OFAC sanctions screening for vendor payments: lists, fuzzy matches, false positives and the records OFAC weighs

Who must comply, and what strict liability means

OFAC's rules are not limited to banks. OFAC's basic FAQ says: “All U.S. persons must comply with OFAC sanctions, including all U.S. citizens and permanent residents regardless of where they are located, all individuals and entities within the United States, and all U.S. incorporated entities and their foreign branches” (FAQ 11). In the Cuba and Iran programs and some others, foreign subsidiaries owned or controlled by U.S. persons must also comply. A U.S. company paying vendors from a U.S. bank account is squarely covered, and so is its foreign branch paying local suppliers.

The liability standard is what makes vendor screening an accounts payable job rather than a legal afterthought. In its published guidance OFAC explains: “OFAC may impose civil penalties for sanctions violations generally based on a strict liability legal standard. This means that, in many cases, a U.S. person may be held civilly liable for sanctions violations even without having knowledge or reason to know it was engaging in such a violation” (OFAC sanctions compliance guidance brochure, October 2021). The same passage says OFAC still looks at the totality of the facts, and may treat a risk-based compliance program and remedial steps as mitigating factors. In short: not knowing does not prevent a violation, but what you did to find out affects what happens next.

The sanctions screening overview covers the non-OFAC lists (SAM.gov, HHS-OIG, BIS). This page goes deeper on OFAC itself.

Which OFAC lists to screen

OFAC publishes two sets of list data through its Sanctions List Service: the Specially Designated Nationals and Blocked Persons List (SDN List) and the Consolidated (non-SDN) List. The SDN List contains individuals, entities and groups designated by OFAC, plus blocked vessels and aircraft. For the second set, OFAC says that to make compliance easier “all non-SDN sanctions lists are consolidated in a set of separate data files.”

OFAC's own Sanctions List Search returns matches from both the SDN and the Consolidated lists, with a List column showing which one (FAQ 369). Many commercial tools also screen against other agencies' lists; OFAC notes that if an alert is against a list maintained by another agency, you contact that agency, because OFAC gives no guidance on potential matches unrelated to its own sanctions (FAQ 5).

Lists are not the whole of OFAC. Some programs block or prohibit dealings with a whole government or region without naming every person, and some persons are blocked by operation of law. OFAC's FAQ 91 says that some sanctions block categories of persons who do not appear on the SDN List, including most Cuban nationals, blocked foreign governments and entities caught by the 50 percent rule. A vendor whose address or bank is in a comprehensively sanctioned jurisdiction can be a problem with no name hit at all.

What to screen in a vendor record

OFAC does not prescribe the fields, but its guidance points to the data that produces or clears a hit. A vendor master supports more than the payee name:

• Legal name and DBA. The name on the W-9 or W-8 and any trade name the vendor invoices under. SDN entries carry former names and aliases, and a DBA can be the name that matches.
• Owners and signers, where known. OFAC lists improper due diligence on ownership, geographic locations, counterparties and transactions among the root causes of past violations (Framework, root cause VII). It also says U.S. persons may not sign contracts signed by a blocked individual, even for an entity that is not blocked (FAQ 400).
• Addresses. The remit-to and physical address, which supports both the location comparison and the jurisdiction check.
• Bank country and bank identifiers. The Framework lists screening tools that left out identifiers such as SWIFT Business Identifier Codes for sanctioned financial institutions, or that did not account for alternative spellings of sanctioned countries (its examples include Habana for Havana and Kuba for Cuba), as a root cause of violations.
• Identifiers for clearing. Registration numbers, tax IDs and dates of birth for individuals are not scored by OFAC's search tool, but they are what OFAC tells you to compare when you review an alert.

The vendor onboarding checklist and, for freight, the carrier onboarding packet show where these fields are collected.

When to screen

OFAC sets no screening frequency. Asked how often a customer database should be scanned, it answers: “The frequency of running an OFAC scan must be guided by your organization's internal policies and procedures” (FAQ 28), and warns that missing a target can mean a transfer to an SDN, an enforcement action and negative publicity. Nor do list changes follow a calendar: “There is no predetermined timetable, but rather names are added or removed as necessary and appropriate” (FAQ 20). OFAC offers email notifications of list updates (FAQ 86).

For a payer that translates into three points of control, with the frequency written into policy:

• At onboarding, before the first payment, on every field above.
• Before payment, particularly for foreign wires, first payments, and any payment after a change of bank account or remit-to address.
• On list updates, re-screening the active vendor file. The Framework expects a program to adjust rapidly to changes OFAC publishes, including list updates, new programs and general licenses.

Marketplaces and gig platforms paying thousands of sellers or drivers face the same rules at higher volume; see marketplaces and gig platforms. Freight payers paying carriers and brokers abroad are covered under logistics and freight.

Fuzzy matching and how OFAC's tool scores a name

OFAC publishes how its free Sanctions List Search scores a name, which is a useful baseline for judging any commercial tool. Only the name field uses fuzzy logic and only the name influences the score; other fields such as ID numbers use exact character matching (FAQs 246, 251, 252). The method, from FAQ 249: the tool first looks for candidates by the first letter of the search terms and at least 50 percent similarity by edit distance, then scores them. “The two algorithms are Jaro-Winkler, a string difference algorithm, and Soundex, a phonetic algorithm.” It compares the full name string, then splits the name into parts and scores each part and a composite. FAQ 892 adds that a further algorithm was added in the January 2021 upgrade.

A score of 100 means an exact match; lower scores are potential matches (FAQ 247). OFAC will not tell you where to set the slider: “Users of Sanctions List Search must make their own match threshold determinations based upon their own internal risk assessments and established compliance practices” (FAQ 250). Two limits matter for AP teams:

• It is a manual tool. “It should not be utilized by automated systems that are configured to continually run searches through the tool” (FAQ 287). For automated screening OFAC points to its downloadable list files.
• It has no history. Removed names are not in it, and updated entries show only the current version (FAQ 467). If you need to show what the list said on the day you paid, keep your own record of the list version.

OFAC also flags certain broad aliases as weak AKAs because they generate large volumes of false hits (FAQ 122), and FAQ 5 notes your screening tool may exclude them as part of a risk-based decision. If yours does, the policy should say so.

Clearing a potential match, OFAC's six steps

OFAC's FAQ 5, updated September 9, 2026, is the closest thing to an official procedure for an alert. It says organizations should follow their own procedures and recommends these steps:

1. Which list? Decide whether the hit is against an OFAC list or another agency's or vendor's list.
2. What kind of OFAC nexus? A listed name, a sanctioned jurisdiction or government, or an unlisted blocked entity. For anything other than a name match OFAC says to consider escalating before acting.
3. How good is the match? Review the full list entry and compare every detail. OFAC is candid that “Many potential matches identified through screening are false positives,” and that this step may require collecting documents from the party, such as a business's corporate registration. On addresses, OFAC notes that several businesses can share one address, so an exact address match alone may not be enough.
4. Valid match? With an exact match or a close match with several similarities and nothing that disqualifies it, follow your procedures for likely matches and check whether a general or specific license or an exemption applies.
5. Block or reject? Block if a blocked person has an interest; reject if the transaction is prohibited but no blocked person is involved. The mechanics are in blocked or rejected payments and OFAC reporting.
6. Report and keep records. Report a block or reject within 10 business days and keep the records of how you investigated the match.

OFAC will not do the clearing for you: “OFAC does not confirm potential matches or false positives to our sanctions lists” and instead encourages risk-based determinations (FAQ 5). Its older FAQ 48 adds that unless you have an exact match or other information that the hit is a target, it recommends you do not block without discussing the matter with OFAC.

Documentation

FAQ 5 asks organizations to keep “complete, accurate records detailing the steps taken to investigate the potential match and the information relied upon to ultimately determine whether the potential match was valid,” and notes OFAC may request them under 31 CFR 501.602. The general recordkeeping rule in 31 CFR 501.601 now runs 10 years from the transaction (it was five; the change is covered in the reporting guide). For each vendor that means keeping:

• the data screened and the list version or date;
• each alert, the identifiers compared and why it was cleared or escalated;
• who decided, and when;
• the ownership information obtained for higher-risk vendors;
• any block or reject report and its OFAC Reporting System reference.

How a compliance program is weighed

OFAC's Economic Sanctions Enforcement Guidelines (Appendix A to 31 CFR part 501) decide both whether OFAC acts and how much. OFAC's responses run from no action, a request for more information and a cautionary letter, through a Finding of Violation, to a civil monetary penalty or a criminal referral. Eleven General Factors drive the choice: willful or reckless violation; awareness of the conduct; harm to sanctions program objectives; individual characteristics; compliance program; remedial response; cooperation with OFAC; timing relative to the sanctions; other enforcement action; future compliance and deterrence; and other factors case by case.

Factor E is the screening program. It looks at “the existence, nature and adequacy of a Subject Person's risk-based OFAC compliance program at the time of the apparent violation.” The 2019 Framework for OFAC Compliance Commitments says what adequate looks like: each program “should be predicated on and incorporate at least five essential components of compliance,” namely management commitment, risk assessment, internal controls, testing and auditing, and training. It says “OFAC will consider favorably subject persons that had effective SCPs at the time of an apparent violation,” that an effective program can also support mitigation under Factor F (remedial response), and that it can bear on whether a case is treated as egregious.

The Framework's list of root causes reads like an AP audit checklist: no formal program, screening software that was not updated for changes to the SDN List or SSI List, incomplete due diligence on ownership, decentralized compliance and non-standard payment practices. The penalty arithmetic, including the inflation-adjusted maximums and the halving of the base penalty for a voluntary self-disclosure, is set out in the reporting guide.

Questions people ask

Related in this round: the OFAC 50 percent rule for vendors and blocked or rejected payments and OFAC reporting. For foreign payees' tax documentation, see foreign vendors, W-8 and 1042-S.