How to investigate a sanctions screening alert

On this page

Define the question before gathering more data

A screening investigation begins with a specific candidate and subject. Ask whether they are the same identity. Do not begin by trying to prove that the customer is risky, and do not treat an unconfirmed match as a fact in other systems.

Capture the original result, selected coverage, and source version. OFAC’s match guidance is a useful authority for OFAC candidates, while other lists need their own restrictions and source material.

Establish source provenance

Open the original authority entry or the retained representation used for the check. Verify the source identifier, record type, aliases, and available distinguishing fields. A search-engine snippet or copied third-party profile may omit important context.

When the same party appears in several databases, inspect whether the entries are independent authority records or redistributed versions of the same data. Repetition alone does not strengthen the identity evidence.

Compare fields at their real precision

Names, dates, countries, identifiers, and addresses have different evidential value in different cases. Preserve approximate or multiple dates and the issuer of identifiers. Do not use a missing field as a conflict or assume every historical address must agree.

An invented organization comparison may turn on whether two registration numbers refer to the same registry and whether one is historical. That is a more useful next question than repeatedly lowering the name-matching threshold.

Gather only the evidence needed to resolve the gap

Identify the fact that would distinguish the competing explanations. Obtain it through an approved process and record the source, date, version, and access reference. Keep personal documents outside broad notification channels.

If the available evidence cannot resolve the comparison, state that limitation. “Unresolved pending reliable identifier evidence” is a more accurate conclusion than either an unsupported confirmation or an unsupported dismissal.

Separate identity from restrictions and ownership

A confirmed identity does not answer every legal question about a proposed activity. Read the applicable measure and obtain an authorized decision. Ownership diligence may also matter for an unlisted organization under OFAC’s 50 Percent Rule.

SanctionsKit does not build the ownership graph or decide whether an authorization applies. Link those separate assessments to the case rather than representing them as automatic outputs of name screening.

Make the investigation reproducible

Write the supporting facts, conflicts, unknowns, identity conclusion, scope, approvals, and next action. Preserve the original record and any later correction. A reviewer should understand both why the candidate was found and why the final decision followed.

Use the decision-note guide for a template. Use ongoing monitoring where policy requires later changes to be returned to review.