Fuzzy Matching Algorithms for Sanctions (Jaro-Winkler and Beyond)

Sanctions screening is fundamentally a name-matching problem, and names are messy. The same person may appear as different transliterations, with reordered components, missing middle names, or outright typos. Exact string matching would miss almost everyone, so screening systems rely on fuzzy matching algorithms. This post explains the main techniques and the trade-offs they force.

Why exact matching fails

Consider a name on the OFAC Specially Designated Nationals (SDN) list transliterated from another script. It might be spelled Mohammed, Muhammad, or Mohamed; the surname order might differ; a title or patronymic might be included or dropped. A payment message carrying any of these variants refers to the same sanctioned person, but a literal comparison sees three different strings. Fuzzy matching quantifies how similar two strings are, so near-misses can be caught.

Edit-distance methods: Levenshtein

The classic measure is Levenshtein distance: the minimum number of single-character insertions, deletions or substitutions needed to turn one string into another. Turning Smith into Smyth costs one substitution. Normalising the distance by string length yields a similarity score. Levenshtein is intuitive and effective for typos, but it treats all edits equally and is not especially tuned to how human names actually vary.

Jaro and Jaro-Winkler

The Jaro similarity measures matching characters and transpositions between two strings, producing a score between 0 and 1. Jaro-Winkler refines it by boosting the score when strings share a common prefix, on the empirical observation that names that agree at the start are more likely to be the same. This makes Jaro-Winkler particularly popular for name matching, where the beginning of a name is often the most stable part. It handles minor spelling differences well and is computationally cheap, which matters when screening every party in every payment in real time.

There is no single best algorithm. Edit distance catches typos, Jaro-Winkler favours shared prefixes, and phonetic methods catch sound-alikes. Robust screening combines them.

Phonetic algorithms

Some variants are not spelling errors but sound-alikes: names that are pronounced similarly but written differently. Soundex, one of the oldest phonetic algorithms, reduces a name to a code based on its consonant sounds, so that Robert and Rupert, or Catherine and Kathryn, collide. More sophisticated schemes such as Metaphone and Double Metaphone handle a wider range of pronunciations and languages. Phonetic matching is powerful for cross-lingual transliteration but can be noisy, generating many candidates that then need finer scoring.

Token and structural methods

Names are multi-part, so comparing them as whole strings is often wrong. Token-based approaches split names into components and compare the sets, using measures like Jaccard similarity or token sort ratios that ignore word order, so that Ali Hassan and Hassan Ali still match. These methods handle reordered given and family names, missing middle names, and extra tokens such as titles far better than character-level distance alone.

Thresholds and the false-positive problem

Every fuzzy method produces a score, and the firm must set a threshold above which a comparison counts as a potential hit. This is the central tension of screening:

• Set the threshold too low (loose) and you generate enormous volumes of false positives, overwhelming analysts and slowing payments.
• Set it too high (strict) and you risk missing a true match, a compliance failure with severe consequences.

Because sanctions liability is strict, firms generally err toward catching more and tuning down false positives through additional signals: date of birth, nationality, secondary identifiers, and known aliases published on the lists. Good screening is less about one clever algorithm and more about layering methods, incorporating structured identifiers, and continuously tuning thresholds against real alert outcomes.

Beyond classical algorithms

Increasingly, screening blends classical string metrics with machine-learning models that learn from historical analyst decisions which alerts were true or false, helping to suppress repetitive false positives without lowering true-match sensitivity. But the classical algorithms remain the transparent, explainable core, and regulators expect firms to be able to explain why a given match did or did not fire.

Key takeaways

• Exact matching fails on sanctions names because of transliteration, reordering and typos, so fuzzy matching is essential.
• Levenshtein measures edit distance; Jaro-Winkler scores similarity and rewards shared prefixes, making it popular for names.
• Phonetic methods (Soundex, Metaphone) catch sound-alike and cross-lingual variants.
• Token-based methods handle reordered and missing name components that character distance misses.
• Threshold tuning trades false positives against missed matches; strict sanctions liability pushes firms to catch more and refine with secondary identifiers.