A financial institution based in the United Kingdom processes a correspondent payment. The beneficiary's name is a close variant of an entry on OFAC's SDN List (OFAC's list of Specially Designated Nationals and blocked persons). The screening system returns no alert. The funds move. Six weeks later, a secondary review flags the transaction. What happens next – and what should have happened before – is the question that defines an effective name and entity screening programme under OFAC.
Name and entity screening under OFAC is the process of checking counterparties, owners, and transactions against the SDN List, the Consolidated Sanctions List, and other OFAC-administered lists to identify prohibited dealings before they occur. The legal obligation derives from IEEPA and the relevant programme regulations, which prohibit US persons – and in many cases non-US persons – from engaging in transactions with blocked parties. A screening programme that generates false negatives exposes the firm to a civil penalty based on the value of the underlying transaction, and in aggravated cases to criminal referral.
This page explains how effective OFAC name and entity screening works, where programmes commonly fail, how the US regime compares with OFSI and the EU, and how Calder & Vance assists businesses in designing, testing, and defending screening operations. As of August 2026, OFAC's enforcement posture continues to treat screening failures as an aggravating factor in civil penalty calculations.
What does OFAC name and entity screening require?
OFAC name and entity screening requires a business to run counterparties, owners, directors, and transaction parties through the SDN List and any relevant programme lists before executing a transaction, and to block or reject as applicable when a match is confirmed. The obligation is not a best-efforts standard. OFAC treats strict liability as the default for civil violations: the fact that a firm did not know it was transacting with a blocked person does not eliminate liability, though it is a mitigating factor in penalty calculations.
The core lists are the SDN List, the Non-SDN Consolidated Sanctions List (which consolidates several secondary-risk lists), and the Foreign Sanctions Evaders List. Each carries different legal consequences. An SDN match triggers an obligation to block property and report to OFAC within a short statutory window. A match on the Non-SDN lists may trigger rejection rather than blocking, depending on the programme. The distinction matters operationally: a system that treats every alert identically will either over-block legitimate transactions or fail to apply the correct legal consequence.
Screening scope is also broader than many firms assume. OFAC's 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked, in the aggregate across direct and indirect holdings) means that a counterparty with no SDN entry of its own can still be a blocked person. A screening programme limited to list-matching will not detect this. Ownership and control mapping must accompany list-matching to close the gap.
How does the OFAC test compare with OFSI and the EU ownership tests?
The OFAC 50 percent rule is mechanical: if blocked persons own 50 percent or more in the aggregate, the entity is blocked regardless of how it is managed or whether the blocked person exercises any operational role. The UK and EU regimes apply a broader ownership and control test (the test for whether a non-listed entity is caught through a listed person's ownership or influence), which can capture an entity at lower ownership levels if the designated person is found to exercise control in fact.
That divergence creates a practical challenge for any business operating across jurisdictions. A counterparty that passes the OFAC 50 percent threshold may still be caught under OFSI's control analysis. The reverse is also possible: a company majority-owned by a listed person under EU rules may not reach the OFAC threshold if the ownership is fragmented across multiple listed persons who each fall below 50 percent individually – though OFAC's aggregation rule would still capture combined ownership at or above the threshold.
In our cross-border practice, we regularly advise businesses that apply OFAC screening logic to their global counterparty population and assume the result covers their OFSI and EU exposure. It does not. The three regimes use different list sources, different ownership tests, and different blocking-versus-rejection mechanics. A single-system approach calibrated to one regime will generate both false negatives and unnecessary false positives under the others.
The position above covers the standard case. Your facts – the counterparty's structure, the goods or services involved, the jurisdictions of the parties, the currency of the transaction – change the analysis materially.
For an initial assessment of your screening programme's coverage under OFAC and the intersecting regimes, contact Calder & Vance at info@caldervance.com.
What is the decision sequence for handling an OFAC screening alert?
When a screening system generates an alert, the first question is whether the match is a true positive, a false positive, or an inconclusive name variant requiring further investigation. The decision sequence below reflects the standard case; individual programme rules may modify it.
- Triage the alert. Identify which list the alert relates to and what legal consequence applies to a confirmed match. SDN alerts carry blocking obligations; other lists may require rejection or enhanced due diligence only.
- Gather identifying information. Compare the full set of identifiers – date of birth, nationality, address, ID numbers, aliases – against the listed entry. A name match alone is not a confirmed hit.
- Apply the ownership test. If the direct counterparty is not listed, check whether any listed person owns or controls it at or above the relevant threshold. For OFAC, this means mapping the full ownership chain for aggregate holdings reaching 50 percent or more.
- Escalate inconclusive matches. If the analysis does not resolve the alert, escalate to legal counsel before proceeding. The cost of a brief legal review is small relative to a civil penalty based on transaction value.
- Block or reject as required. For a confirmed SDN match, block the property or funds and file the required OFAC report within the applicable reporting window.
- Document the decision. Record the evidence reviewed, the conclusion reached, and the action taken. This record is essential for any future enforcement enquiry or voluntary self-disclosure.
Step six is where many programmes fall short. In our experience, firms invest in the alert-generation phase and under-invest in the resolution and documentation phase. OFAC's enforcement guidance expressly treats record-keeping as a factor in assessing a firm's compliance posture. A well-documented false-positive determination is not just defensible – it is evidence of a functioning programme.
What are the most common screening failures, and how do they arise?
Screening failures cluster around four operational weaknesses: misconfigured fuzzy-matching parameters, incomplete counterparty data, absence of an ownership-mapping layer, and stale list data. Each is addressable, but none is trivial to fix.
Fuzzy-matching misconfiguration is the most frequent technical failure. A threshold set too high misses name variants and transliterations; one set too low floods analysts with unworkable alert volumes, which in turn causes genuine hits to be cleared without adequate review. The right calibration depends on the counterparty population: a financial institution with high-volume retail payments faces a different problem than a manufacturer screening a handful of key suppliers. There is no universal setting.
Incomplete counterparty data is a structural problem. Screening a legal entity name without checking its beneficial owners, directors, and controlling persons defeats the purpose of the exercise. The 50 percent rule operates at the level of the entity's ownership chain, not the entity name in the payment message. A programme that does not collect and screen ownership information cannot comply with OFAC's requirements for entities with opaque structures.
List currency matters more than it may appear. OFAC updates the SDN List frequently, sometimes multiple times in a single day during active designation periods. A programme that refreshes list data weekly will miss designations made in the interim. For high-volume or high-risk counterparty populations, daily refresh cycles are the minimum. For firms whose exposure is concentrated in a particular programme, real-time alerting services are standard practice.
Do you know when your system last received a list update? That answer is one of the first things an OFAC examiner or enforcement investigator will ask.
How does secondary-sanctions risk change the screening obligation?
Secondary-sanctions risk adds a dimension that standard list-matching does not address. Secondary sanctions under certain OFAC programmes can expose non-US persons to penalty or designation if they engage in defined categories of activity with certain foreign persons, even without a direct transaction with a listed person. The exposure does not require a US nexus in the traditional sense.
For a non-US bank or multinational, this means that the screening question is not limited to "is this counterparty on a list?" It extends to: does this transaction fall within a category of activity that a US secondary-sanctions programme reaches? That analysis requires understanding the programme's secondary-sanctions provisions, the relevant designation criteria, and the categories of persons already designated for secondary-sanctions-related activity.
We regularly advise European and Asian financial institutions on this question. The answer is never a simple list-check. It requires mapping the counterparty's activities, identifying the relevant programme, and assessing whether the transaction would meet the criteria for a secondary designation. A compliance programme that does not address secondary-sanctions risk is incomplete for any business with exposure to OFAC programmes that carry such provisions.
The cross-border angle extends further. OFSI and the EU do not replicate US secondary-sanctions provisions in the same form. A transaction that is clean under UK and EU primary-sanctions analysis may still carry significant US secondary-sanctions risk if any of the parties, the currency, or the intermediary banks have US connections. That is a gap we see regularly in the programmes of non-US firms that have calibrated their screening to their domestic regime only.
If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time. Contact Calder & Vance at info@caldervance.com for a confidential review.
What do effective OFAC-compliant screening programmes look like in practice?
An effective OFAC-compliant screening programme addresses five elements: list coverage, counterparty data quality, ownership and control mapping, alert management, and documentation. Each element must be designed and maintained; a programme that functions well in four areas but fails in one remains a liability.
List coverage means not only the SDN List but the full set of lists relevant to the business's counterparty population and transaction types. A correspondent bank will need broader list coverage than a manufacturer screening domestic distributors. The programme design should map the lists to the business's actual risk profile, not apply a generic configuration.
Counterparty data quality is an ongoing discipline, not a one-time collection exercise. Beneficial ownership information becomes stale as corporate structures change. A periodic refresh cycle, triggered by changes in the counterparty relationship or by a defined calendar interval, is standard practice in well-run programmes. For higher-risk counterparties, refresh at each transaction is appropriate.
In a recent matter, a technology distribution business operating across multiple continents discovered, through a routine ownership audit we conducted, that a mid-tier supplier had been acquired by an entity with a beneficial ownership chain reaching a listed person. The SDN match was not against the supplier's trading name. It was two layers up the ownership structure. We mapped the chain, confirmed the 50 percent aggregate threshold was met, and advised on the steps to restructure the supply arrangement lawfully. The matter resolved without an OFAC enforcement action.
Documentation underpins the entire system. OFAC's enforcement guidance consistently treats a well-documented, well-maintained compliance programme as a significant mitigating factor. Where a firm has made a genuine effort to comply and has records to show it, the enforcement outcome is materially different from a firm that cannot produce evidence of its process. We test documentation quality as a core part of every programme review we conduct.
A common misconception: "Our bank screens for us, so we are covered"
The most persistent myth in entity-screening practice is that a business's OFAC obligation is satisfied by its bank's screening. It is not. OFAC's obligations attach to each US person (and to non-US persons within the reach of the relevant programme) independently. A bank's screening protects the bank. It does not discharge the corporate customer's own obligation to screen its counterparties before transacting.
The practical consequence is significant. A business that relies on its payment bank as its sole screening control has no ability to detect a problem before the transaction is initiated. By the time the bank's system flags an alert – or fails to – the business has already committed commercially. The legal exposure attaches at the point of the prohibited dealing, not at the point of payment.
This is an area where we regularly advise businesses that are genuinely surprised to learn the position. Their bank has sophisticated screening. Their compliance team monitors AML alerts. But no one has built and maintained an independent counterparty screening programme calibrated to OFAC's lists, ownership rules, and programme-specific obligations. Building that programme is not optional; it is the baseline for a defensible compliance posture under OFAC.
Related practices
- Name and entity screening under OFSI – UK financial sanctions list-screening, ownership tests, and alert management
- Name and entity screening under SECO – Swiss sanctions screening requirements and cross-regime calibration
- Compliance audit and testing – Australia – programme testing against Australian autonomous sanctions and DFAT requirements