Handling a Sanctions Hit: The Operational Playbook

A sanctions screening system firing an alert is not the end of a process; it is the beginning of one. What a firm does in the minutes and days after a potential match determines whether it meets its legal obligations or commits a violation. This post walks through the operational playbook for handling a sanctions hit, using the US OFAC framework as the reference example.

Step one: the alert and triage

When a name or other identifier in a transaction matches a sanctions list closely enough to cross the threshold, the payment is typically held and an alert is created. Firms usually operate a tiered review model: a first-level (L1) analyst performs initial triage to weed out obvious false positives, escalating genuine or ambiguous matches to more experienced second-level (L2) and specialist (L3) teams. Speed matters because the payment is stopped, but so does accuracy, releasing a true hit is a serious breach.

Step two: investigate the match

The analyst compares the transaction party against the listed entry using every available identifier: full name, date of birth, place of birth, nationality, address, and any secondary identifiers or known aliases published on the list. The goal is to decide whether this is a true match (the party really is, or is linked to, a sanctioned target) or a false positive (a coincidental name similarity). Documentation of the reasoning is essential; regulators expect a clear, auditable rationale for every disposition.

Step three: block or reject

If the match is genuine, the correct action depends on the sanctions programme and the nature of the target. Under OFAC there is a critical distinction:

• Blocking (freezing): where the target is a sanctioned person or entity, the firm must freeze the funds or property, place them in a segregated blocked account, and not release them. The funds do not go back to the sender.
• Rejecting: where a transaction is prohibited but does not involve blockable property of a sanctioned person, the firm rejects it, declining to process and returning it, without seizing the funds.

Choosing wrongly, releasing what should be blocked or seizing what should be rejected, is itself a compliance failure, so this decision is made carefully and often with compliance and legal input.

The block-versus-reject decision is the crux of the playbook: freeze and report a sanctioned party's property, or reject a prohibited transaction, but never quietly let it through.

Step four: report

Sanctions actions carry mandatory reporting. Under OFAC rules, firms must report blocked property, generally within 10 business days of blocking, and also report rejected transactions. In addition, firms file an annual report of all property blocked as of a set date. Missing these reports is a violation independent of the underlying transaction. Other jurisdictions have their own competent authorities and reporting deadlines, but the principle, prompt reporting of frozen assets, is universal.

Step five: escalate, document and monitor

Handling a hit does not end with one transaction. Firms should:

• Escalate confirmed matches to compliance leadership and, where appropriate, seek an OFAC licence if there is a legitimate basis to release specific funds.
• Review the whole relationship, not just the single payment, since a true match may implicate the customer entirely.
• Document everything, the alert, the evidence compared, the decision and its rationale, to withstand later examination.
• Feed back confirmed false positives to tune screening rules and reduce repeat alerts without lowering sensitivity.

Why discipline beats speed

The pressure to clear alerts and release held payments is real, but sanctions liability is typically strict: intent is not required for a violation, and penalties are severe. A disciplined, documented playbook, consistent triage, careful true-match analysis, correct block-or-reject action, and timely reporting, is what protects the firm. Under-screening invites penalties; over-releasing invites disaster.

Key takeaways

• A screening alert holds the payment and starts a tiered (L1/L2/L3) investigation.
• Analysts compare all identifiers, name, DOB, nationality, aliases, to classify true match versus false positive, with documented reasoning.
• True matches require the right action: block and freeze a sanctioned party's property, or reject a prohibited transaction.
• OFAC requires reporting blocked property (generally within 10 business days) plus an annual blocked-property report.
• Sanctions liability is strict, so disciplined documentation and correct action matter more than speed.