Governments maintain sanctions lists naming individuals, companies, and countries that regulated entities are prohibited from transacting with. Sanctions screening checks names, entities, and sometimes vessels or addresses against these lists at onboarding and, for financial institutions, on an ongoing transaction basis.

Name matching is genuinely hard: transliteration from other alphabets, common names, and deliberate misspellings all generate matches that need investigation before being cleared or escalated. The volume of alerts at a large bank can run into the thousands per month, the vast majority of which are false positives once investigated.

Frequently Asked Questions

Which watchlists does sanctions screening typically check?

OFAC (US Treasury), UN Security Council sanctions, EU consolidated lists, and UK OFSI are the most commonly referenced, though the exact set depends on where the institution operates and which regulators it answers to.

Why are most sanctions alerts false positives?

Name-matching algorithms are deliberately tuned to catch too much rather than too little, since missing a genuine match carries severe regulatory consequences. This means a common name that happens to partially match a sanctioned individual triggers an alert even when there's no real connection.

What happens once a real match is confirmed?

The transaction is typically blocked or frozen, and the case is escalated for deeper investigation, often including a suspicious activity report to the relevant regulator, depending on jurisdiction and severity.

Why do sanctions screening teams struggle to scale with volume?

Because every alert, regardless of how likely it is to be a false positive, requires the same rigorous, documented investigation before disposition, a fixed-size team's capacity gets consumed by noise, leaving less bandwidth for the small number of alerts that represent genuine risk.