry is obliged to freeze the funds. The EU does not operate a formal mistaken-identity clearance procedure in the same administrative sense as OFAC. In practice, EU-based institutions rely on the quality of the identifier data published on the Council list and, where a clear mismatch of date of birth, nationality, or other identifier is apparent, they may apply their own internal resolution process rather than waiting for a regulatory clearance. For more complex cases, engaging with the relevant national competent authority – the body responsible in each member state for implementing the sanctions regulations – is the more structured route.
The practical cross-border lesson is this: resolving a mistaken-identity block at OFAC does not automatically resolve a parallel block at OFSI or in an EU jurisdiction. Each regime operates independently, and a written OFAC clearance carries no legal weight in a UK or EU enforcement context. For a business with multi-currency payment flow, the resolution strategy must address each relevant regime on its own terms, and the documentation gathered for one submission should be structured with the other regimes in mind from the outset.
A secondary-sanctions dimension adds a further layer for non-US businesses. Under certain OFAC programmes, non-US financial institutions that process transactions on behalf of SDN-adjacent parties – even where those parties are ultimately not listed – may find themselves subject to OFAC scrutiny if their due-diligence steps are inadequate. The obligation to maintain and produce clean, consistent identification data across all jurisdictions is not merely an administrative convenience; it is a risk-management imperative.
What are the common risk flags, and when does a mistaken-identity situation escalate?
Not every mistaken-identity situation resolves cleanly through an administrative submission. Certain features of the facts substantially increase the risk of escalation, either because they complicate the resolution at OFAC or because they trigger parallel obligations under other regimes.
The most common risk flags we see in practice are as follows.
- Incomplete or inconsistent identification data. Where the affected person's name, date of birth, or nationality is recorded differently across passports, corporate filings, and bank accounts, the differentiation from the SDN entry becomes harder to establish. OFAC compares identifiers; inconsistency within the affected person's own records undermines the submission.
- Common names in high-risk regions. A name that appears frequently in a region associated with multiple SDN entries creates a more complex matching problem. The affected person may share name characteristics with several SDN entries simultaneously, requiring a more detailed differentiating submission.
- Beneficial-ownership gaps. Where the affected person is a legal entity rather than an individual, and where its beneficial-ownership chain has not been fully documented, a screening system may flag the entity on account of a shareholder whose name resembles an SDN. Resolving the entity-level block requires establishing the full ownership structure and demonstrating that none of the owners is the SDN entry in question. This is not a straightforward submission.
- Repeated blocks at multiple institutions. Where the same person or entity is repeatedly blocked at different financial institutions – reflecting the same underlying SDN match – each institution must be addressed separately. OFAC clearance assists, but until the root cause (the data gap) is resolved, the blocks recur.
- Time pressure combined with poor documentation. A payment block on a time-critical trade-finance instrument creates pressure to resolve quickly. Where the documentation is thin, that pressure can lead affected parties to submit incomplete material to OFAC, which slows rather than accelerates resolution.
- Concurrent OFSI or EU exposure. As noted above, a multi-regime block requires a co-ordinated strategy. Resolving one without addressing the others leaves the underlying commercial problem in place.
A situation escalates when the affected person's identification documentation is genuinely inadequate to differentiate from the SDN entry, when the block extends to multiple institutions and multiple regimes simultaneously, or when the commercial pressure of the hold creates a risk that poorly advised parties will take steps that could be read as circumvention. At any of those points, specialist counsel becomes necessary rather than optional. Is the documentation your business holds for its principals and beneficial owners sufficient to pass a detailed OFAC differentiating analysis? That question is worth answering before a block occurs.
If a transaction has already been flagged, or a resolution submission has received no response for a material period, an early review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com for a confidential assessment.
What underlying obligations does a mistaken-identity situation reveal about ongoing compliance?
A mistaken-identity block is frequently a symptom of a compliance gap that predates the block itself. In our cross-border practice, we regularly advise businesses that discover – only when a payment is frozen – that their beneficial-owner identification records are inconsistent, their screening logic flags only direct SDN matches and misses name-variant matching, or their customer-due-diligence files lack the document quality needed to resolve a regulatory query rapidly.
OFAC's sanctions compliance programme guidance – which addresses the five core elements of an effective compliance structure: management commitment, risk assessment, internal controls, testing and auditing, and training – makes clear that de-risking (a financial institution exiting a relationship to avoid sanctions exposure) is not a substitute for a well-designed compliance programme. For the non-financial business, the parallel obligation is to maintain identification data in a form that will survive regulatory scrutiny. That means holding, and regularly updating, primary identification documents for all principals; maintaining consistent records across jurisdictions; and ensuring that screening is run not only on the counterparty's legal name but on its known name variants, aliases, and transliterations.
Record-keeping under OFAC's rules requires that documentation supporting any transaction – including any analysis that a counterparty is not a blocked person – be retained for a defined period, as specified in the relevant thematic regulations. The precise duration varies by programme; verify the current requirement for the specific programme before relying on any single figure. The practical point is that the documentation used to resolve a mistaken-identity block should be preserved with the same rigour as any other compliance record, because it may be needed again if the same issue recurs.
We have acted for manufacturers, trading houses, and payment businesses that faced repeated blocks arising from the same underlying data gap. In each case, the lasting solution was not merely obtaining OFAC clearance on one transaction but redesigning the onboarding and identification process so that the differentiating data was available and current before any future screening hit occurred. The clearance resolves today's block; the process improvement prevents tomorrow's.
A common misconception: OFAC clearance is not a licence, and it does not authorise the underlying transaction
A persistent myth in this area is that obtaining OFAC confirmation that a person is not the SDN entry implicitly authorises the underlying transaction. It does not. OFAC's mistaken-identity process addresses solely the question of identity. It does not constitute a review of whether the underlying transaction is otherwise permitted under the applicable sanctions programme.
This matters because the affected person's counterparty, or another party in the transaction chain, may itself be subject to sanctions – not through the mistaken-identity match but through a separate designation or through ownership and control (the UK and EU test for whether a non-listed entity is caught through a listed person; OFAC applies its own 50 percent test in the same vein) rules. A business that focuses entirely on resolving the identity mismatch and neglects to screen the full transaction chain for independent sanctions risk may clear one obstacle only to trip over another.
The same logic applies to export controls. A transaction that is cleared of a sanctions identity issue may still be subject to licensing requirements under the EAR (the Export Administration Regulations administered by BIS – the Bureau of Industry and Security) if the goods, technology, or software involved are subject to export-control classification. Clearing an OFAC identity block and clearing an EAR licence requirement are distinct steps, and neither substitutes for the other. Our briefing on building a complete evidence package in related proceedings is available at Delisting evidence package: Australia service.
The related myth is that a mistaken-identity removal is quick and low-cost if the facts are clear. This underestimates OFAC's workload and the time required to gather, verify, and present differentiating identification data in a form OFAC will act on promptly. Even in straightforward cases, the process requires careful preparation. In cases with documentation gaps, concurrent multi-regime blocks, or time pressure, the effort and elapsed time are substantially greater.
Related practices
- Delisting evidence package – Australia – building the evidence package for sanctions removal in the Australian regime
- Mistaken-identity removals under OFSI explained – how OFSI handles identity disputes and the comparison with OFAC