5 Common OFAC Screening Mistakes (and How to Avoid Them)
OFAC enforcement actions follow patterns. The same handful of screening failures come up repeatedly. Here are the five most common ones and what to do about them.
1. Exact-Match-Only Screening
Treasury's free search covers its two OFAC lists and does have fuzzy matching, but the sensitivity slider ships at 100, meaning exact match only, and nothing in the interface tells you to move it. Left at the default, "Mohamed" will not match "Mohammed" or "Muhammad," and transliterations from Arabic, Cyrillic, and Chinese scripts routinely produce multiple valid English spellings of the same name. It also keeps no record: close the tab and there is no evidence the search happened.
Fix: Use a screening tool that supports fuzzy matching, and keep the cut-off loose enough to catch plausible variations. There is no industry-standard number, and any vendor quoting one is guessing. Write down whatever cut-off you use and why, because an examiner will ask how sensitive your search was.
2. Screening Only at Onboarding
A customer who was clean when you onboarded them six months ago could be designated tomorrow. OFAC adds names to the SDN list multiple times per week. If you only screen at onboarding, you will eventually process a transaction with a sanctioned party without knowing it.
Fix: Re-screen your customer base whenever the lists update. Continuous monitoring automates this: you add your customers once and get alerted when a list change produces a new match.
3. No Audit Trail
When an examiner asks "show me your OFAC screening records for Q3," you need an answer. "We screened them, trust us" does not work. Examiners want to see what name was searched, which lists were checked, the date and time, and the results.
Fix: Log every search automatically. A screenshot is weaker than it looks: no list version, no match parameters, and a date that can be cropped. Use a tool that writes the record for you, or buy a timestamped report of the search you just ran.
4. Ignoring Non-SDN Lists
The SDN list gets all the attention, but the Consolidated Non-SDN list, BIS Denied Persons List, and international lists carry their own compliance obligations. A match on any of them can mean you need to block a transaction or impose restrictions.
Fix: Screen against every list relevant to your business. At minimum: SDN, Non-SDN, and BIS. Add EU, UN, UK, and others if you operate internationally.
5. No Written Procedures
OFAC's enforcement guidelines explicitly consider whether a company has a written compliance program. Having no documented procedures is treated as an aggravating factor when penalties are calculated.
Fix: Write it down. Document when screening happens (onboarding, before disbursement, periodically), who is responsible, what to do when there's a potential match, and how to escalate. It doesn't need to be 50 pages. A clear two-page policy is better than nothing.