Sanctions screening for payers: the lists, the 50 Percent Rule, and what 295 OFAC enforcement actions show

Who must comply

OFAC’s prohibitions bind U.S. persons: U.S. citizens and permanent residents wherever they are, every person and entity inside the United States, and U.S.-incorporated entities and their foreign branches. In the Cuba and Iran programs they also reach foreign subsidiaries owned or controlled by U.S. persons, and the 2019 Framework lists failure to appreciate that status, “a U.S.-owned or controlled subsidiary (in the Cuba and Iran programs)”, as a recurring root cause of violations (Framework, root cause II). A non-U.S. company is reached too when it causes a U.S. bank to process a payment or exports U.S.-origin goods to a sanctioned destination.

The standard is strict liability. OFAC’s 2021 compliance guidance for the virtual currency industry puts it in general terms: “OFAC may impose civil penalties for sanctions violations generally based on a strict liability legal standard.” (OFAC sanctions compliance guidance brochure, October 2021). Knowledge is not an element of the violation; it is a factor in the penalty. The enforcement record bears this out for payers. Blue Robin (2015) paid $82,260 for importing web development services from an Iranian vendor; Alliance Steel (2021) paid $435,003 after outsourcing engineering work to an Iranian firm for five years by check; IPSA International (2017) paid $259,200 because its U.S. office reviewed, approved and initiated its foreign subsidiaries’ payments to Iranian service providers; Mondo TV (2024) paid $538,000 for wiring animation fees to the Chinese and U.S. accounts named on a North Korean studio’s invoices. None of these companies was a bank. Each was an accounts payable department paying a vendor.

The lists

OFAC publishes the Specially Designated Nationals and Blocked Persons List (SDN List) and, as separate data files, a set of non-SDN lists that it combines into the Consolidated Sanctions List. Its Additional Sanctions Lists page describes each. OFAC’s Sanctions List Search covers both the SDN List and the Consolidated list (FAQ 369), and each non-SDN entry appears there with a program tag such as FSE- or NS- and Non-SDN as the list type. A screening program that loads only the SDN file misses every list below it.

Lists are not the whole of OFAC. The Cuba, Iran, North Korea, Syria (until July 2025) and Crimea programs prohibit dealings with a whole jurisdiction or government, so a vendor with no list hit but an address, bank or IP address in one of them is still a problem. Amazon (2020) was penalized for orders whose address field read “Yalta, Krimea”; Emigrant Bank (2023) for an account whose statements had carried an Iranian address for 26 years.

Beyond OFAC. Organizations that take federal funds also check the SAM.gov exclusions list, healthcare payers check the HHS-OIG List of Excluded Individuals/Entities, and exporters check the Commerce Department’s Entity List and Denied Persons List. Those are different regimes with different consequences (debarment, non-reimbursement, export denial) and are not covered here; for an ordinary U.S. accounts payable team the sanctions non-negotiables are the SDN List and the Consolidated list.

The 50 Percent Rule

The rule is in OFAC’s Revised Guidance on Entities Owned by Persons Whose Property and Interests in Property are Blocked of August 13, 2014, published at 79 FR 47726. The operative wording:

“Persons whose property and interests in property are blocked pursuant to an Executive order or regulations administered by OFAC (blocked persons) are considered to have an interest in all property and interests in property of an entity in which such blocked persons own, whether individually or in the aggregate, directly or indirectly, a 50 percent or greater interest. Consequently, any entity owned in the aggregate, directly or indirectly, 50 percent or more by one or more blocked persons is itself considered to be a blocked person. The property and interests in property of such an entity are blocked regardless of whether the entity itself is listed in the annex to an Executive order or otherwise placed on OFAC’s list of Specially Designated Nationals (“SDNs”).”

It continues: “Accordingly, a U.S. person generally may not engage in any transactions with such an entity” unless OFAC authorizes them. Two more sentences from the same page matter to a payer. On minority stakes: “U.S. persons are advised to act with caution when considering a transaction with a non-blocked entity in which one or more blocked persons has a significant ownership interest that is less than 50 percent or which one or more blocked persons may control by means other than a majority ownership interest.” And on procurement: “a U.S. person may not procure goods, services, or technology from, or engage in transactions with, a blocked person directly or indirectly (including through a third-party intermediary).”

The 2014 revision added aggregation: the holdings of several blocked persons are added together. OFAC’s FAQs 398 to 403 confirm that the rule turns on ownership, not control (FAQ 398), and that indirectly means ownership through one or more entities that are themselves 50 percent or more owned by blocked persons (FAQ 401). The 50 percent rule guide works through the arithmetic with examples.

In the enforcement record the rule is a trap for screening programs that only look up names. 24 of the 295 actions turn on it. Cobham (2018) shipped to a company 51 percent owned by an SDN and its screening tool, which required every word to match, did not return “Almaz Antey” when the user searched “Almaz Antey Telecom”. PURE Insurance (2023) held a 2010 shareholder disclosure naming the blocked owner but never loaded it into its underwriting system. Haas Automation (2025): “For seven of the eight blocked entity customers, Haas failed to conduct sufficient due diligence regarding the blocked entities’ ownership structures”. Microsoft (2023) admitted its screening “did not identify blocked parties not specifically listed on the SDN List, but owned 50 percent or more by SDNs”. Extreme Networks (2026) screened every Russian order under a review policy and never recognized that the end user was majority-owned by a designated missile maker. See all 50 Percent Rule cases in the finder.

The practical consequence for onboarding: collect ownership. For a foreign vendor, a vendor in a higher-risk country, or any vendor above a materiality line, the onboarding form should ask for owners of 25 percent or more (the beneficial ownership threshold most companies already use for banking) and the screening should run the owners as well as the entity.

OFAC’s compliance framework: five components, ten root causes

OFAC’s A Framework for OFAC Compliance Commitments (May 2, 2019) is the document OFAC measures a program against when it decides whether, and how much, to penalize. It says that while programs vary with size and risk, each “should be predicated on and incorporate at least five essential components of compliance: (1) management commitment; (2) risk assessment; (3) internal controls; (4) testing and auditing; and (5) training.” The risk assessment should cover “customers, supply chain, intermediaries, and counter-parties”, which for a payer means the vendor file, the distributors and agents the company sells through, and the parties that pay its invoices.

The appendix, titled “Root Causes of OFAC Sanctions Compliance Program Breakdowns or Deficiencies Based on Assessment of Prior OFAC Administrative Actions”, lists ten. OFAC wrote it from the same enforcement releases this guide draws on; the numbers in the right column are how often each root cause shows up in the 295 actions since Nov. 9, 2009 under this site’s tagging.

Root cause VI is the one aimed at screening tools. The Framework says organizations “failed to update their sanctions screening software to incorporate updates to the SDN List or SSI List, failed to include pertinent identifiers such as SWIFT Business Identifier Codes for designated, blocked, or sanctioned financial institutions, or did not account for alternative spellings of prohibited countries or parties”, with the examples “Habana instead of Havana, Kuba instead of Cuba, Soudan instead of Sudan”. Root cause VII says due diligence should cover the organization’s “customers, supply chain, intermediaries, and counter-parties”, including “their ownership, geographic location(s), counter-parties, and transactions”.

What the enforcement record shows

The dollar totals belong to the banks: a handful of payment-stripping settlements account for most of the $7.87 billion. The case count belongs to everyone else. Reading the 295 releases for what the compliance program actually missed gives this order of failures (an action usually carries more than one):

1. Third-party or vendor payments (152 actions, all of them AP or vendor relevant). The classic fact pattern is a U.S. manufacturer selling through a distributor in the UAE, Turkey, China or Europe that re-exports to Iran, with employees using euphemisms on the paperwork. The second pattern is a blocked party in plain sight on the documents: GE accepted 289 checks over four years from a Cuban SDN as third-party payer; Cartier shipped to a ship-to name and address identical to the SDN entry; IMG Academy signed tuition agreements by name with two Kingpin Act designees; Pegasus Worldwide Logistics emailed the exact address on the SDN entry. Finder: third-party cases.
2. Customer or counterparty due diligence (97). Ownership, end user and country never asked, or asked and not read. 12 of these are post-acquisition cases where the buyer inherited the seller’s customers and did not re-screen them.
3. Facilitation (102). A U.S. parent or U.S. staff approving, pricing, shipping or paying for a foreign affiliate’s sanctioned deal. Cameron International (2021): four U.S. senior managers signed five contracts for a Romanian subsidiary, and the company’s Russia review form never mentioned that U.S.-person involvement could itself be prohibited.
4. Screening that skipped a field (68). The filter existed and did not read the address, the country of origin, the email domain, the bank BIC, the IP address, the owner, or the existing customers after a list update. Deutsche Bank Trust Company Americas (2020) had not loaded an SDN bank’s BIC and its filter was set so that “only a payment with an exact SDN List match would trigger manual review”. MidFirst Bank (2022) believed its vendor rescreened daily; “the vendor only screened MidFirst’s entire existing customer base once a month”. SkyGeek (2024) tried to refund a newly designated supplier “Because its compliance protocol at the time was not to re-screen previously approved parties”.
5. No program at all (82). Still common among mid-sized manufacturers, freight forwarders and service firms.
6. The 50 Percent Rule (24). See above.
7. Alerts cleared wrongly (27). The filter worked and a person, or a rule, undid it. American Express (2022): a high-confidence alert matching name, date of birth and national ID was closed by the analyst doing first review without the required second look. TD Bank (2021): four alerts over four years dismissed because the middle name differed. Banco do Brasil (2015): a customer put on a “Good Guy Exception List” after repeated alerts on the word Isfahan. Bank of America (2026): payments “released automatically due to an ‘alert suppression rule’” that auto-cleared repeats of earlier decisions. Finder: cleared alerts.
8. Name matching false negatives (18). Apple (2019): the tool did not match the upper case “SIS DOO” in its records with the lower case “SIS d.o.o.” on the SDN List. JPMorgan (2018): a vendor system that “failed to identify customer names with hyphens, initials, or additional middle or last names as potential matches”. GE: software “screened only the abbreviation of the SDN’s name”. Finder: matching cases.

Two further patterns are worth a line. Invoice re-dating for SSI entities is its own small category (4 cases): the receivable is new debt and extending it past the Directive’s tenor, even at the customer’s request after a bank has rejected the payment, is the violation. And since 2024 OFAC has pursued what the releases call gatekeepers: a property manager (Gracetown, $7.1 million), a trustee, a venture firm (GVA Capital), a private equity adviser, a consultancy and a school.

What OFAC credits is equally visible. 110 of the 295 actions were voluntarily self-disclosed, and OFAC says so in each release because the disclosure halves the base penalty (see penalties). Nearly every release lists the remediation OFAC counted as mitigating: a new screening tool, rescreening of the whole customer file, ownership checks added at onboarding, training, a named compliance officer. The same list, done before the violation, is the Framework.

Screening in an AP workflow

When to screen

• At onboarding, before the vendor is approved and before the first payment. Every no program and no screening case starts here.
• Before each payment, screening the payee and the beneficiary bank at payment time, and screening a refund or credit as a payment: SkyGeek’s violation was a refund to a supplier designated the same day. Bank changes and remit-to changes are rescreen events.
• On every list update, rescreening the active vendor master. OFAC sets no frequency and publishes changes on no timetable, so the policy has to set the frequency and the tool has to meet it. MidFirst thought daily and got monthly; Banco Popular (2022) took 14 months to find four accounts after an Executive Order blocked the Government of Venezuela, with the employment data already in its files.
• On any change to the vendor’s name, ownership, address or country, and when the company acquires another company’s vendor and customer files.

Which fields

The Framework’s root cause VI and the cases say which fields the filter must read, not just the payee name:

• Name, DBA and aliases, with the matching tolerant of case, punctuation, acronyms, hyphens, initials, word order and transliteration (Apple, JPMorgan, GE, Cobham).
• Address, city and country, including the ship-to and the address on the invoice, with alternative spellings (Krimea, Habana) and embassies in third countries (Amazon).
• Country of origin and territory on distributor agreements and purchase orders; Middle East as a destination is a flag, not an answer.
• Bank name, country and BIC of the beneficiary bank, screened against the SDN and CAPTA entries for financial institutions (Deutsche Bank, Payoneer, Bank of America).
• Owners and signers where collected, screened as parties in their own right (the 50 Percent Rule cases; OFAC’s FAQ 400 adds that a U.S. person may not deal in a contract signed by a blocked individual even for a non-blocked entity).
• Email domain, phone and IP address where the business is online: the SDN entry for Pegasus’s supplier carried the phone and email that the shipping documents also carried; Kraken (2022) checked IP addresses at signup and not at transaction time.

Name scoring and the minimum name score

OFAC publishes how its own Sanctions List Search scores a name, and it is the baseline for judging a commercial tool. Only the name field uses fuzzy logic; the other fields use exact character matching (FAQs 246 and 252), so an ID number must be searched with and without punctuation (FAQ 253). The score “is calculated using two matching logic algorithms: one based upon phonetics, and a second based upon the similarity of the characters in the two strings. The slider bar defaults to a score of 100, which indicates an exact match.” (FAQ 247). The method is Jaro-Winkler for string similarity and Soundex for phonetics, run on the whole name and on each name part, and the tool “returns the higher of the two scores” (FAQ 249). On the threshold: “A value of 100 will return only names that exactly match the characters entered into the name field. A value of 50 will return all names that are deemed to be 50% similar based upon the matching logic of the search tool.” (FAQ 248). And OFAC will not pick the number for you: users “must make their own match threshold determinations based upon their own internal risk assessments and established compliance practices” (FAQ 250).

Two practical points follow. First, a threshold of 100, exact match only, is the setting Deutsche Bank Trust Company Americas was penalized for; a program needs a lower threshold on the name and a documented reason for it, tested against known variants (the Cobham all-word problem, the Apple case problem, the JPMorgan hyphen problem). Second, OFAC’s tool is for individual lookups: it “should not be utilized by automated systems that are configured to continually run searches through the tool” (FAQ 287). Batch screening uses the downloadable list files or a provider that loads them, and the provider’s update lag becomes your rescreen lag.

The OFAC vendor screening guide goes deeper on clearing a potential match, OFAC’s six-step review and the weak alias list.

Handling a match

A match that survives comparison of the identifiers (aliases, addresses, dates of birth, nationality, ID numbers, owners) is a potential match, and the payment stops. From there the rules are mechanical:

• Block or reject. If a blocked person has an interest in the payment (an SDN payee, an entity caught by the 50 Percent Rule, a blocked government) the funds are blocked: held in a segregated, interest-bearing account, not returned and not paid. If the transaction is prohibited but no blocked person has an interest (most non-SDN list hits, a sanctioned-jurisdiction nexus with no blocked party) it is rejected: not processed, funds not taken. The blocked or rejected payment guide covers the mechanics and the forms.
• The 10-day report. 31 CFR 501.603 and 501.604 require a report of blocked property or a rejected transaction within 10 business days of the blocking or rejection, through the OFAC Reporting System. Since June 21, 2019 the rejected transaction report applies to every U.S. person, not only financial institutions (OFAC reporting FAQs). Gracetown (2025) was penalized in part for continuing to receive payments after OFAC itself had mailed it a blocking notification.
• The annual blocked property report. Holders of blocked property file an annual report by September 30 covering property held as of June 30 (31 CFR 501.603(b)(2); OFAC FAQ 50).
• Hotline and licenses, at a high level. OFAC’s Compliance Hotline answers questions about its guidance; it does not confirm or clear matches, and the determination and its record are the company’s. Where a payment is prohibited but the business has a case for it (humanitarian trade, winding down a contract, releasing funds blocked by mistake), the route is a general license if one covers the activity or an application for a specific license through OFAC’s licensing portal; property blocked through mistaken identity can be released with an unblocking report under 501.603(b)(3) and OFAC FAQ 1196. None of these happen inside accounts payable; the AP control is to stop and escalate.
• Do not tip off. The vendor is told the payment is on hold for review, not that it is being reported.

Recordkeeping

31 CFR 501.601 now reads: “every person engaging in any transaction subject to the provisions of this chapter shall keep a full and accurate record of each such transaction engaged in, regardless of whether such transaction is effected pursuant to license or otherwise, and such record shall be available for examination for at least 10 years after the date of such transaction.” Records of blocked property must be kept “for the period of time that such property is blocked and for at least 10 years after the date such property is unblocked.”

The period was five years until an interim final rule at 89 FR 74832 (September 13, 2024), effective March 12, 2025, extended it to ten. The rule explains why: section 3111 of the 21st Century Peace through Strength Act, Public Law 118-50, signed April 24, 2024, “extended from five years to 10 years the statute of limitations for civil and criminal violations” of IEEPA and the Trading with the Enemy Act, and OFAC matched the recordkeeping period to it in 501.601 and in the enforcement guidelines. Enforcement can now reach a vendor payment made a decade ago, and the records that show it was screened have to last as long.

For a payer the record is: the data screened, the list version or date, each alert, the identifiers compared and the reason it was cleared or escalated, who decided and when, the ownership information collected, and any report filed with its OFAC reference. Nodus International Bank (2022) received a Finding of Violation partly because “its systems did not effectively retain such records or communications”.

Penalties and self-disclosure

The arithmetic is in the Economic Sanctions Enforcement Guidelines, Appendix A to 31 CFR part 501. OFAC first decides whether to act at all (no action, a cautionary letter, a Finding of Violation, a civil penalty, or a criminal referral), then, if it is a penalty, whether the case is egregious, giving “substantial weight” to whether the conduct was willful or reckless and whether the company was aware of it. The base penalty then comes from a four-cell matrix:

The statutory maximum under IEEPA, which covers most programs, is the greater of $377,700 or twice the value of the transaction, per violation, at the 2026 inflation adjustment in the appendix; the Trading with the Enemy Act (Cuba) and the Kingpin Act have their own figures. The base amount is then adjusted up or down for the general factors: the compliance program at the time, remediation, cooperation, prior record, and the harm done. That is why the finder shows Alliance Steel paying $435,003 on about $1.45 million of Iranian engineering invoices while Blue Robin paid $82,260 on $205,650 of Iranian web work, and why self-disclosed cases with the same facts settle for roughly half.

A voluntary self-disclosure counts only if OFAC hears it from the company first. The appendix says a disclosure does not qualify where a third party has already reported the conduct to OFAC, “regardless of whether the Subject Person was aware of the third party’s disclosure”; a bank that blocks the payment and files its 10-day report has often beaten the company to it (Danfoss, Cameron and IMG Academy all lost the credit that way). A company that finds a problem has a narrow window in which disclosure is still worth half the base penalty.

A note on the programs in older cases

Two programs that appear often in the record no longer exist. Syria sanctions were revoked by Executive Order 14312 of June 30, 2025, effective July 1, 2025 (certain designations continued under other authorities). The comprehensive Sudan program was revoked by Executive Order 13761 of January 13, 2017, with the effective date moved by Executive Order 13804 to October 12, 2017; a separate Sudan-related program under later Executive Orders targets named persons, not the country. The 30 Syria and 69 Sudan actions in the finder are kept for what they show about how controls failed, not as a statement of current law. Iran and Cuba, the two most cited programs (157 and 83 actions), remain comprehensive; the Russia-related program has grown from sectoral directives into the largest source of new actions since 2022.

Questions people ask