5 Common OFAC Screening Mistakes (and How to Avoid Them)
OFAC enforcement actions follow patterns. The same handful of screening failures come up repeatedly. Here are the five most common ones and what to do about them.
1. Exact-Match-Only Screening
Treasury's own free search tool on the OFAC website only does exact matching. That means "Mohamed" won't match "Mohammed" or "Muhammad." Transliterations from Arabic, Cyrillic, and Chinese scripts routinely produce multiple valid English spellings of the same name.
Fix: Use a screening tool that supports fuzzy matching. Set your match threshold low enough to catch plausible variations (most teams use 75-85%) and review the flagged results manually.
2. Screening Only at Onboarding
A customer who was clean when you onboarded them six months ago could be designated tomorrow. OFAC adds names to the SDN list multiple times per week. If you only screen at onboarding, you will eventually process a transaction with a sanctioned party without knowing it.
Fix: Re-screen your customer base whenever the lists update. Continuous monitoring automates this: you add your customers once and get alerted when a list change produces a new match.
3. No Audit Trail
When an examiner asks "show me your OFAC screening records for Q3," you need an answer. "We screened them, trust us" does not work. Examiners want to see what name was searched, which lists were checked, the date and time, and the results.
Fix: Log every search automatically. If you're screening manually through the OFAC website, you should be taking screenshots at minimum. Better yet, use a tool that creates logs for you.
4. Ignoring Non-SDN Lists
The SDN list gets all the attention, but the Consolidated Non-SDN list, BIS Denied Persons List, and international lists carry their own compliance obligations. A match on any of them can mean you need to block a transaction or impose restrictions.
Fix: Screen against every list relevant to your business. At minimum: SDN, Non-SDN, and BIS. Add EU, UN, UK, and others if you operate internationally.
5. No Written Procedures
OFAC's enforcement guidelines explicitly consider whether a company has a written compliance program. Having no documented procedures is treated as an aggravating factor when penalties are calculated.
Fix: Write it down. Document when screening happens (onboarding, before disbursement, periodically), who is responsible, what to do when there's a potential match, and how to escalate. It doesn't need to be 50 pages. A clear two-page policy is better than nothing.