A financial institution's automated screening system flags a payment. The customer's name is identical to a person on OFSI's Consolidated List. The account is frozen, the transaction is rejected, and the customer – a perfectly legitimate business or private individual who has never been designated – faces the immediate practical consequences of a mistaken match. What are the rules? What must the institution do? And what rights does the affected person have?
Mistaken-identity removals under OFSI rules govern the process by which a person incorrectly identified as a designated individual obtains confirmation that they are not subject to UK financial sanctions. OFSI, the Office of Financial Sanctions Implementation of HM Treasury, administers the regime under the Sanctions and Anti-Money Laundering Act 2018 ("SAMLA") and the relevant thematic sanctions regulations. A mistaken-identity case is distinct from a formal delisting challenge: the person was never designated; they were simply confused with someone who was. The distinction controls the route, the evidence required, and the obligations on financial institutions in the interim.
This briefing sets out how OFSI handles mistaken-identity situations, what obligations fall on firms that act on a false match, how the position compares with OFAC and EU practice, and when to involve sanctions counsel.
What is the legal basis for OFSI's mistaken-identity procedure?
OFSI's authority to clarify designation status derives from SAMLA and the relevant thematic sanctions regulations that give effect to UK autonomous and UN-derived designations. The core instrument is the legal framework that prohibits dealing with the funds or economic resources of designated persons. When a firm acts on a match that turns out to be incorrect, it has restricted a non-designated person's assets – a position that creates practical and potentially legal exposure for the firm and ongoing harm for the individual.
OFSI does not operate a formal "mistaken identity" track with a dedicated statutory deadline in the way that some other regimes do. Instead, it handles these cases through its standard licensing and clarification functions, supplemented by direct engagement. Firms and individuals can write to OFSI setting out why the match is incorrect. OFSI will confirm, in writing, whether the named individual is or is not a designated person under the applicable regime.
The distinction between a mistaken-identity case and a genuine designation challenge matters acutely. A person challenging their own designation must use the formal delisting route: petition to HM Treasury with a request for reassessment, or seek judicial review in the UK High Court. A person who was simply misidentified as someone else has a different, and generally shorter, route – but the evidence burden on the applicant remains real.
As of early 2026, OFSI's published guidance confirms that firms have a reporting obligation when they know or suspect that a person they deal with is subject to UK financial sanctions. That reporting duty does not, by itself, prohibit the firm from engaging with OFSI to clarify whether a match is genuine.
How does a mistaken-identity situation arise, and who does it affect?
Mistaken-identity matches arise in three common patterns: a common surname shared with a designated person; a name that is transliterated differently across document sets; and a date of birth, nationality, or passport number that partially overlaps with a listed entry. Each pattern produces a different evidentiary challenge in the resolution process.
The persons most frequently affected are private individuals and smaller businesses whose name-matching characteristics are shared with a designated person on OFSI's Consolidated List. Banks, payment services providers, and virtual-asset service providers (VASPs – firms operating in the crypto and digital-asset sector) encounter these cases regularly. A VASP whose transaction-monitoring system generates a false-positive match faces the same immediate question as a correspondent bank: has the firm's obligation to freeze assets been triggered, or is this a screening error?
The answer depends on whether the firm's screening has correctly distinguished between "reasonable grounds to know or suspect" that a designated person is involved, and a match that, on examination of the underlying data, does not hold. In our cross-border practice, we see firms default to the more cautious position – freezing or rejecting – without first applying the due-diligence step that could resolve the question quickly. That caution is understandable, but it imposes real harm on innocent parties and can itself attract scrutiny if the restriction is maintained without reasonable investigation.
The affected sectors are wide. Trade-finance desks, insurance underwriters, correspondent banking relationships, clearing and settlement operations, and any business with a UK nexus that screens counterparties will encounter false-positive matches. The obligation to act correctly on those matches is not optional.
What are the obligations on a financial institution that has acted on a false match?
Once a firm identifies that a match is likely to be a false positive, three obligations run in parallel: the duty to investigate the match properly, the question of whether an asset-freeze or transaction block was lawfully triggered in the first place, and the duty to report to OFSI where the firm has reasonable grounds to suspect a designated person is involved.
The reporting obligation under SAMLA and the thematic regulations requires firms to tell OFSI promptly when they know or have reasonable grounds to suspect that they hold funds or economic resources belonging to a designated person, or that they have been approached by or on behalf of such a person. A pure false-positive – a case where the firm has investigated and is satisfied the customer is not designated – does not engage the same reporting obligation. But the line between "I need to investigate further" and "I am satisfied this is a false match" is not always obvious at the point of screening. In our experience, firms underestimate how much documentary evidence they need to cross that line safely.
If a firm has already frozen assets or blocked a transaction on the basis of a false match, it faces a secondary question: what steps are needed to unfreeze or release? OFSI does not issue automatic release instructions. The firm will ordinarily need a written confirmation from OFSI that the individual is not on the Consolidated List, or it may seek a specific licence to transact. A specific licence (a case-by-case authorisation to conduct an otherwise prohibited transaction) can be used as an interim measure, but in a genuine mistaken-identity case the better route is confirmation of non-designation rather than a licence that implies the prohibition applies.
Record-keeping is a parallel obligation. Firms must maintain records of their screening decisions, the basis for any freeze or block, the investigation steps taken, and any communications with OFSI. Those records will matter if the firm is later asked to explain its conduct. The obligation to keep adequate records under OFSI's guidance runs for a defined period; practitioners should verify the current requirement under the applicable thematic regulations before relying on any figure here.
What evidence supports a mistaken-identity submission to OFSI?
The strength of a mistaken-identity submission to OFSI turns almost entirely on documentary differentiation: evidence that the person under review is not the same natural or legal person as the designated entry on the Consolidated List.
For a natural person, the core evidence set typically includes official identity documents showing name, date of birth, nationality, and national identity or passport number; evidence of address that differs from the designated person's known addresses; and, where available, biometric or other objective differentiating data. Where names are phonetically or orthographically similar, a statement explaining the source of the confusion – for example, a common family name in a given jurisdiction – assists OFSI in understanding why the match occurred at all.
For a legal person – a company or partnership – the differentiation evidence will include incorporation documents, company registration numbers, registered address, and beneficial-ownership information. Where the company name closely resembles a listed entity, evidence of the company's date of incorporation, its trading history, and the identity of its directors and shareholders (none of whom should be designated persons) forms the basis of the submission.
A critical risk flag: the submission should not inadvertently raise new concerns. If the documentation discloses that a shareholder of the company is connected to a designated person – even if the company itself is not listed – the firm and the applicant may face a distinct ownership-and-control question under OFSI's ownership and control test (the UK test for whether a non-listed entity is caught through a listed person's influence). In our practice, we review the full ownership structure before submitting any mistaken-identity package to ensure the submission does not create a more complex problem than it resolves.
The position above covers the standard case. Your facts – the nature of the match, the type of entity, the thematic sanctions programme in play – change the analysis materially. For an assessment of your exposure, contact Calder & Vance at info@caldervance.com.
How does the OFSI position compare with OFAC and EU practice?
The cross-regime comparison matters for any business that operates across UK, US, and EU jurisdictions – because the same false-positive match may require action under all three regimes simultaneously.
Under OFAC, the US Treasury's Office of Foreign Assets Control, the equivalent mechanism is a request for a delisting or reconsideration submission, or, in a straightforward false-match case, an OFAC advisory opinion or specific licence application. OFAC does not operate a formalised "mistaken identity" track by that name, but in practice the agency will confirm, on request, whether a given person appears on the SDN List (OFAC's list of Specially Designated Nationals and blocked persons). The OFAC regime also has an important feature: the 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked). A firm that has screened only the direct name may still be exposed if the counterparty is an entity owned by a listed person. That is a distinct issue from mistaken identity, but it arises in practice alongside it. For a detailed analysis of the OFAC reconsideration route, see our briefing at OFAC reconsideration explained.
Under EU practice, the Council designations are given effect through specific Council Regulations. The EU framework does not contain a dedicated mistaken-identity removal procedure by statute; the affected person must approach the relevant competent authority (the national authority in the member state where the assets are held) or, in the case of a challenge to the designation itself, bring an annulment action before the EU General Court. A false-match case at the national-authority level can typically be resolved through correspondence, but the evidentiary standards are set at the national level and vary across member states.
The UK regime under OFSI occupies a middle position. It is more centralised than the EU model – OFSI is the single UK competent authority for financial sanctions – and more responsive to direct written engagement than the OFAC model, which routes some queries through a formal licensing mechanism. That said, OFSI operates within SAMLA's framework, which gives it less administrative flexibility in some respects than OFAC's broader statutory base under IEEPA.
A critical operational point: where a match has been flagged under all three regimes, the stricter prohibition governs. A firm cannot rely on an OFSI confirmation of non-designation to clear a transaction that may still be blocked under an OFAC or EU measure. Cross-regime clearance must be obtained separately. This is a common oversight in multi-jurisdiction operations, and it is one of the areas where we regularly advise clients to take a structured, regime-by-regime approach rather than treating one clearance as sufficient.
For cases with an Australian dimension – for example, where the same counterparty name has triggered a match under the Australian Autonomous Sanctions regime administered by DFAT – see our related page on building a delisting evidence package under Australian sanctions.
What are the principal risk flags, and when should a firm involve counsel?
Mistaken-identity cases carry a number of risk points that are not always apparent at the screening stage. The following are the flags we see most frequently.
Delayed investigation. The longer a firm maintains a freeze or block without actively investigating the match, the more difficult its position becomes if the customer or counterparty makes a complaint or seeks compensation. OFSI expects firms to act on a match promptly and proportionately. An unexplained delay in investigating a potential false positive is a compliance risk in its own right.
Inadequate screening logic. Firms that rely solely on name-matching without also comparing dates of birth, nationality, and identifying numbers will generate high false-positive rates. A poorly calibrated screening tool does not reduce a firm's obligation to investigate matches properly – it simply multiplies the number of cases requiring investigation. If you are uncertain whether your screening logic is correctly calibrated, that is a programme-level question requiring review before the next match occurs, not after.
Failure to document the investigation. A firm that unfreezes an asset or releases a transaction without a written record of the investigation steps and the basis for its conclusion is exposed if OFSI later asks how the decision was made. Documentation is the defence.
Ownership structure surprises. As noted above, a submission that resolves the name match may simultaneously reveal that a shareholder of the applicant entity is connected to a designated person. That transforms what began as a mistaken-identity case into an ownership-and-control question requiring a separate analysis.
UN-list interactions. Some UK designations mirror entries on the UN Security Council Consolidated List. A mistaken-identity resolution with OFSI does not automatically resolve the UN-derived dimension. Firms with obligations under UN Security Council resolutions must consider whether a separate confirmation or engagement with the relevant Security Council committee is required.
Parallel enforcement exposure. If the match prompted the firm to submit a suspicious-activity report or other regulatory notification before the investigation was complete, the firm should review whether that report requires supplementing or correcting once the false-positive status is confirmed. Leaving an inaccurate report on the record creates its own risk.
If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com to discuss.
A common misconception: mistaken-identity cases resolve themselves quickly
A persistent assumption among compliance teams is that a mistaken-identity case is administratively simple and will resolve quickly once the relevant identity documents are produced. In a straightforward case involving a common name and clear documentary differentiation, that assumption may prove correct.
However, we regularly advise clients where the case presents complications that extend the timeline significantly. Where the applicant's name is shared with multiple listed entries across different sanctions programmes, each entry requires separate treatment. Where the documentation provided is in a language other than English, certified translations will ordinarily be required. Where the applicant is a legal person with a complex ownership structure in a jurisdiction with limited corporate transparency, assembling the differentiation evidence can itself be a substantial exercise.
OFSI does not publish fixed processing timelines for mistaken-identity queries distinct from its other casework. The actual resolution time depends on the complexity of the submission, the volume of OFSI's current casework, and the completeness of the evidence provided at the outset. An incomplete submission that requires a follow-up round of questions will extend the process by weeks. We have seen cases where a client submitted an inadequate first package and then faced a materially longer wait – and continued disruption to their business – than they would have experienced had the submission been properly prepared from the start.
The lesson is straightforward: prepare the submission fully before filing it. The cost of a well-prepared first submission is almost always lower than the cost of an inadequate one.
Related practices
- Delisting evidence package – Australia – building the evidence file for Australian autonomous-sanctions challenges
- Mistaken-identity removals under OFSI – further analysis – extended regime and procedural detail