How to Handle an OFAC Match: Step-by-Step Procedures

When Your Screening Returns a Hit

You ran a name through your sanctions screening tool and got a potential match. Now what? Having a clear, documented procedure for handling potential matches is one of the most important parts of your OFAC compliance program. Here is a step-by-step guide.

Step 1: Pause the Transaction

Do not process the transaction, open the account, or disburse funds until you have resolved the potential match. If the match turns out to be real and you let the transaction go through, you have a violation. The urgency of the transaction does not matter. Hold everything until the match is resolved.

Step 2: Investigate the Match

Most potential matches are false positives, especially if you are using fuzzy matching (which you should be). Your job is to determine whether this is a true match or a false positive. Compare the identifying information you have about your customer with the details on the sanctions list entry:

• Full name: Are all parts of the name consistent, including middle names and suffixes?
• Date of birth: Does the date of birth match?
• Address or country: Is there a geographic connection to the sanctioned party?
• Identification numbers: Do passport numbers, national ID numbers, or other identifiers match?
• Aliases: Does the SDN entry list aliases that match your customer?

The more data points you can compare, the more confident you can be in your determination. A name match alone, without any corroborating information, is usually a false positive.

Step 3: If It Is a False Positive

If you determine the match is a false positive, document your analysis. Write down what information you compared, why you concluded it was not a true match, who made the determination, and the date. Then proceed with the transaction as normal.

Keep this documentation on file. If a regulator or examiner asks about it later, you want to be able to show your work.

Step 4: If It Is a True Match

If you believe the match is genuine, you must take immediate action:

1. Block the transaction. Do not process it under any circumstances.
2. Block or freeze any assets. If you hold funds or other property belonging to the sanctioned party, freeze them.
3. Do not tip off the customer. This is critical. You cannot tell the customer that they have been identified as a potential match on a sanctions list. Tipping off a sanctioned party is itself a violation.
4. Report to OFAC. File a blocking or reject report with OFAC within 10 business days. OFAC provides forms and instructions for this on their website.
5. Notify your compliance officer and legal counsel. This is not something to handle alone. Escalate immediately.

Step 5: Document Everything

Whether the match is true or false, documentation is essential. Your records should include:

• The name and identifying information that was screened
• The date and time of the screening
• The potential match and its details
• Your investigation and analysis
• The determination (true match or false positive)
• The action taken (transaction processed, blocked, or rejected)
• Who made the determination and when

OFACScreen automatically logs all screening results, match scores, and identifying details, giving you a strong starting point for your documentation.

The No-Tipping-Off Rule

This is worth repeating because it catches people off guard. If you have a true or suspected true match, you cannot tell the customer why their transaction was blocked or why you are declining to do business with them. This applies to your entire staff, so make sure employees understand this rule. If the customer asks, a generic "we were unable to process your request" is typically acceptable. Consult legal counsel if unsure.

Build Your Procedures Now

The time to figure out your match-handling procedures is before you get a match, not during. Write down your process, train your staff, and make sure everyone knows who to contact and what to do.