Sanctions Screening: Lists, Name Matching and Alerts

Sanctions screening is the check a business runs to make sure it is not dealing with people, companies, or countries under sanctions. It compares customer names, and often payment details, against official lists such as the UN, OFAC, EU, and UK lists. Since spellings drift and many people share a name, good screening depends on fuzzy matching, a sensible threshold, and a clear process for clearing false positives.

What Sanctions Screening Is and Who Must Do It

In general, governments and the UN use sanctions to restrict dealings with terrorists, weapons proliferators, human rights abusers, and hostile regimes. However, a firm that serves a listed party, even by accident, can face heavy fines. So screening is the control that stops that from happening.

Unlike most AML duties, sanctions rules are also usually strict liability. A firm does not need to know or suspect anything to breach them, which is why regulators expect screening to be fast and thorough. Likewise, FATF Recommendations 6 and 7 ask countries to apply targeted financial sanctions “without delay”. In practice, banks, payment firms, crypto exchanges, insurers, and many non-financial businesses must screen. Even so, companies outside finance often screen trading partners to protect their supply chains.

Major Sanctions Lists

First, there is no single global list. Instead, each issuer keeps its own, and they overlap only in part.

List	Issuer	Scope
UN Security Council Consolidated List	The UN	Binding on all UN member states; terrorism, proliferation, and country regimes
Specially Designated Nationals (SDN) List	US Treasury, OFAC	US persons worldwide; often applied by others because of dollar clearing
Consolidated Financial Sanctions List	European Union	All EU persons and firms operating in the EU
UK Sanctions List	UK government, enforced by OFSI	UK persons and firms operating in the UK
National lists	Individual countries	Domestic designations, for example local terrorism lists

Ownership also matters as well as names. Under the OFAC 50 Percent Rule, for instance, a company that blocked parties own at 50% or above, added together, is itself blocked, even with no listing of its own. That is why sanctions checks reach beneficial owners, not just the customer’s own name.

When and How to Screen

Typically, screening happens at three moments, and each catches a different risk.

1. Real-time at onboarding. First, check the customer, and for companies each beneficial owner, before opening the account. Because weak input weakens every check, run it on a verified digital identity, so the name really belongs to the applicant.
2. Re-screening the existing customer base. Lists change often, sometimes daily. So firms re-screen everyone whenever lists update, either in batches or through continuous monitoring.
3. Payment screening. Besides customers, banks and payment firms also screen the parties, banks, and countries named in each transfer before it goes through.

Verihubs watchlist screening supports the first two. It runs real-time name searches at onboarding, bulk searches of up to 1,000 rows per batch when you review existing customers, plus Monitor, which flags profile changes later. Payment screening, however, needs a separate system.

How Name Matching Works

Exact matching, by itself, misses too much. After all, names change across alphabets, people use nicknames and titles, and data entry adds typos. For that reason, screening tools use fuzzy matching that scores how similar two names are.

• Fuzzy logic. Counts the character edits between two spellings, which catches typos and small spelling shifts.
• Transliteration. Handles names written from Arabic, Cyrillic, Chinese, and other scripts, where one name can have many Latin spellings.
• Aliases. Lists often include known alternative names, so the tool checks those too.
• Name order and titles. Removes honorifics and handles reversed or single names, which are common in parts of Asia.

In the end, the result is a similarity score, often shown from 0 to 1. Then the firm sets a threshold: matches above it become alerts, and matches below it pass. In Verihubs, teams can set the minimum similarity anywhere from 0.65 to 1.0, and they can also supply birth date, birthplace, and nationality so the engine ranks hits more precisely.

Worked example: one name, three thresholds

Suppose a listed person appears as “Mohammad Al-Rashid”, and a customer applies as “Mohammed Alrashid”. The scores below are illustrative only.

Customer name	Illustrative score	Alert at 0.95?	Alert at 0.85?	Alert at 0.70?
Mohammad Al-Rashid	1.00	Yes	Yes	Yes
Mohammed Alrashid	0.90	No	Yes	Yes
Muhamad Rasyid	0.74	No	No	Yes
Ahmad Rashidi	0.61	No	No	No

On one hand, a high threshold keeps alert volumes low but can miss a real target spelled a different way. On the other hand, a low one catches more variants, yet it buries analysts in false positives. In practice, firms test thresholds on their own customer data, then layer in extra identifiers like birth year to cut noise without lowering protection.

Alert Workflow: False Positives, True Matches, and Escalation

Above all, every alert needs a decision and a record. The table shows a typical flow.

Stage	What happens	What to record
Triage	Analyst compares name, date of birth, nationality, and other details	Which details matched or differed
False positive	Clear differences prove it is not the listed party	Reason for closure; optional whitelist for future checks
Possible match	Details are unclear, so the analyst asks for more data or escalates	Documents requested, escalation date
True match	Firm blocks or freezes assets and reports to the authority as the law requires	Action taken, report reference, timings

For true matches, speed matters most. For example, many regimes require a freeze without delay and a report within a short deadline. Meanwhile, a separate internal blacklist lets a firm add parties it has chosen not to serve, which Verihubs also supports. Since auditors review closed alerts, every decision should therefore state its reason in plain language.

Setting Up a Sanctions Screening Program

Of course, a screening program needs more than software. Here are the steps most firms follow.

1. Decide which lists apply. Start with the lists your laws require, then add others because of the currencies, partners, or markets you deal with.
2. Define who you screen. Include customers, beneficial owners, directors, and, where relevant, payment parties and vendors.
3. Set and test thresholds. Next, run a sample of real customer names through the tool and adjust until alert volumes and missed hits balance.
4. Write the alert procedure. Then spell out who reviews, how quickly, what evidence closes an alert, and who decides on true matches.
5. Plan re-screening. Also schedule how and when the whole customer base gets checked against list updates.
6. Audit the results. Finally, sample closed alerts regularly to confirm decisions hold up and thresholds still fit.

Meanwhile, document each choice with its reason. For instance, if you skip a list, write down why, because regulators ask that question first.

Common Sanctions Screening Mistakes

• One-off checks. Authorities can designate a customer next month who looked fine at signup.
• Ignoring owners. Checking only the company name misses blocked owners and the 50 percent rule.
• Thresholds set by guesswork. Untested settings either flood the team or miss real hits.
• Weak records. Alerts closed with “not a match” and no reason will not satisfy an auditor.
• Bad input data. Typos and missing birth dates at onboarding make every later check weaker.

Most of these, in fact, share one root cause: screening treated as a one-time gate rather than part of how AML and KYC work together across the whole relationship. Crypto firms face the same issues, as our piece on crypto exchange KYC shows.

Frequently Asked Questions

What is sanctions screening?

Sanctions screening checks customers, their owners, and often payments against official sanctions lists, so a business does not deal with sanctioned people, companies, or countries.

Which sanctions lists should a business check?

Mainly, it depends on where the business operates and which currencies it uses. Common lists include the UN Security Council list, the OFAC SDN list, the EU consolidated list, the UK Sanctions List, and national lists.

How often do customers need re-screening?

Ideally, every time a list changes. For that reason, many firms run continuous monitoring or daily batch re-screening of their whole customer base.

What is a good matching threshold?

Unfortunately, there is no universal number. Firms test thresholds on their own data and combine the score with date of birth and nationality to balance missed hits against false positives.

What happens after a true sanctions match?

The firm must usually block or freeze the assets, stop the transaction, and report to the relevant authority within the legal deadline.

Sanctions Screening Works When Matching and Judgment Meet

Strong sanctions screening checks the right lists at the right moments, reaches owners as well as customers, scores names with tested fuzzy matching, and closes every alert with a clear reason. Software does the heavy lifting. Still, analysts make the calls that matter. So the goal is not zero alerts, but alerts that a trained team can resolve quickly and defend later.

Tuning thresholds or re-screening a back book? Schedule a screening demo with Verihubs using your own sample names.