Sanctions Compliance: OFAC, OFSI and Beyond

Start here

What a sanction actually is

Strip away the legal language and a sanction is simple. A government decides someone, or some country, should not get access to the financial system, so it publishes a list and tells every bank in its jurisdiction, do not deal with these names. Miss that instruction and process a payment for a listed name anyway, and the bank itself is now breaking the law, not just the sanctioned party.

🚫

Think of it like a banned customer list, but for the entire global economy

A shop can refuse service to a difficult customer and that is the end of it. A sanctions list works the same idea at national scale, except the shop is every bank, payment processor and exporter in that country, and refusing to comply is not a customer service choice, it is a criminal offence with real prison sentences attached.

There is no single global sanctions authority. The United Nations, the United States through OFAC, the United Kingdom through OFSI, the European Union, and dozens of other governments each run their own list, their own legal basis, and their own penalties. A name can sit on one list and not another, which is exactly why screening against only one source is a false sense of security, not compliance.

The mechanics

The four types of sanction, click each to expand

Most people think a sanction only means one thing, freeze the money. In practice there are four distinct flavours, and mixing them up is one of the most common mistakes junior analysts make.

👤Individual and entity sanctions

Named people or companies

Tap to expand

The most common form. A specific person or company is named, added to a list such as the OFAC SDN list or the OFSI UK Sanctions List, and any asset belonging to them is frozen the moment the designation takes effect. This is what most screening tools check for first.

🏭Sectoral sanctions

A whole industry, not a name

Tap to expand

Instead of naming a person, an entire sector such as Russian defence manufacturing or oil extraction technology is restricted. A company can be perfectly legitimate and still be caught if it operates in a sector on the restricted list, which is why sanctions screening cannot rely on name matching alone.

🌍Country and comprehensive sanctions

An entire nation, no exceptions

Tap to expand

The most severe form. North Korea, Iran, and Cuba have historically faced comprehensive embargoes where almost any transaction connected to the country is prohibited, regardless of who the individual counterparty is or how innocent the transaction looks.

🔗Secondary sanctions

Punishing anyone who deals with them

Tap to expand

The most misunderstood category. A secondary sanction does not target the original sanctioned party at all, it targets any third country business that continues trading with them. A bank in a completely unsanctioned country can still be cut off from the US financial system for facilitating a sanctioned Russian bank's payments, even without breaking its own country's law.

The roster

Every major and minor list you actually need to know

There is no single master list. Below is the practical roster, ranked by how often you will encounter it in real screening work, from the lists that carry direct legal force in most jurisdictions down to the lists that inform risk without being sanctions in the strict legal sense.

List	Issued by	Type	Legal weight
SDN list	OFAC, United States Treasury	Individual and entity	Major
UK Sanctions List	OFSI, HM Treasury	Individual and entity	Major
Consolidated Financial Sanctions List	European Union	Individual and entity	Major
UN Security Council Consolidated List	United Nations	Individual and entity	Major
Non-SDN and sectoral lists	OFAC, United States Treasury	Sectoral	Major
Denied Persons and Entity List	BIS, United States Commerce	Individual and entity, export control	Major
DFAT Consolidated List	Australia, Foreign Affairs	Individual and entity	Moderate
SEMA Consolidated List	Canada, Global Affairs	Individual and entity	Moderate
SECO Sanctions List	Switzerland	Individual and entity	Moderate
FATF grey and black list	Financial Action Task Force	Jurisdictional risk, not a sanction	Minor
Interpol Red Notices	Interpol	Law enforcement alert, not a freeze	Minor
World Bank debarred parties	World Bank Group	Procurement ban only	Minor

💡

Major does not mean easiest

The SDN list carries the heaviest legal consequence, but as the case study below shows, legal weight and screening difficulty are two completely different things. Some of the hardest names to screen correctly sit on the biggest, most authoritative lists.

Case study

One name everyone recognises, one name almost nobody does

The best way to understand why sanctions screening is genuinely hard is to put a famous designation next to an obscure one, and watch what actually happens when both hit a screening engine.

Well known

Roman Abramovich

Designated by OFSI on 10 March 2022 under the Russia Sanctions Regulations, for his links to Vladimir Putin and his ownership stake in Evraz. The designation carries a full asset freeze, travel ban and transport sanctions. His name comes with a specific date of birth, place of birth, multiple passport numbers across three nationalities, and one of the most heavily reported business profiles in the world, the former owner of Chelsea Football Club.

Genuinely obscure

Jorge Jesus Rodriguez Gomez

A real entry on the OFAC SDN list. The given name, family name and aliases are all extremely common across Venezuela and dozens of other countries. Screening research has documented that this exact name pattern generates false alerts against completely unrelated real people, including a television doctor, a minor league baseball player, and a business executive who happen to share the same common name.

What makes it different	Roman Abramovich	Jorge Jesus Rodriguez Gomez
Name uniqueness	Rare	Extremely common
Supporting identifiers on file	Date of birth, place of birth, three passports	Sparse, name driven match only
Public media coverage	Global, instantly recognisable	Effectively none
Typical screening outcome	Confirmed match in seconds	Dozens of false alerts before any real review
Analyst risk	Low, easy to confirm	High, genuine hit could hide inside the noise

The real danger

Why analysts start ignoring names like Jorge Rodriguez

OFAC itself has a name for this problem. Some aliases on its own lists are formally tagged as a weak AKA, a name so broad or generic that OFAC does not even expect firms to screen against it directly, because the volume of false hits it produces would swamp any team. That tag exists precisely because names like Jorge Rodriguez are common enough to break a screening programme through sheer noise, not through any fault in the technology.

⚠️

The boy who cried wolf effect

When one common name generates ten false alerts every week, an analyst's brain does exactly what any human brain does under repetition, it starts pattern matching to dismiss rather than pattern matching to investigate. The eleventh alert against that same name gets the same reflexive clear as the first ten, even on the one occasion it is the actual designated person behind a genuine transaction. This is not laziness, it is a predictable, well documented consequence of alert fatigue, and it is exactly why relying on name matching alone is dangerous rather than merely inefficient.

The fix is not to screen less, it is to screen with more than a name. Date of birth, nationality, address, and transaction context turn a common name collision into a confident decision either way. This is the entire reason a proper screening engine returns a risk score rather than a flat yes or no, the score reflects how much more than the name actually lined up.

Memory aid

Cheat cards, tap each one to flip

Eight terms worth knowing cold. Tap a card to reveal the plain English definition on the back.

SDN

tap to flip

Specially Designated National. OFAC's main list of individuals and entities whose assets in the US must be frozen.

Weak AKA

tap to flip

An alias OFAC itself flags as too generic to screen against directly, because it produces overwhelming false hits.

Asset freeze

tap to flip

Funds belonging to a designated person are locked in place. Not seized, just frozen, until the designation is lifted.

Sectoral sanction

tap to flip

Restricts an entire industry or activity, not a named person, meaning legitimate firms can still be caught.

Designated person

tap to flip

The formal term for anyone or anything actually named on a sanctions list, as opposed to merely suspected or investigated.

General licence

tap to flip

A standing exception that permits a specific type of otherwise prohibited activity, such as paying a sanctioned person's lawyer.

Fifty percent rule

tap to flip

A company is treated as sanctioned if designated persons own fifty percent or more of it combined, even if no single owner is listed alone.

Secondary sanction

tap to flip

Targets a third party for dealing with a sanctioned entity, rather than targeting the sanctioned entity itself.

Quick check

Test what stuck

Question 1

A common name like Jorge Rodriguez generating dozens of false alerts is best solved by

Question 2

A sectoral sanction restricts

Question 3

A secondary sanction primarily targets

FAQ

Quick answers

Is OFSI the same as OFAC? +

No. OFAC is the United States Treasury's sanctions authority. OFSI, the Office of Financial Sanctions Implementation, is its UK equivalent under HM Treasury. Both maintain separate lists with separate legal force, and a name can appear on one without appearing on the other.

If a name is not on any sanctions list, is it definitely safe? +

No. Sanctions screening is one control among several. A name can be entirely unsanctioned and still carry politically exposed person risk, adverse media risk, or ownership ties to a sanctioned entity under the fifty percent rule, none of which show up on a plain name check alone.

Why do sanctions lists update so often? +

Geopolitical events move faster than annual review cycles. New designations, delistings and amendments happen on a rolling basis, which is why a one time screen at onboarding is never enough, ongoing rescreening against a live feed is the actual requirement.