OFAC screening requirements: a policy setup checklist

Define what your organization needs to check

A workable OFAC screening process starts with the parties you deal with and the work you do. Have the responsible legal and compliance team set the scope, review points and decisions. OFAC FAQ 11 explains who must comply; it does not prescribe one software purchase for every business.

SanctionsKit can put parts of that policy into the daily workflow. First write down who screens, who reviews, which outside checks are required and how evidence will be kept.

When you are ready to evaluate a tool, the OFAC screening software overview connects those requirements to source selection, match review and retained evidence. Compare production plans after checking the sources and monthly screening capacity your team needs.

Set source coverage and review rules

An owner or administrator can create a policy in Screening policies. State its purpose and the jurisdictions it covers. Define required and optional sources for each subject type, including SDN and non-SDN coverage when needed and available.

Choose Standard or Focused matching deliberately. Focused can omit candidates a broader setting returns, so fewer alerts alone do not show a better check. API clients send policy: { id, version } with exactly one permitted coverage selector.

Give outside checks and approvals an owner

A list check does not find the owners of a company or decide whether a planned activity is allowed. Add required external checks for that work. The reviewer must record the outside assessment and link its evidence in the case.

Check Production permissions in Settings. Billing access does not make someone a reviewer. An API key cannot act as a human approver. Name who can investigate the case and who can give a separate approval.

Decide when to repeat checks and retain evidence

Set how often monitoring should run and which changes call for a new check. Choose the event that starts retention: review completion, the end of a relationship or another business event. Name who must record that date.

OFAC's 2025 amendment extended certain recordkeeping duties to ten years. That is not one clock that starts at every search. Use the recordkeeping guide with your legal and records team. They need to decide which rule applies, then map it to the settings.

Test the whole process before relying on it

In Sandbox, use invented subjects to test a candidate, a no-match and an incomplete check. Follow each into required external work and approval. Synthetic success verifies the workflow, not live source coverage.

For authorized Production use, confirm current source availability and inspect a retained result with its policy version. A required-source failure must leave the check incomplete. Review monitor failures and whether the team can keep up with review work.

Frequently asked questions