Last updated: October 2026

OFAC sanctions screening is the check of customers, counterparties and transactions against the sanctions lists of the Office of Foreign Assets Control (OFAC), and against entities owned 50 percent or more by blocked persons, so that an institution never deals with a blocked person. OFAC requires no particular screening tool or schedule, but liability is strict, so each institution designs and evidences its own program: which lists, how fast updates land, what gets screened and how matches are judged. What OFAC does fix is reporting within 10 business days and records kept for at least 10 years.

TL;DR

• OFAC sets the outcome and leaves the method to the institution: never deal with a blocked person, and never complete a transaction before a hit is analyzed. Liability is strict.

• Screen the SDN List, decide by risk how to treat the six non-SDN lists, and remember that some blocked parties appear on no list.

• No OFAC rule sets a deadline for applying a list update; the institution sets its own and evidences it.

• Screen payments and counterparties as well as customers.

• Block when a blocked person has an interest; reject when a transaction is prohibited without one. Report either within 10 business days.

• Keep records for at least 10 years, and map the program to the five components of OFAC's Framework.

What OFAC sanctions screening has to catch

OFAC sanctions screening has to stop an institution from processing a transaction for, or holding property of, a blocked person or an entity blocked through ownership. It also has to catch transactions an OFAC program prohibits outright, so they can be rejected. Everything else in an OFAC compliance program serves those two outcomes.

OFAC does not prescribe the method. FAQ 124 says "OFAC's regulations do not explicitly require any specific screening regime," FAQ 43 says there is no legal requirement to use software or to scan, and Treasury's March 2026 report to Congress on innovative technologies says OFAC requires no specific screening tool. What FAQ 43 does require is that an institution not do business with a target or fail to block property, and that it not conclude a transaction before a hit is analyzed.

Liability is strict. Under OFAC's FAQ 65 and its June 2026 Introduction guide, a person can be held civilly liable without knowing a transaction was prohibited, though OFAC may treat a risk-based compliance program as mitigating. The same guide calls screening of customers, intermediaries, counterparties, documents and transactions, typically through software, the most common internal control.

Which OFAC lists to screen

Screen the Specially Designated Nationals (SDN) List, then decide by risk how to treat OFAC's non-SDN lists.

An obligation to block can come from a listing, an ownership chain or a program's own definitions.

The six non-SDN lists are the Sectoral Sanctions Identifications (SSI) List, the Foreign Sanctions Evaders (FSE) List, empty since December 18, 2025, and the NS-PLC, CAPTA, NS-MBS and NS-CMIC lists. OFAC's FAQ 10, amended October 26, 2026, describes them as carrying "non-blocking prohibitions on targeted persons." OFAC does not say whether they must be screened; its June 2026 Introduction guide says only that actions "vary according to the applicable list." FAQ 91 adds that some sanctions block whole categories of persons, such as blocked governments, whether or not they are listed.

Lists beyond OFAC follow from the institution's other obligations. A chief risk officer and BSA officer at a community bank (card and treasury fintech programs) said its critical lists are OFAC, UN and EU, with UK lists required for part of its card business by a network rule. Politically exposed persons are not a sanctions list; our explainer on PEP screening covers what US rules require.

The OFAC 50 Percent Rule

Under OFAC's 50 Percent Rule, any entity owned 50 percent or more in the aggregate, directly or indirectly, by one or more blocked persons is itself blocked, whether or not it appears on a list. The rule comes from OFAC's revised guidance of August 13, 2014, and OFAC has written it into program regulations such as 31 CFR 594.412.

OFAC adds together the stakes of all blocked persons, including persons blocked under different programs: under FAQ 399, two blocked persons owning 25 percent each make an entity blocked. Indirect ownership counts only through entities that are themselves 50 percent or more owned by blocked persons (FAQ 401).

Control alone does not block an entity. FAQ 398 says the rule "speaks only to ownership and not to control," though OFAC may still designate a controlled entity and urges caution. FAQ 400 adds that US persons may not deal with a non-blocked entity through a blocked individual, for example by entering into a contract a blocked individual signed.

A divestment entirely outside US jurisdiction that takes blocked persons below 50 percent ends the automatic block, but property already blocked stays blocked (FAQ 402). OFAC's March 31, 2026 sanctions advisory on sham transactions gives factors for testing whether a divestment really happened.

Existing ownership data may not settle the question. The customer due diligence (CDD) rule at 31 CFR 1010.230 identifies individuals owning 25 percent or more of a legal entity customer, a different test from OFAC's, and FinCEN's BOI database is not a source for US ownership chains because US companies are exempt from reporting under FinCEN's final rule of August 14, 2026. How to judge a screening tool on ownership data, and on the other criteria that matter, is covered in our guide to the best sanctions screening software.

How fast list updates have to be applied

No OFAC regulation, FAQ or guidance sets a number of hours or days within which a list update has to reach screening. OFAC leaves the frequency to each institution's risk assessment and warns that updates are arriving faster: under FAQ 88, institutions "decide how often they need to download the lists in order to comply with U.S. law," and "OFAC is updating its sanctions lists at an ever increasing pace."

The SDN List changes with "no predetermined timetable" (FAQ 20). OFAC's Sanctions List Service delivers full files, a delta file of changes and an API (FAQs 89 and 90 cover the full and delta files), and OFAC emails subscribers when lists change (FAQ 86).

OFAC's A Framework for OFAC Compliance Commitments (May 2019) expects a program "capable of adjusting rapidly to changes published by OFAC," and names screening software not updated for list changes among the root causes of past violations. The FFIEC BSA/AML Examination Manual's OFAC section asks banks for timely updating of the lists across their operations, without a time limit either.

Treat list management as its own control

Because OFAC sets the outcome and not the schedule, sanctions list management works best as its own control, separate from screening and alert review. List management covers which lists are in scope, how each addition, removal and amendment reaches the screening system, when customers are rescreened, and which list version applied on which date. A principal architect, financial crimes at a large bank described that separation: "There is one application responsible for list management, another application responsible for data ingestion across many sources. Then there is one application responsible for actual alert generation itself."

When to rescreen customers

Screen new customers before an account opens or shortly after, and rescreen existing customers when the lists change, at a frequency set by risk assessment. The FFIEC manual's OFAC section allows no transactions other than the initial deposit until a check made after opening is complete, and OFAC's FAQ 28 leaves scan frequency to the organization's "internal policies and procedures."

OFAC's clearest call to rescreen is in its insurance FAQ 65, which names list updates as a point to screen and warns that "Screening only at the point of policy issuance may expose insurers to sanctions risk." FAQ 65 is written for insurers, but the logic holds for any customer base: a customer who passed at onboarding can be designated later.

A blocked applicant should never get an account. OFAC's FAQ 42, amended October 26, 2026, says a bank that receives an application and initial deposit from a person on the SDN List "is obligated to decline to open the account and block the initial deposit," once it has confirmed the applicant is the listed person.

Some programs stop after onboarding: a director of treasury and compliance at a payments and merchant-acquiring fintech described screening clients at onboarding only, then sending the client list off each month to be checked by hand. An OFAC check at onboarding alone leaves the exposure FAQ 65 describes. Done well, rescreening is also quieter: an OFAC manager at a bank wants a match already reviewed to stay silent unless the list entry or the customer's data has changed.

Screening payments and counterparties, not only customers

OFAC's rules reach transactions as well as account holders. FAQ 45 says "Every transaction that a U.S. financial institution engages in is subject to OFAC regulations," and the FFIEC manual's OFAC section has funds transfers and non-customer transactions checked before execution. Specific screening points follow:

• Beneficiaries. FAQ 95 calls it prudent to screen account beneficiaries at opening, on updates, in periodic screening and, "most definitely, upon disbursing funds."

• Intermediary banks. FAQ 116 says an intermediary bank with no relationship to a non-account party on a wire, and no knowledge that the party is blocked, is not expected to research non-account parties that do not appear on the SDN List. The bank must still know its own customers.

• ACH. Per the FFIEC manual, the originating bank (ODFI) checks the Originator and the receiving bank (RDFI) the Receiver, and the RDFI is responsible for inbound international ACH transactions (IATs).

• Instant payments. OFAC's September 2022 guidance for instant payment systems leaves whether and how to screen them to each institution's risk assessment.

A program therefore screens what the rules reach: customers at onboarding and when the lists or their details change, and payments and counterparties as they move. Counterparties are the harder half. The same OFAC manager at a bank said the team will "get hits on both our customers and the counterparties," and that "sometimes the counterparty information is harder" to obtain, so wire alerts often mean researching a counterparty from scratch.

Match tuning and false positives

OFAC leaves the judgment of each potential match to the institution. FAQ 5, rewritten September 9, 2026, asks organizations to use all available information "to make a risk-based decision about the validity of a potential match" under their own policies and risk profile, and to keep records of the investigation. OFAC does not confirm potential matches or false positives.

Weak aliases get lighter treatment. OFAC does not expect screening for weak aliases (FAQ 124). Processing an unauthorized transaction involving a list entry is still a violation, but OFAC generally will not issue a civil penalty where a weak alias is the only sanctions reference and the processor keeps a rigorous risk-based program (FAQ 125).

OFAC's own Sanctions List Search combines string and phonetic matching on names (FAQs 246 and 249). The Framework expects screening technology to be calibrated to the institution's risk profile and routinely tested, and makes the institution responsible for fixing what testing finds.

Loose matching is a common source of false positives. A BSA manager at a credit union described one kind: "it is literally what we would consider a junk alert. It is completely based on just a string of characters and it's matching on like one letter in the string of characters." How hits are reviewed and cleared, including with agents, is covered in our guide to AI sanctions screening agents.

Block or reject: what to do with a true match

A confirmed match is either blocked or rejected, and each action has its own report.

Both reports go through the OFAC Reporting System, and records of both are kept for at least 10 years.

Blocked property is frozen, not seized. FAQ 32, amended October 26, 2026, says blocked funds "must be placed into a segregated, interest-bearing account on a U.S. financial institution's books, from which only OFAC-authorized debits may be made." The interest-bearing requirement itself sits in each program's regulations, such as 31 CFR 594.203, not in OFAC's general reporting rules in Part 501.

Rejection applies when a transaction is prohibited but nothing in it is blockable. FAQ 36, amended October 26, 2026, says such a transaction "should be rejected and returned to the originator." Its examples draw the line: a payment to a blocked Iranian bank is blocked, while a payment to a non-blocked company in Tehran is rejected.

A customer's question is different from a payment instruction. FAQ 53, amended October 26, 2026, says a customer merely asking whether money may be sent to a sanctioned place is not something to reject, while an instruction to pay a blocked person is blocked and reported.

Reporting to OFAC: deadlines and the annual report

Report blocked property to OFAC within 10 business days from the date it becomes blocked (31 CFR 501.603), report a rejected transaction within 10 business days of rejecting it (31 CFR 501.604), and file an annual report of all property blocked as of June 30 by September 30. Those are the core OFAC reporting requirements.

All of these reports go through the OFAC Reporting System (ORS), mandatory since an interim final rule effective August 8, 2024. FAQ 49, amended October 26, 2026, says reports go through ORS "within 10 business days of the date of the action," with copies of supporting documents such as payment instructions. Since a rule effective June 21, 2019, reject reporting covers all rejected transactions, not only funds transfers.

The annual report is easy to miss. OFAC's July 1, 2026 reminder says "Failure to file the ARBP by September 30 constitutes a violation of the RPPR," OFAC's Reporting, Procedures and Penalties Regulations. FAQ 50, amended October 26, 2026, restates the requirement.

Reporting is where many programs strain. A senior director of compliance (OFAC owner) at a prepaid card and consumer payments fintech said: "Reporting is a big pain point for me right now." Activity that is suspicious but is not a sanctions match raises a different question, whether a SAR is due; our guide to SAR filing requirements covers the thresholds and deadlines.

Recordkeeping: 10 years

Keep records of transactions subject to OFAC's regulations available for examination for at least 10 years after the transaction, and records of blocked property for as long as it is blocked and at least 10 years after it is unblocked (31 CFR 501.601). OFAC's June 2026 Introduction guide states the same 10-year period.

The OFAC recordkeeping requirements changed in 2025. An interim final rule published September 13, 2024 extended the period from five to 10 years, effective March 12, 2025, and a final rule effective March 21, 2025 adopted it unchanged. The change matches the 10-year statute of limitations that the 21st Century Peace through Strength Act, signed April 24, 2024, set for violations of the sanctions statutes OFAC enforces. Older guidance that still gives five years for OFAC records predates the 10-year rule.

A record should also answer an examiner: when a customer or payment was screened, against which list version, and how each hit was decided and by whom. Without a system, that evidence gets improvised: a business affairs lead at an early-stage platform company (non-bank) described screening by hand on each government's website and keeping screenshots of blank search results as the record.

OFAC's Framework for Compliance Commitments

OFAC's A Framework for OFAC Compliance Commitments, released May 2, 2019, says each risk-based sanctions compliance program should incorporate at least five essential components:

1. Management commitment

2. Risk assessment

3. Internal controls

4. Testing and auditing

5. Training

OFAC's June 2026 Introduction guide still points to the Framework and repeats the five components, so the Framework remains current guidance for an OFAC compliance program.

Screening sits inside internal controls. Under testing and auditing, the Framework makes it the organization's responsibility "to enhance its program, including all program-related software, systems, and other technology, to remediate any identified compliance gaps." The Framework's list of root causes of past violations includes screening software or filter faults: missed SDN or SSI List updates, missing identifiers for designated banks and missed alternative spellings.

The program also counts in enforcement. The Economic Sanctions Enforcement Guidelines (Appendix A to 31 CFR Part 501) list the existence, nature and adequacy of a risk-based OFAC compliance program as a general factor, and OFAC's Sanctions Penalties Regulations (31 CFR Part 505, effective September 25, 2026) leave those guidelines in place.

How Oscilar fits

Oscilar is the agentic risk platform for fraud, credit, onboarding, and compliance, used by banks, credit unions and fintechs. Oscilar is a unified platform: real-time data fabric, device and behavior intelligence, rules, and case management in one stack, with agents native to it.

For a sanctions program, the part that matters most is the record. Oscilar keeps a full audit trail per decision with stored reasoning, human-in-the-loop by design, so an institution can show how a decision on a hit was reached and who made it. See how Oscilar supports AML compliance for banks.

Frequently asked questions

Is OFAC screening required by law?

No law or OFAC regulation requires a particular screening regime or software (OFAC FAQs 43 and 124). The law requires that an institution never deal with a blocked person or fail to block property, and liability for doing so is strict.

Do non-SDN lists have to be screened?

OFAC does not say either way. Non-SDN lists carry non-blocking prohibitions that vary by list, so the right action on a hit depends on the list and its regulations. Whether to screen each one is a risk-based decision to document.

Does control alone make an entity blocked under the 50 Percent Rule?

No. OFAC's FAQ 398 says the 50 Percent Rule covers ownership, not control, so an entity that blocked persons control but do not own 50 percent or more of is not automatically blocked. OFAC may still designate it.

How often should customers be rescreened against OFAC lists?

OFAC sets no fixed frequency. Rescreen customers when OFAC's lists change, at a frequency set by the institution's risk assessment and written policies (OFAC FAQs 28 and 88).

How long does a bank have to report a blocked transaction to OFAC?

Within 10 business days from the date the property becomes blocked (31 CFR 501.603), filed through the OFAC Reporting System. Rejected transactions have the same deadline under 31 CFR 501.604.

How long must OFAC compliance records be kept?

At least 10 years. Since March 12, 2025, 31 CFR 501.601 has required transaction records to be kept for at least 10 years after the transaction, and blocked-property records for 10 years after unblocking; the period was previously five years.

What are the five components of an OFAC compliance program?

OFAC's 2019 Framework for OFAC Compliance Commitments names five: management commitment, risk assessment, internal controls, testing and auditing, and training.

Is PEP screening part of OFAC sanctions screening?

No. Politically exposed persons are not a sanctions list, so a PEP match alone does not call for blocking or rejecting. PEP screening is a separate due diligence question, covered in our explainer on PEP screening.