Sanctions Screening: Names, Fuzzy Matching, and Thresholds

Sanctions compliance ultimately rests on a deceptively simple task: check whether a name in your systems matches a name on a watchlist. In practice, this is one of the hardest matching problems in finance, because names are messy and the cost of a miss is severe. Fuzzy matching and carefully set thresholds are how screening systems cope.

What is being screened against

Screening compares your parties — customers, counterparties, and payment participants — against sanctions and watchlists. The best known is the US Treasury's OFAC SDN list (Specially Designated Nationals and Blocked Persons), alongside consolidated lists from the EU, the UN, and the UK's OFSI. These lists include names, aliases, dates of birth, nationalities, addresses, and identifiers — but real-world data is often incomplete on both sides.

Why exact matching fails

You cannot simply test for identical strings. Sanctioned parties deliberately obscure their names, and legitimate data varies for innocent reasons:

• Transliteration. Names originally in Arabic, Cyrillic, or Chinese have many valid Latin spellings; a single listed person can appear a dozen ways.
• Word order and structure. Given names, family names, and patronymics vary in order and completeness across cultures.
• Typos and abbreviations. Real data contains misspellings, initials, and truncations.
• Aliases. Lists carry known aliases (a.k.a.s), and bad actors invent new variations.

Exact matching would miss all of these, so screening deliberately matches approximately.

How fuzzy matching works

Fuzzy matching measures how similar two names are rather than demanding equality, producing a similarity score. Techniques combine several approaches:

• Edit distance (such as Levenshtein) counts the character changes needed to turn one string into another, catching typos and minor spelling differences.
• Phonetic algorithms (such as Soundex and Metaphone) match names that sound alike despite different spelling.
• Token and n-gram methods compare word components and character sequences, handling reordering and partial matches.
• Transliteration handling normalises scripts and known spelling variants before comparison.

The output is a score, often expressed as a percentage or a value between 0 and 1, representing confidence that the two names refer to the same entity.

The role of thresholds

A threshold is the score at or above which the system raises an alert for human review. Choosing it is the central tuning decision:

• Set the threshold too high and you miss genuine matches — the unacceptable failure, since it can mean processing a payment for a sanctioned party.
• Set it too low and you drown analysts in false positives, which slows business and can itself weaken compliance by hiding real hits in noise.

Because a missed true match is far more damaging than an extra false one, screening is tuned conservatively — thresholds lean toward over-alerting. This is precisely why false positives are endemic to sanctions screening; the asymmetry of consequences pushes settings toward caution.

Improving precision without lowering coverage

The way to reduce noise without missing matches is to screen on more than the name. Adding secondary attributes — date of birth, nationality, address, and identifiers — lets a system keep a low name-matching threshold while confidently dismissing hits where the other details clearly diverge. Good customer data is therefore the strongest lever: a name match plus a matching date of birth is a very different signal from a name match alone.

Other essentials include screening against current, updated lists (sanctions lists change frequently, and stale data creates both misses and needless alerts), screening at the right moments (onboarding, ongoing rescreening, and real-time payment screening), and documenting every tuning choice. Regulators expect institutions to justify their thresholds and matching logic, showing the settings are risk-based rather than arbitrary.

Matching more than personal names

It is easy to fixate on individuals, but screening covers more. Sanctioned entities — companies, banks, vessels, and aircraft — must be matched too, and their names carry their own quirks: legal-form suffixes (Ltd, GmbH, LLC), abbreviations, and trading names all vary. Screening also targets countries and locations, so address and jurisdiction data feed geographic checks, and some programmes screen identifiers such as passport numbers, tax IDs, and vessel IMO numbers, which — when present — are far stronger discriminators than names alone.

Good screening therefore treats a name as one signal among several. The more high-quality attributes an institution can compare, the more confidently its system can promote a genuine hit and dismiss a coincidental one, which is the whole game: maximise true matches while keeping the analyst workload sustainable.

Key takeaways

• Screening compares parties against lists like OFAC's SDN and EU, UN, and UK OFSI lists.
• Exact matching fails because of transliteration, name-order variation, typos, and aliases.
• Fuzzy matching uses edit distance, phonetic, and token methods to produce a similarity score.
• A threshold decides which scores alert; it is tuned conservatively because a missed match is far costlier than a false one.
• Screening on secondary attributes (date of birth, nationality) cuts false positives without lowering coverage.