OFAC Screening Requirements: A Practical Compliance Guide
- Who Must Screen Against OFAC Lists?
- Which Lists and Watchlists Belong in an OFAC Screening Program?
- What Is the OFAC Watchlist?
- Program Codes and the 50 Percent Rule
- Lists Commonly Screened Alongside OFAC
- When Must Screening Happen?
- How Name Matching, Thresholds and Data Quality Work
- Screening Tools: Real-Time, Batch and Manual
- IP Geolocation and VPN Screening for Online Platforms
- OFAC Screening Requirements by Industry
- What to Do When Screening Returns a Match
- Screening Records, Alert Files and Testing
- Penalties When a Screening Gap Leads to a Violation
- Frequently Asked Questions
OFAC screening is the practice of checking customers, counterparties and transactions against the sanctions lists published by the U.S. Treasury’s Office of Foreign Assets Control (OFAC) before you open an account, ship goods or move money. There is no single regulation titled “screening requirements”: the obligation follows from the rule that U.S. persons must not deal with blocked persons and must block or reject prohibited transactions — and liability for civil violations is strict, so if a missed match lets a prohibited transaction through, that is a violation even without intent.
This guide explains who has to screen, which lists and watchlists belong in a screening program, when screening must happen, how name matching and IP geolocation work, what to do with a match and which records OFAC expects you to keep.
Who Must Screen Against OFAC Lists?
OFAC regulations bind U.S. persons: U.S. citizens and permanent residents wherever they are, entities organized under U.S. law and their foreign branches, and anyone physically in the United States. Under the Cuba and Iran programs, foreign entities owned or controlled by U.S. persons are covered as well. For the full definition, see who counts as a U.S. person under OFAC.
Non-U.S. companies are not directly bound by most OFAC prohibitions, but they screen for practical reasons: a payment in U.S. dollars passes through U.S. correspondent banks, which will block or reject it; causing a U.S. person to violate sanctions is itself a violation; and many programs carry secondary sanctions risk for dealings with designated parties. In practice, banks and business partners require screening as a condition of the relationship.
OFAC does not prescribe one screening method. Its Framework for OFAC Compliance Commitments (2019) expects a risk-based program built on five components — management commitment, risk assessment, internal controls, testing and auditing, and training — so the depth of screening should match your customers, products, payment channels and geographic exposure.
Get a free case assessment
Our team handles OFAC and sanctions matters for clients worldwide. We review the applicable sanctions programs, assess your exposure, and prepare an action plan.
Which Lists and Watchlists Belong in an OFAC Screening Program?
What Is the OFAC Watchlist?
“OFAC watchlist” is the informal name for the SDN List and OFAC’s non-SDN lists. It names individuals, companies, vessels and aircraft designated under OFAC sanctions programs — terrorists, narcotics traffickers, proliferators, sanctions evaders and persons tied to sanctioned governments; entries may also list digital currency addresses as identifiers. The core is the Specially Designated Nationals and Blocked Persons (SDN) List — see what the SDN List is and what a listing means. The non-SDN lists are published together as the Consolidated Sanctions List, and each carries a different legal effect, so a hit must be handled according to the list it came from:
| List | What a hit requires you to do |
|---|---|
| SDN List | Block all property and interests in property in the United States or in the possession or control of U.S. persons; no dealings without OFAC authorization |
| Sectoral Sanctions Identifications (SSI) List | No new debt or equity, or other dealings, prohibited by the applicable Russia-related directive; other business is allowed |
| Foreign Sanctions Evaders (FSE) List | No transactions by U.S. persons or within the United States; property is not blocked. The list has been empty since OFAC removed the last name on December 18, 2025, but names can be added at any time |
| Non-SDN Menu-Based Sanctions (NS-MBS) List | Apply the specific non-blocking restrictions stated in the entry |
| CAPTA List | No U.S. correspondent or payable-through account for the institution, or only on OFAC’s strict conditions |
| Non-SDN Chinese Military-Industrial Complex Companies (NS-CMIC) List | No purchase or sale of publicly traded securities of listed companies or securities that give exposure to them, starting 60 days after listing; divestment sales are permitted for 365 days after listing. Property is not blocked, and the list is not the Defense Department’s Section 1260H list |
| Non-SDN Palestinian Legislative Council (NS-PLC) List | U.S. banks may reject transactions with listed PLC members |
For an overview of how these lists fit together, see our guide to the OFAC sanctions lists.
Program Codes and the 50 Percent Rule
Every SDN and non-SDN entry carries a program tag, such as SDGT (Specially Designated Global Terrorists, E.O. 13224) or UKRAINE-EO13662 (Russia-related sectoral sanctions). The tag tells you which regulations and general licenses apply, so record it with every match. Screening the listed names alone is not enough: under OFAC’s 50 Percent Rule, an entity owned 50 percent or more, directly or indirectly and in the aggregate, by blocked persons is blocked even if it does not appear on any list. Ownership structures therefore need to be screened, not just the counterparty’s name. The same 50 percent test applies to the Russia-related directives: an entity owned 50 percent or more by SSI-listed persons is subject to the same directive restrictions.
Lists Commonly Screened Alongside OFAC
- BIS Entity List and other Commerce lists — license requirements for exports, reexports and transfers of items subject to the EAR (often all such items), not asset blocking
- UN Security Council sanctions lists — binding on UN member states; a UN listing may or may not have an OFAC counterpart
- EU Consolidated Financial Sanctions List and the UK Sanctions List (maintained by the FCDO; OFSI’s Consolidated List closed on January 28, 2026) — separate legal regimes that overlap with, but do not mirror, OFAC’s lists
- Politically exposed persons (PEPs) — not a sanctions list; a PEP match calls for enhanced due diligence rather than blocking
A program that covers only OFAC leaves the others open; see how sanctions screening goes beyond OFAC lists.
When Must Screening Happen?
Screening has to happen before the prohibited dealing would occur — once a payment to a blocked person is processed, the violation has already happened. The usual control points:
| Screening event | When | Who and what to screen |
|---|---|---|
| Customer or vendor onboarding | Before the relationship starts | Legal name, aliases, date of birth or incorporation, addresses, ID and registration numbers, beneficial owners |
| Payments and wires | Before funds are released | Originator, beneficiary, intermediary and beneficiary banks, payment text |
| Trade finance and shipping | Before a letter of credit is issued or goods are released | All parties on the documents, vessels (by IMO number), ports and goods |
| Rescreening the customer base | Whenever OFAC updates its lists, and on a risk-based schedule | All active customers, counterparties and their owners |
OFAC publishes changes on no fixed schedule and they take effect when published, so firms that screen against a local copy of the lists should refresh it as soon as an update is released and rescreen existing relationships against new designations. Banks covered by FinCEN’s customer due diligence rule already identify beneficial owners of legal-entity customers; those owners should be screened too.
How Name Matching, Thresholds and Data Quality Work
Names on the lists appear in transliterations, with aliases and in different word orders, so exact-match searches miss real hits. Screening tools use fuzzy matching: “Mohamed” can match “Muhammad”, “Mohammed” or “Mohamad”, and “Global Trade Ltd.” can match “Global Trading Limited”. OFAC’s free Sanctions List Search lets you set a minimum name score with a slider; commercial tools apply the same idea at volume. OFAC does not recommend a specific threshold — a lower setting produces more false positives to review, a higher one risks missing true matches, and the choice should follow your risk assessment and be documented.
Matching is only as good as the data you capture. Full legal names, all known aliases, dates of birth or incorporation, nationality, addresses and identification numbers let analysts tell a listed person from a customer with a similar name. For automated screening, OFAC’s Sanctions List Service provides the SDN and consolidated lists as downloadable data files, including the enhanced XML format with identifiers such as passport numbers, vessel IMO numbers and digital currency addresses. For one-off checks of a person or company, see how to search the OFAC lists step by step.
Screening Tools: Real-Time, Batch and Manual
- Real-time (API) screening checks each customer and payment as it is entered or processed — the norm for banks, payment companies and marketplaces
- Batch screening runs the whole customer or vendor file against the latest lists, usually after each list update
- Manual searches in Sanctions List Search suit occasional checks by small firms, but do not scale and leave weaker audit trails
Whatever the tool, OFAC holds the company — not the vendor — responsible for the result, so test what the tool screens, which lists it loads and how quickly it picks up updates.
IP Geolocation and VPN Screening for Online Platforms
Name screening does not catch a user who logs in from a comprehensively sanctioned jurisdiction under a clean name. OFAC’s Sanctions Compliance Guidance for the Virtual Currency Industry (October 2021) — relevant to any online platform — recommends geolocation tools that identify IP addresses originating in sanctioned jurisdictions and prevent them from accessing services for prohibited activity. It also describes tools that compare IP addresses against known virtual private network (VPN) addresses and flag improbable logins. OFAC’s settlements with BitGo (December 2020), BitPay (February 2021) and Kraken (November 2022) each cited IP address data the company had collected but did not use to block users in sanctioned jurisdictions — see OFAC enforcement information.
- Block or review sign-ups and logins from IP addresses in comprehensively sanctioned jurisdictions
- Flag VPN, proxy and hosting-provider IP ranges and inconsistent signals, such as a billing address abroad but a login from a sanctioned region
- Compare IP data with KYC data (address, phone code, ID document) and escalate mismatches
- After OFAC lists a digital currency address, look back through past transactions for exposure
OFAC Screening Requirements by Industry
The legal standard is the same for every U.S. person, but the control points differ by business model:
- Banks and money services businesses: screening at account opening, on every payment and on payment messages, integrated into the BSA/AML program and reviewed by federal banking examiners (for MSBs, by IRS and state examiners); like every U.S. person, they report blocked property and rejected transactions to OFAC
- Fintech and crypto platforms: real-time screening of users, counterparties and wallet addresses, plus IP geolocation and VPN controls, because users onboard remotely
- E-commerce, SaaS and marketplaces: screening of buyers, sellers and shipping addresses, and blocking of access from comprehensively sanctioned jurisdictions
- Exporters, logistics and shipping: screening of every party on the transaction documents, end users, vessels and ports, together with export-control lists
- Real estate, investment and professional services: screening of buyers, sellers, investors and their beneficial owners before closing or onboarding — see OFAC screening in real estate deals
What to Do When Screening Returns a Match
Stop the transaction and escalate it to staff trained in sanctions review. Compare every identifier you hold — dates of birth, addresses, ID numbers, registration details — with the list entry. A name match alone is not enough to confirm a hit, and nationality or ethnic origin is never a reason to treat someone as a match.
- False positive: record which identifiers you compared and why you cleared the alert, then proceed
- True match: block the property or reject the transaction, depending on the program and the transaction — see when to block and when to reject
- Report: blocked property and rejected transactions must be reported to OFAC within 10 business days — see OFAC reporting requirements
- Unclear match: hold the transaction; if your review cannot resolve it, contact OFAC’s compliance hotline (1-800-540-6322) or sanctions counsel — the review must not delay a required block or the 10-business-day report
- Possible past violation: get legal advice on a voluntary self-disclosure
For a step-by-step response to an alert, including how to challenge a false match, read what to do after an OFAC hit.
Screening Records, Alert Files and Testing
Screening has to be provable. Examiners and OFAC investigators ask for:
- Screening logs showing what was screened, when, against which list version and with what result
- Alert files for every potential match, including cleared false positives and the identifiers that cleared them
- Matching settings — lists loaded, thresholds and the reasons for them — and records of changes
- Testing results showing that screening covers every control point and picks up list updates promptly
Since March 12, 2025 (interim final rule, adopted as final on March 21, 2025), 31 C.F.R. § 501.601 requires records of transactions subject to OFAC regulations to be kept for 10 years, up from five, to match the 10-year statute of limitations for IEEPA and TWEA violations; the same 10-year period applies to Cuba records under § 515.572 (Federal Register, March 21, 2025). Blocked-property records must be kept for as long as the property is blocked and for 10 years after it is unblocked.
Screening is one control within a wider program; for policies, risk assessment, training and governance, see how to build an OFAC compliance program.
Penalties When a Screening Gap Leads to a Violation
Civil liability for OFAC violations is strict: good faith does not prevent a violation, but it affects the penalty. Under IEEPA, civil penalties reach $377,700 per violation or twice the value of the transaction, whichever is greater; willful violations carry criminal fines of up to $1 million and up to 20 years in prison. Cuba-related violations fall under TWEA, which has its own civil and criminal maximums. Under OFAC’s Enforcement Guidelines, the existence and quality of a compliance program, cooperation and remediation are weighed in setting the penalty, and a voluntary self-disclosure is a major mitigating factor. For how penalties are calculated, see OFAC violation penalties.
If you need a screening program reviewed or built, our team works on OFAC compliance programs for banks, fintechs, exporters and online platforms.
Sources: OFAC, Other OFAC Sanctions Lists; A Framework for OFAC Compliance Commitments; OFAC Sanctions List Service; OFAC FAQs on reporting; OFAC guidance for the virtual currency industry; Federal Register, recordkeeping rule.
Frequently Asked Questions
What is the OFAC watchlist?
“OFAC watchlist” is the informal name for the SDN List and OFAC’s non-SDN lists. It names individuals, companies, vessels and aircraft designated under OFAC sanctions programs — terrorists, narcotics traffickers, proliferators, sanctions evaders and persons tied to sanctioned governments — and entries may also list digital currency addresses as identifiers.
Who is required to do OFAC screening?
OFAC regulations bind U.S. persons: U.S. citizens and permanent residents wherever located, U.S.-organized entities and their foreign branches, and anyone in the United States. Foreign entities owned or controlled by U.S. persons are also covered under the Cuba and Iran programs. Non-U.S. companies screen because U.S. banks and partners require it, because causing a U.S. person to violate sanctions is a violation, and because of secondary sanctions risk.
How often should customers be rescreened?
Whenever OFAC updates its lists, at least for new designations, and on a risk-based schedule for the full customer base. Higher-risk customers, products and geographies call for more frequent or continuous rescreening. The schedule should be written into your policies.
Does OFAC require a specific matching threshold or screening software?
No. OFAC does not endorse software or prescribe a threshold. It expects a risk-based program: the matching settings, lists and control points should follow your risk assessment, be documented and be tested regularly.
Are the FSE List and SSI List part of the SDN List?
No. They are separate non-SDN lists with different legal effects, although the same person can appear on more than one list. A name that clears the SDN List still has to be checked against the non-SDN lists, and an SDN match requires blocking, which goes further than any non-SDN restriction.
Does OFAC screening involve detecting VPN use?
Not as a formal list requirement, but OFAC’s 2021 guidance for the virtual currency industry recommends geolocation tools to stop IP addresses in sanctioned jurisdictions and tools that identify VPN IP addresses and improbable logins. Online platforms should treat IP and VPN checks as part of their sanctions controls.
How long must OFAC screening records be kept?
OFAC’s rule covers records of transactions subject to its regulations: 10 years since March 12, 2025, and for blocked property, while it is blocked plus 10 years after unblocking. Screening logs and alert files are not named in the rule, but keeping them for the same period lets you show how each transaction was cleared within the 10-year limitations period.
