OFAC SDN List

What is the OFAC SDN List?

The Specially Designated Nationals and Blocked Persons List, usually called the SDN List, is a list of individuals, companies, groups, vessels and aircraft that the Office of Foreign Assets Control (OFAC) at the US Department of the Treasury has designated under a sanctions program. OFAC publishes it through its Sanctions List Service. US persons are generally barred from dealing with listed parties, and their property within US jurisdiction is blocked.

This entry defines the list. For the screening process, see sanctions screening, and for alert review, see OFAC sanctions screening automation.

What is the difference between blocking and rejecting?

A match on the SDN List leads to one of two outcomes, and each has its own report to OFAC.

• Blocking. When a bank holds property in which a blocked person has an interest, it freezes the property and files a report. Under 31 CFR 501.603, an initial blocking report is due within 10 business days from the date the property becomes blocked.
• Rejecting. Some transactions are prohibited even though no blocked person's property is involved, for example a payment that would violate a sanctions regulation. The bank declines to process it and files a report under 31 CFR 501.604 within 10 business days of the rejected transaction.

What is the 50 Percent Rule?

An entity can be blocked without being named. Under OFAC's 50 Percent Rule, set out in revised guidance dated August 13, 2014, an entity owned 50 percent or more in the aggregate by one or more blocked persons is itself blocked, even if its name is not on the list. If one SDN owns 25 percent and another owns a separate 25 percent, the entity is blocked.

The rule speaks to ownership and not to control. OFAC says an entity that is controlled but not owned 50 percent or more by blocked persons is not automatically blocked, although OFAC urges caution and may designate it later.

How is the SDN List different from the Consolidated Sanctions List?

OFAC also keeps a Consolidated Sanctions List (Non-SDN Lists), which gathers its other sanctions lists into separate data files. Those entries carry narrower restrictions than a full blocking, so a tool that checks only the SDN List will miss them. The Sanctions List Service offers both lists.

How are the list and its updates published?

OFAC offers the SDN List as downloadable files through the Sanctions List Service, including an XML format and legacy formats described in its data format FAQ. Changes are not on a fixed calendar. OFAC's FAQ 88 says list changes can be sporadic and that each institution decides how often to download them based on its own risk assessment. Each change is announced on OFAC's Recent Actions page.

What does the list mean for bank screening programs?

No statute spells out how a bank must screen against the list. The FFIEC BSA/AML Examination Manual describes a written, risk-based OFAC compliance program as sound practice rather than a specific regulatory requirement. The exposure is still real. OFAC may impose civil penalties on a strict liability basis, meaning a person can be liable without knowing a transaction was prohibited.

OFAC's Framework for OFAC Compliance Commitments, published in May 2019, says a risk-based sanctions compliance program should have five components: management commitment, risk assessment, internal controls, testing and auditing, and training. OFAC says it may weigh an effective program when deciding on a penalty.

What records must a bank keep?

Under 31 CFR 501.601, a person engaging in a transaction subject to OFAC regulations must keep a full and accurate record for at least 10 years after the transaction. For blocked property, the record is kept while the property is blocked and for at least 10 years after it is unblocked. OFAC extended the period from five years in an interim final rule published in September 2024. Alert dispositions and approvals belong in that file, so a clean audit trail matters.

Where do AI employees help with SDN List alerts?

Most alert work is comparison and documentation. An AI employee can pull the customer file, compare identifiers such as date of birth, country and address against the list entry, check ownership data against the 50 Percent Rule, write up the comparison and route the case to a reviewer.

People keep the decisions with legal weight. Closing a confirmed match, releasing a held payment, filing a blocking or rejection report and changing list sources or match thresholds stay with a trained compliance officer. This fits the human in the loop model. Zamp builds AI employees that run back-office work end to end, with approval gates, a Needs Attention queue for items that need a decision and a full audit trail.

Frequently asked questions

Who publishes the OFAC SDN List?

The Office of Foreign Assets Control at the US Department of the Treasury publishes it. OFAC distributes it through the Sanctions List Service and announces each change on its Recent Actions page.

Is a bank legally required to screen against the SDN List?

No statute prescribes a screening method, but OFAC can penalize violations on a strict liability basis. The FFIEC manual treats a written, risk-based OFAC compliance program as sound practice, so banks screen as a core control.

What happens when a payment matches the SDN List?

The bank pauses it and reviews the match. If the match is real and a blocked person has an interest in the property, the bank blocks it and reports within 10 business days under 31 CFR 501.603. If it must decline a prohibited transaction, it rejects it and reports under 31 CFR 501.604.

Can AI agents clear an SDN List alert on their own?

They can gather evidence, compare identifiers, test ownership and draft the disposition. A trained person decides whether a match is real and signs off on any block, release or report, and the approval is recorded in the audit trail.