Sanctions Screening

Sanctions screening is checking customers, vendors, and counterparties against government blocked-party lists before you do business with them. In the US, OFAC administers those lists (“restricted and denied parties”), and civil liability is strict: you can be penalized without knowing you dealt with a sanctioned party. It also reaches further than most people expect, because an entity that's 50 percent or more owned by blocked parties, counting their stakes together, is blocked itself, even when it's not named on any list.

What does sanctions screening involve?

Screening runs at three moments: before you onboard a counterparty, before individual transactions where the risk warrants it, and again whenever the lists change. Governments update designations constantly, so a counterparty you cleared last quarter can become a problem without doing anything differently.

The mechanics are matching, not lookup. You compare names, aliases, addresses, dates of birth, vessel and aircraft identifiers, and ownership structures against the lists, then work through the near-matches. Fuzzy matching produces false positives by design, and the job is to clear them with evidence rather than to tune them away.

Which lists do you screen against?

OFAC publishes the Specially Designated Nationals and Blocked Persons List, which covers designated individuals, entities, groups, vessels, and aircraft, plus a Consolidated Sanctions List that packages its non-SDN lists together. Those two are the floor for a US company.

Depending on what you sell and where, screening also reaches Commerce's Entity List, which sits at Supplement No. 4 to 15 CFR Part 744, and parties under denial orders, whose transactions are prohibited under 15 CFR Part 764. If your exposure runs to controlled technology as well as counterparties, screening pairs with export controls, and the same trade risk should show up in your compliance risk assessment.

What is the 50 percent rule?

OFAC's revised guidance of August 13, 2014 states that an entity owned in the aggregate, directly or indirectly, 50 percent or more by one or more blocked persons is itself blocked, whether or not it appears on the SDN List. On the guidance's own example, two blocked persons holding 25 percent each trigger it.

Two details do the damage. First, the rule aggregates. Screening each owner separately and finding none at 50 percent tells you nothing. Second, the guidance addresses ownership rather than control. OFAC says an entity controlled by blocked persons that doesn't meet the 50 percent ownership test isn't automatically blocked, and cautions that it may still be designated. Treat control as a separate risk question. Ownership data is also the hardest data to get, which is why sanctions screening and customer due diligence belong in the same workflow.

What do you do when you get a hit?

Confirm it first. Most alerts are false positives, and clearing them with documented evidence is the routine case. When a hit is real, you stop the transaction and escalate immediately, because the next steps are legal decisions with clocks attached.

The rejected-transaction obligation at 501.604 is the one most write-ups leave out, and it's the one that catches teams who assume declining the business ends the matter. Both obligations run to any US person or person subject to US jurisdiction, including financial institutions, under 31 CFR 501.603(a) and 501.604. Records of transactions subject to the chapter have to stay available for examination for at least 10 years under 31 CFR 501.601.

Who has to screen, and why isn't it only banks?

The reporting duties at 31 CFR 501.603(a) and 501.604 reach any US person or person subject to US jurisdiction, including financial institutions. A software company selling a subscription, a manufacturer paying a freight forwarder, a staffing firm placing a contractor, and a nonprofit wiring a grant carry the same obligations a bank does.

The strict liability standard is what makes that matter. OFAC's FAQ 65 states that OFAC "may impose civil penalties for sanctions violations based on strict liability, meaning that a person subject to U.S. jurisdiction may be held civilly liable even if such person did not have knowledge that it was engaging in a transaction that was prohibited." Two qualifiers travel with that sentence and get dropped constantly. FAQ 65 frames the standard around persons subject to US jurisdiction, and it speaks to civil penalties. The criminal provision of the International Emergency Economic Powers Act at 50 U.S.C. 1705(c) reaches a person who "willfully commits, willfully attempts to commit, or willfully conspires to commit, or aids or abets in the commission of" a prohibited act.

For the people doing the work, that translates into one habit: screen before you transact, and escalate a hit instead of judging it yourself.

FAQ

Does strict liability mean an employee can go to prison for a screening miss?

OFAC's FAQ 65 describes strict liability in the context of civil penalties. The IEEPA criminal provision at 50 U.S.C. 1705(c) applies to a person who acts willfully.

Do we have to screen if we aren't a financial institution?

The reporting duties at 31 CFR 501.603(a) and 501.604 run to any US person or person subject to US jurisdiction, including financial institutions.

If an owner isn't on the SDN List, are we clear?

Not necessarily. Under OFAC's 50 percent rule guidance, an entity can be blocked without ever being named, because the ownership stakes of multiple blocked persons count together.