Why AP screens
U.S. persons are prohibited from dealing with parties on the Treasury Department's Office of Foreign Assets Control (OFAC) lists, and the prohibition applies to a payment as much as to a sale. OFAC enforcement is strict liability: it doesn't matter whether you knew. Separately, organizations that receive federal funds or bill federal healthcare programs are barred from contracting with excluded parties, and a company on the Commerce Department's Entity List can't receive controlled items. Each of these is enforced against the paying organization, and each is cheap to check at onboarding and expensive to discover afterward.
Vendor screening is also a fraud control. A vendor whose TIN matches but whose principal is on a sanctions or exclusion list is telling you something about who you're dealing with.
The lists that matter
| List | Maintained by | Who needs it |
|---|---|---|
| Specially Designated Nationals (SDN) | OFAC, U.S. Treasury | Everyone. Payments to SDNs and entities they own 50% or more are prohibited; property must be blocked. |
| Consolidated Sanctions List (non-SDN lists: sectoral sanctions, foreign sanctions evaders, CAPTA, and others) | OFAC | Everyone; restrictions vary by program. |
| SAM.gov exclusions (formerly EPLS) | GSA | Federal contractors, grantees and their subcontractors; anyone paying with federal funds. |
| List of Excluded Individuals/Entities (LEIE) | HHS Office of Inspector General | Healthcare providers and anyone billing Medicare/Medicaid; payments to excluded parties can't be reimbursed. Most states publish their own Medicaid exclusion lists too. |
| Entity List, Denied Persons List, Unverified List | Commerce Department, BIS | Exporters and anyone shipping controlled technology. |
| Politically exposed persons (PEP) | Commercial compilations, not a government list | Financial institutions under BSA/AML rules; optional for most AP teams. |
| UN, EU, UK (OFSI) and other foreign lists | Respective governments | Organizations with operations or subsidiaries in those jurisdictions. |
Vendors advertise list counts (30 lists, 300 lists) but for a U.S. accounts-payable team the non-negotiables are the SDN and Consolidated lists. SAM and LEIE are added by industry. Everything past that is coverage for specific jurisdictions or regulatory regimes, not a general requirement.
When to screen and re-screen
- At onboarding, before the first payment, using the legal name from the W-9 and any DBA, plus principals for higher-risk vendors.
- Before payment for large or unusual payments, if your system supports it; the OFAC lists change several times a month.
- On list updates, re-screen the active vendor master. OFAC publishes changes continually; a monthly re-screen of the whole file is a common standard, weekly for financial institutions.
- On any change to a vendor's name, ownership or country.
Keep the screening result, the list version or date, and the reviewer for every check. That log is what an examiner or auditor asks for.
What to do with a hit
Most hits are false positives: common names, partial matches, transliteration variants. A defensible process is to compare the additional identifiers OFAC publishes (aliases, addresses, dates of birth, nationality, ID numbers) against what you know about the vendor, document the reasoning, and clear or escalate. A hit that survives that comparison is a potential match and the payment stops until compliance or counsel decides. Don't tip off the vendor while that's happening.
For a confirmed SDN match, the payment must be blocked (held in a segregated interest-bearing account) rather than simply not made, and reported. For most non-SDN programs the transaction is rejected (not processed) and reported. The distinction matters for the report you file and for what happens to the funds.
Reporting obligations
Under 31 CFR 501.603 and 501.604, blocked property and rejected transactions must be reported to OFAC within 10 business days, and blocked property is reported again annually by September 30. OFAC provides an online reporting form. Failing to report is itself a violation. Federal contractors that discover an excluded subcontractor generally have notification duties to the contracting officer under the FAR, and healthcare organizations that paid an LEIE-excluded party face repayment and may need to self-disclose to OIG.
Questions people ask
Do I have to screen domestic vendors?
Yes. The SDN list includes U.S. persons and U.S.-based entities, and the 50% rule reaches subsidiaries of listed parties. Screening only foreign vendors misses both.
Is a TIN match enough to skip screening?
No. The IRS and OFAC don't share data. A sanctioned party can have a perfectly valid EIN.
How much of a name has to match?
Screening tools use fuzzy matching and produce a score; you set the threshold. Too tight misses transliterations; too loose buries you in false positives. Most AP programs tune to catch the vendor's legal name and principals with obvious variants, then rely on the identifier comparison to clear the rest.
What about the vendor's owners?
OFAC's 50% rule means an entity owned 50% or more, directly or indirectly, by one or more SDNs is treated as blocked even if it isn't listed. For vendors where you know the ownership, screen the owners. For most small vendors you won't know, and screening the entity and its signatory is the practical standard.