Sanctions screening program
sanctions-screening-programDomain: trade-sanctionsType: mixedDescription
A working sanctions-screening program operates a screening engine, a false-positive review queue, an escalation path for confirmed hits, and an audit log, against a constantly-updating set of restricted-party lists. The lists themselves layer rather than substitute: the OFAC Specially Designated Nationals list, the UK OFSI Consolidated List, the EU consolidated financial sanctions list, the UN Security Council list, and a growing inventory of country-specific and sectoral programs (the Russia sectoral lists, the Iran-related secondary-sanctions exposure, the OFAC 50% rule on majority-owned entities, the various dual-use end-user controls under EAR Part 744). Operators commonly screen against an aggregator product that consolidates the lists rather than maintaining direct list integrations per regime. Screening happens at three points. Onboarding catches the customer or counterparty entering the platform. Transaction screening catches each payment, trade, or shipment against the lists current at the moment of execution. List-update screening catches the harder case: when a name is added to a list, every existing customer has to be rescreened against the new entry, and the failure mode where a previously-cleared customer becomes sanctioned mid-relationship is the one most often missed by programs that only screen on onboarding and at transaction. The operationally interesting tuning question is fuzzy-match scoring. Too tight and the false-positive volume swamps the review team, who then start clearing hits without real diligence and the program loses its credibility with examiners. Too loose and a confirmed hit slips through, and the institution carries strict-liability exposure under most of the relevant regimes. The escalation path for confirmed hits is typically blocking the transaction, freezing the account, and filing the relevant authority report (OFAC blocking report, OFSI notification, EU competent-authority report) within the statutory window. Evidence formats that hold up include the published screening configuration with match thresholds and list versions, the hit-or-clear log keyed to the customer and transaction IDs, the list-update cadence record, and the risk-based exception policy showing how lower-risk customer cohorts were screened against a narrower list or with different review thresholds. The audit log matters at the same level as the screening itself; a clean hit-and-clear chain is what regulators read first.
Required by (5 regulations)
- US EAR
15 CFR §744 + Part 744 Supp. — restricted-party screening as the parallel obligation alongside ECCN-based licensing.
15 CFR §744 + Part 744 Supp.
- US OFAC
31 CFR Part 501 + program-specific provisions; SDN List + 50% Rule + comprehensive country programs (Cuba, Iran, NK, Syria, Crimea/DNR/LNR); real-time screening at signup and transaction time.
31 CFR Part 501 + program-specific provisions; SDN List + 50% Rule + comprehensi
- EU Dual-Use
Regulation (EU) 2021/821, Article 12(4) + Commission Recommendation 2019/1318 — Internal Compliance Programme with restricted-party screening as the third of seven core elements.
Regulation (EU) 2021/821, Article 12(4) + Commission Recommendation 2019/1318
- UK Export Control
SAMLA 2018-based sanctions framework operates alongside the export-control regime; OFSI Consolidated List is the screening baseline.
SAMLA 2018-based sanctions framework operates alongside the export-control regim
- Other Sanctions
Consolidated multilateral screening (UN + AU DFAT + CA OSFI + JP METI/MOFA + SG MAS + CH SECO + others); commercial aggregators (Refinitiv, Dow Jones, LexisNexis, Sanctions.io) the operational baseline.
Consolidated multilateral screening (UN + AU DFAT + CA OSFI + JP METI/MOFA + SG
Fulfilled by (4)
- comply-advantage · full · medium effort · $$
- refinitiv · full · high effort · $$$
- ofac-search · partial · low effort · $
- In-house build · high effortMaintaining list updates + fuzzy-match scoring is the part teams underestimate.
Magist does not accept payment from vendors. Methodology.
Evidence formats
- screening configuration
- hit / clear log
- list-update cadence
- risk-based exception policy