What happens if you get an OFAC match? A review workflow

On this page

A possible match is the start of an investigation

A screening alert means the system found a candidate worth comparing. It does not, by itself, mean the customer is the listed party or that a particular transaction must be blocked. Preserve the original result and follow the organization’s escalation process before making a disposition.

First identify the underlying list. OFAC FAQ 5 distinguishes OFAC hits from other screening sources and directs businesses to compare the available information. A combined watchlist result should retain that source distinction.

Stabilize the case and its evidence

Create a clear internal subject reference and retain the screening ID, requested coverage, source version, matching explanation, and candidate record. Assign a reviewer who can obtain additional evidence through an approved channel. Keep the relevant business step in the state required by policy while the review is unresolved.

Do not repeatedly change the search input until the alert disappears. A later search with different facts is a new comparison, not a replacement for the original evidence. Record why a correction was necessary and connect both results.

Compare identity facts before deciding restrictions

Read the complete source entry. Compare entity type, names and aliases, relevant dates, identifiers with issuers, and other available distinguishing facts. The absence of a fact on one side is unknown, not contradictory. A strong identifier is useful only when its provenance and meaning are comparable.

A reviewer can conclude that the identities match, that reliable evidence distinguishes them, or that the evidence remains insufficient. Keep those outcomes separate. “Unresolved” is a meaningful state, not an operational inconvenience to relabel as dismissed.

Escalate the legal question separately

When identity is confirmed, the applicable program, restrictions, authorizations, parties, and proposed activity still need review. Blocking and rejecting are not interchangeable labels. OFAC’s current guidance explains that applicable reporting obligations may follow a valid match and the resulting transaction treatment. Consult the underlying rules and authorized compliance or legal personnel.

OFAC expressly says it does not confirm a business’s potential match or false-positive determination. Its guidance and contact resources help with compliance questions; they are not an outsourced identity-clearance service.

Write the decision and preserve independent review

Document the evidence that mattered, the unresolved gaps, the identity conclusion, the person making it, and the separate business disposition. Reference external records by a stable approved repository location and version. Do not paste full identity documents into a general comment field.

In SanctionsKit, case review retains per-match decisions and can require independent second review under organization policy. Approved external document references do not transfer the original file bytes into the case.

Synthetic example: confirmed identity is not the final action

In an invented case, a customer’s verified identifier matches the identifier and issuer on a fictional listed record. The analyst records a confirmed identity conclusion and the supporting comparison. An authorized specialist then evaluates the relevant restriction and proposed activity. The case distinguishes these two decisions.

For a dismissed candidate, define when the decision must be reconsidered. A new alias, changed identifier, or corrected customer record can reopen the comparison. Never let a broad name-only allowlist hide future candidates.