The Main Sanctions Lists

The OFAC Specially Designated Nationals list, usually called the SDN list, is the most widely screened list in the world. It names individuals, companies, vessels and aircraft, and dealing with anyone on it is prohibited for US persons and for dollar transactions. OFAC also runs country programmes, such as comprehensive sanctions on certain countries, and sectoral sanctions that restrict specific types of business, like new debt or equity, with named entities. A payment to a company that is fifty percent or more owned by an SDN is also blocked, even if the company itself is not listed, which is known as the fifty percent rule. This ownership rule is one reason screening teams must look beyond the exact name on the payment. The United Nations consolidated list is built from Security Council resolutions and covers people and entities linked to terrorism, weapons proliferation and specific country regimes. Because UN sanctions are binding on all member states, banks in nearly every country screen against this list as a minimum. The European Union maintains its own consolidated list of persons, groups and entities subject to financial sanctions, plus country specific measures that can be stricter than the UN baseline. The United Kingdom maintains its own list through the Office of Financial Sanctions Implementation, and many banks also screen against it because of London's role in global payments. Beyond these headline lists, banks screen against many other sources. These include the US Commerce Department entity list, the EU dual use goods lists, adverse media and politically exposed persons lists, and internal lists built from the bank's own past experience. A payment operations BA should know that the screening engine is usually configured with several lists at once, each with its own matching rules and its own action when a hit occurs. The design question is never which single list to use, it is how to combine many lists without drowning operations in alerts that turn out to be harmless. List updates are a daily operational event. The UN Security Council adds names, the EU updates its consolidated list, OFAC publishes changes, and the UK Office of Financial Sanctions Implementation updates its list. Each update must be loaded into the screening system the same day, and the system must be able to prove it was loaded. The most dangerous moment is the gap between the publication and the loading, because a payment made in that gap to a newly listed person will not be flagged. The requirements must state the update frequency, the loading procedure, and the evidence that the update was applied. The lists differ in ways that matter. The UN list is the narrowest, covering only persons designated by the Security Council. The EU list is broader, covering persons designated by the Council of the European Union. The OFAC list is the broadest, covering the Specially Designated Nationals list, the sectoral sanctions, and the comprehensive country programmes for Iran, North Korea, Syria and Cuba. The UK list mirrors the EU list but has diverged since Brexit, and now includes persons the EU does not list. A payment must be screened against every list that applies, and the analyst must know which lists apply to which payment, because a payment to Iran is blocked under OFAC even if the payer is European. Delisting is the reverse process, and it is easy to get wrong. When a person is removed from a list, the screening system must stop flagging them, but the historical alerts must be retained, because the bank must be able to prove it screened correctly at the time. The delisting must be loaded the same day as a listing, and the system must be able to show that a payment made after the delisting was not blocked. A bank that continues to block a delisted person is causing customer harm, and a bank that stops blocking before the delisting is loaded is breaching the law. The procedure must handle both directions. The fifty percent rule is best understood through a worked case. A company in Cyprus is 30 percent owned by a person on the SDN list and 25 percent owned by a company that is itself 60 percent owned by the same person. Direct ownership is 30 percent, below the threshold, and indirect ownership is 25 percent times 60 percent, which is 15 percent, so the total is 45 percent, still below 50 percent. Now suppose a second listed person owns 10 percent of the same company. The aggregate ownership by listed persons is 55 percent, which crosses the threshold, so the company is blocked even though no single listed person owns half of it. The engine must calculate aggregate ownership through company chains, which is why banks buy ownership data from specialist providers. List updates are the operational risk that is easiest to underestimate. Suppose OFAC adds a new name on a Tuesday morning, and the bank's screening engine loads list updates once a day at midnight. A payment to the newly listed person sent on Tuesday afternoon is screened against Monday's list, so it passes, and the bank has knowingly, if unknowingly, processed a payment for a sanctioned party. The fix is to load updates intraday and to run delta screening over payments already processed, so that a payment that passed in the morning is rechecked in the afternoon. A BA should specify the update frequency, the delta screening window, and the alert that fires when an update cannot be loaded, because a list that is a day old is a control that is a day behind. The design question for lists is how to combine many of them without drowning operations in alerts. Each list needs its own matching rules, its own threshold, and its own action when a hit occurs. The OFAC SDN list blocks, the EU list freezes, an adverse media list creates an alert for review, and an internal list may only add a risk score. The BA should define the list inventory, the action per list, and the priority when two lists disagree, because the strictest rule wins and the system must know which one that is. The BA should also define the test pack: a payment that hits each list, a payment that hits two lists at once, and a payment that hits none, because those three cases prove the configuration works.