OFAC SDN List: What It Is and How Screening Works

If you move money that touches the US financial system, one list shapes your compliance more than almost any other: the OFAC SDN list. Understanding what it is, and how screening against it works, is fundamental to sanctions compliance in payments.

What OFAC and the SDN list are

The Office of Foreign Assets Control (OFAC) is a part of the US Treasury that administers and enforces economic and trade sanctions. Its flagship publication is the Specially Designated Nationals and Blocked Persons List (SDN list): a roster of individuals, companies, vessels, and aircraft that US persons are generally prohibited from dealing with. When a party is on the SDN list, their assets within US jurisdiction must be blocked (frozen), and transactions with them are prohibited unless licensed.

Each SDN entry can carry a rich set of data: primary name, aliases (known as AKAs, both strong and weak), dates of birth, places of birth, passport and national ID numbers, addresses, and the sanctions programs under which the party is listed. This detail exists precisely to help institutions distinguish a true match from a coincidental name similarity.

Beyond the SDN: other lists and the 50 Percent Rule

OFAC maintains additional lists, such as the Consolidated Sanctions List and sectoral lists, and screening usually covers several of them. One critical concept is the 50 Percent Rule: any entity owned 50 percent or more, directly or indirectly, by one or more SDNs is itself treated as blocked, even if it does not appear on the list by name. This means screening cannot stop at literal list membership; ownership analysis matters, which is why beneficial-ownership data from KYC feeds into sanctions risk.

How screening works

Sanctions screening compares the parties and details of a transaction — payer, payee, banks, and sometimes free-text fields — against the sanctions lists. The core challenge is that names are messy: transliterations, spelling variants, word order, and missing middle names all mean an exact string comparison would miss real matches. So screening engines use fuzzy matching.

• Fuzzy name matching. Algorithms score similarity between the transaction name and list names, accounting for transliteration (especially from Arabic, Cyrillic, and Chinese scripts), phonetic similarity, and edit distance, so "Mohammed" and "Muhammad" can match.
• Secondary identifiers. When a name scores as a possible hit, the engine compares date of birth, nationality, and ID numbers to confirm or dismiss it.
• Thresholds. Firms tune match thresholds to balance catching true hits against generating too many false alerts.

The false positive problem

Fuzzy matching casts a wide net, so most alerts are false positives — legitimate customers who happen to share a name with a listed party. A common name can generate huge volumes of alerts. Every alert must be reviewed by an analyst, who examines the secondary identifiers to decide whether it is a true match. Tuning is a balancing act: too loose and analysts drown in noise; too tight and a real sanctioned party slips through, which carries severe penalties. Good programs invest heavily in reducing false positives without raising the risk of a missed true hit.

What happens on a real match

If screening confirms a true match, the institution must not process the transaction. Depending on the situation, it must block or reject the transaction and report it to OFAC within the required timeframe (blocked and rejected transaction reports are due within a set number of business days, and blocked property must also be reported annually). Blocking means freezing the funds; rejecting means refusing to process and returning them, depending on the nature of the sanctions and the parties. Getting this wrong — processing a transaction with an SDN — can lead to significant civil or criminal penalties, and liability is largely strict, meaning intent is not required to be in violation.

Key takeaways

• The OFAC SDN list names individuals and entities that US persons are generally barred from dealing with, whose assets must be blocked.
• Entries carry aliases, dates of birth, and ID numbers to help distinguish true matches from coincidences.
• The 50 Percent Rule blocks entities owned 50 percent or more by SDNs even if not named, so ownership analysis is essential.
• Screening relies on fuzzy name matching to handle transliteration and spelling variants, then uses secondary identifiers to confirm hits.
• Most alerts are false positives requiring analyst review; a confirmed match must be blocked or rejected and reported, with strict liability for violations.