Sanctions Compliance: OFAC, OFSI and Beyond

Start here

What a sanction actually is

Strip away the legal language and the core idea is straightforward: a government identifies a person, entity, or country it wants to restrict, and prohibits specific dealings with them, primarily freezing their funds and economic resources, and barring transactions involving any entity they own or control, subject to whatever exceptions and licences the regime allows. It is not simply "do not deal with this name" though: the prohibition is defined by specific conduct, dealing with the funds or economic resources of a designated person, directly or through something they own or control, within that regime's jurisdictional reach, not a blanket ban on any transaction that happens to touch the name. Process a payment that genuinely falls within a prohibition anyway, and the bank itself is breaking the law, not just the sanctioned party, but whether a given payment falls within the prohibition is a legal question with real exceptions and licensing routes, not an automatic yes because a name matched.

🚫

Think of it like a banned customer list, but for the entire global economy

A shop can refuse service to a difficult customer and that is the end of it. A sanctions list works the same idea at national scale, except the shop is every bank, payment processor and exporter in that country, and refusing to comply is not a customer service choice, it is a criminal offence with real prison sentences attached.

There is no single global sanctions authority. The United Nations, the United States through OFAC, the United Kingdom (financial sanctions implemented and enforced by OFSI, designations published on the FCDO's UK Sanctions List), the European Union, and dozens of other governments each run their own list, their own legal basis, and their own penalties. A name can sit on one list and not another, which is exactly why screening against only one source is a false sense of security, not compliance.

The mechanics

The four types of sanction, click each to expand

Most people think a sanction only means one thing, freeze the money. In practice there are four distinct flavours, and mixing them up is one of the most common mistakes junior analysts make.

👤Individual and entity sanctions

Named people or companies

Tap to expand

The most common form. A specific person or company is named, added to a list such as the OFAC SDN list or the FCDO's UK Sanctions List, and any asset belonging to them is frozen the moment the designation takes effect. This is what most screening tools check for first.

🏭Sectoral sanctions

A whole industry, not a name

Tap to expand

Instead of naming a person, an entire sector such as Russian defence manufacturing or oil extraction technology is restricted. A company can be perfectly legitimate and still be caught if it operates in a sector on the restricted list, which is why sanctions screening cannot rely on name matching alone.

🌍Country and comprehensive sanctions

An entire nation, no exceptions

Tap to expand

The most severe form. North Korea faces close to a comprehensive embargo under UN Security Council sanctions, reinforced by US and UK measures. Iran and Cuba are often cited alongside it, but the actual scope varies sharply by regime and by period: Iran's UK and EU measures are targeted rather than a blanket embargo, and Cuba's comprehensive embargo is specifically a US programme, the UK has no equivalent Cuba-wide embargo. Treat "country-wide embargo" as regime-specific and date-specific, not a single fixed category.

🔗Secondary sanctions

Punishing anyone who deals with them

Tap to expand

The most misunderstood category. A secondary sanction does not target the original sanctioned party at all, it targets any third country business that continues trading with them. A bank in a completely unsanctioned country can still be cut off from the US financial system for facilitating a sanctioned Russian bank's payments, even without breaking its own country's law.

The roster

Every major and minor list you actually need to know

There is no single master list. Below is the practical roster of sanctions and export-control lists that carry direct legal force in their own jurisdiction, ranked by how often you will encounter each in real screening work. A separate table further down covers related lists that inform risk without being sanctions in the legal sense, they aren't ranked on the same scale because they aren't the same kind of thing.

List	Issued by	Type	Legal weight
SDN list	OFAC, United States Treasury	Individual and entity	Major
UK Sanctions List	FCDO (financial sanctions on the list are implemented and enforced by OFSI, HM Treasury)	Individual and entity	Major
Consolidated Financial Sanctions List	European Union	Individual and entity	Major
UN Security Council Consolidated List	United Nations	Individual and entity	Major
Non-SDN and sectoral lists	OFAC, United States Treasury	Sectoral	Major
Denied Persons and Entity List	BIS, United States Commerce	Individual and entity, export control	Major
DFAT Consolidated List	Australia, Foreign Affairs	Individual and entity	Moderate
SEMA Consolidated List	Canada, Global Affairs	Individual and entity	Moderate
SECO Sanctions List	Switzerland	Individual and entity	Moderate

Related lists that inform risk but aren't sanctions

These get screened alongside sanctions lists because they carry real risk signal, but none of them is a sanctions list, and none carries an asset freeze or blocking obligation of its own, so they don't sit on the Major/Moderate/Minor scale above at all.

List	Issued by	What it actually is
FATF grey and black list	Financial Action Task Force	Jurisdictional risk designation, not a sanction
Interpol Red Notices	Interpol	Law enforcement alert requesting arrest/extradition, not an asset freeze
World Bank debarred parties	World Bank Group	Procurement ban from World Bank-financed projects only

💡

Major does not mean easiest

The SDN list carries the heaviest legal consequence, but as the case study below shows, legal weight and screening difficulty are two completely different things. Some of the hardest names to screen correctly sit on the biggest, most authoritative lists.

Case study

One name everyone recognises, one name almost nobody does

The best way to understand why sanctions screening is genuinely hard is to put a famous designation next to an obscure one, and watch what actually happens when both hit a screening engine.

Well known

Roman Abramovich

Designated under the Russia (Sanctions) (EU Exit) Regulations on 10 March 2022, published on what is now the FCDO's UK Sanctions List (OFSI implements and enforces the resulting financial sanctions), for his links to Vladimir Putin and his ownership stake in Evraz. The designation carries a full asset freeze, travel ban and transport sanctions. His name comes with a specific date of birth, place of birth, multiple passport numbers across three nationalities, and one of the most heavily reported business profiles in the world, the former owner of Chelsea Football Club.

Genuinely obscure

Jorge Jesus Rodriguez Gomez

A real entry on the OFAC SDN list. The given name, family name and aliases are all extremely common across Venezuela and dozens of other countries. A name this common creates exactly this kind of collision risk against unrelated real people, illustratively, a television doctor, a minor league baseball player, a business executive, anyone who happens to share the name; we haven't identified a specific published study documenting this exact case, so treat the professions as illustrative of the pattern, not a cited research finding.

What makes it different	Roman Abramovich	Jorge Jesus Rodriguez Gomez
Name uniqueness	Rare	Extremely common
Supporting identifiers on file	Date of birth, place of birth, three passports	Sparse, name driven match only
Public media coverage	Global, instantly recognisable	Effectively none
Typical screening outcome	Confirmed match in seconds	Dozens of false alerts before any real review
Analyst risk	Low, easy to confirm	High, genuine hit could hide inside the noise

The real danger

Why analysts start ignoring names like Jorge Rodriguez

OFAC itself has a name for this problem. OFAC's own regulations don't prescribe a specific screening regime, firms design their own risk-based approach to how they screen. Some aliases on its lists are formally tagged as a weak AKA; per OFAC's own FAQ 124, OFAC does not expect firms to proactively screen for these specifically, but expects a weak AKA may help confirm whether a match arising from other identifying information is accurate. That distinction exists precisely because names like Jorge Rodriguez are common enough to swamp a screening programme through sheer noise if treated as a primary screening field, not through any fault in the technology.

⚠️

The boy who cried wolf effect

When one common name generates ten false alerts every week, an analyst's brain does exactly what any human brain does under repetition, it starts pattern matching to dismiss rather than pattern matching to investigate. The eleventh alert against that same name gets the same reflexive clear as the first ten, even on the one occasion it is the actual designated person behind a genuine transaction. This is not laziness, it is a predictable, well documented consequence of alert fatigue, and it is exactly why relying on name matching alone is dangerous rather than merely inefficient.

The fix is not to screen less, it is to screen with more than a name. Date of birth, nationality, address, and transaction context turn a common name collision into a confident decision either way. This is the entire reason a proper screening engine returns a risk score rather than a flat yes or no, the score reflects how much more than the name actually lined up.

Memory aid

Cheat cards, tap each one to flip

Eight terms worth knowing cold. Tap a card to reveal the plain English definition on the back.

SDN

tap to flip

Specially Designated National. OFAC's main list of individuals and entities whose property and interests in property, when within the US or in the possession or control of a US person, must be blocked, subject to the specific programme's rules and any applicable exceptions or licences.

Weak AKA

tap to flip

An alias OFAC itself flags as too generic to screen against directly, because it produces overwhelming false hits.

Asset freeze

tap to flip

Funds belonging to a designated person are locked in place. Not seized, just frozen, until the designation is lifted.

Sectoral sanction

tap to flip

Restricts an entire industry or activity, not a named person, meaning legitimate firms can still be caught.

Designated person

tap to flip

The formal term for anyone or anything actually named on a sanctions list, as opposed to merely suspected or investigated.

General licence

tap to flip

A standing exception that permits a specific type of otherwise prohibited activity, such as paying a sanctioned person's lawyer.

OFAC's 50 Percent Rule

tap to flip

The US-specific rule: a company is treated as blocked if designated persons own fifty percent or more of it combined, even if no single owner individually holds that much. The UK's OFSI test is different, it looks at each designated person's holding individually against the 50% threshold (plus a separate control test) and generally does not aggregate separate designated persons' stakes unless there's a joint arrangement or one controls the other.

Secondary sanction

tap to flip

Targets a third party for dealing with a sanctioned entity, rather than targeting the sanctioned entity itself.

Quick check

Test what stuck

Question 1

A common name like Jorge Rodriguez generating dozens of false alerts is best solved by

Question 2

A sectoral sanction restricts

Question 3

A secondary sanction primarily targets

FAQ

Quick answers

Is OFSI the same as OFAC? +

No. OFAC is the United States Treasury's sanctions authority, and it does maintain the SDN list directly. OFSI, the Office of Financial Sanctions Implementation, is a UK equivalent for financial sanctions specifically, under HM Treasury, but it implements and enforces UK financial sanctions rather than publishing the master list itself, that's the FCDO's UK Sanctions List. Either way, the two countries run separate regimes with separate legal force, and a name can appear on one without appearing on the other.

If a name is not on any sanctions list, is it definitely safe? +

No. Sanctions screening is one control among several. A name can be entirely unsanctioned and still carry politically exposed person risk, adverse media risk, or ownership/control ties to a sanctioned entity, whether through OFAC's aggregate 50% rule, OFSI's individual-basis ownership and control test, or an equivalent test under another regime, none of which show up on a plain name check alone.

Why do sanctions lists update so often? +

Geopolitical events move faster than annual review cycles. New designations, delistings and amendments happen on a rolling basis, which is why a one time screen at onboarding is never enough. UK and other sanctions regimes require you to comply with the prohibitions at all times, they don't prescribe a specific rescreening cadence, but ongoing rescreening against a live, regularly updated feed is, in our view, the practical control that actually keeps you compliant as lists change.