What is OFAC screening?

OFAC screening answers one question at the moment it matters: is the person, company, wallet or jurisdiction on the other side of this transaction someone US sanctions say I cannot deal with? The check runs against OFAC's Specially Designated Nationals list, its Non-SDN Consolidated list and its country programs, and a confirmed hit means the transaction is blocked or rejected and reported to OFAC within ten business days.

Screening is not itself a legal term — no OFAC regulation uses the word. It is how an organisation meets the obligation the regulations do impose: to block the property of blocked persons and refuse prohibited dealings, on a strict-liability basis. OFAC does not certify screening software and keeps no "safe list" of cleared names (OFAC FAQ 469), so the quality of the check is the business's own responsibility.

Every US person is bound by OFAC's prohibitions (OFAC FAQ 11): US citizens and permanent residents wherever they are, everyone physically in the United States, every US-incorporated entity and its foreign branches, and under the Iran and North Korea programs the foreign subsidiaries US persons own or control. Because civil liability is strict — OFAC need not show the violator knew a party was sanctioned — any of them that moves money, goods or services for others has a practical need to screen, whatever its industry.

OFAC's A Framework for OFAC Compliance Commitments (2 May 2019) says plainly that its regulations do not require a formal compliance program, then encourages every organisation subject to US jurisdiction to adopt one, particularly those with international dealings or clients abroad. US bank examiners review OFAC controls alongside anti-money-laundering controls, and the enforcement record shows the expectation now reaches fintech and crypto: OFAC's 2025 settlements included the wallet company Exodus Movement ($3,103,360, 16 December 2025) and the exchange ShapeShift ($750,000, 22 September 2025).

Non-US companies are not directly bound, but they may not cause a US person to violate sanctions or help a blocked party evade them, and a payment that clears in US dollars passes through US jurisdiction. In practice most non-US financial businesses screen against OFAC's lists as well as their own regulator's.

OFAC's list entries carry far more than names. A screening program should check every identifier type its own data holds against the identifier types the lists publish, and should check jurisdiction separately — a counterparty in a comprehensively sanctioned country is a problem even when no party is listed.

The process is the same whether it runs in a bank's payment filter or a developer's checkout flow. Six steps, in order:

At three points. At onboarding, before a customer, vendor or counterparty relationship starts. Before value moves, on the specific counterparty of each payment, withdrawal or shipment — the recipient of a transfer is often not the customer you onboarded. And whenever the list changes, re-screening the identifiers you already hold, because a customer who was clear at onboarding can be designated afterwards and a blocked one can be delisted.

The third point is where most programs are weakest, because it depends on knowing when the list changed. Monitoring the values you hold against each list update turns a periodic batch re-screen into an alert on the day of the designation.

The appendix to OFAC's 2019 Framework lists the root causes it kept finding in enforcement cases. Four of its ten are screening problems:

An API turns the match step into one request per identifier. CompliAPI screens crypto addresses, emails, websites, government IDs, names, vessels and aircraft against the SDN list, the Non-SDN Consolidated list and other government sanctions lists, with the list copy refreshed every 15 minutes; the ?lists= filter narrows a check to OFAC's two lists. Every match names its list and links the official record, and every call is written to the organisation's audit trail — the review and record-keeping steps start from that log.