What an OFAC Check Covers
An OFAC check is the act of looking up one customer, company, or address against the lists OFAC maintains, mainly the SDN list. It answers a narrow question: is this exact party blocked right now? What it does not answer, and what follows below, is everything around that lookup. The OFAC sanctions hub collects the related guides.
The scope is worth stating plainly. A check covers the party in front of you: the person opening an account, the company behind a payment, the address receiving a withdrawal. It compares identifiers, names and spellings for people and firms, addresses for chain activity, against the current version of the list, mainly the SDN list. The comparison targets exact and near matches, because lists store transliterated names that never settle into one spelling.
What a single check does not do is just as important. It does not watch the party over time, which belongs to continuous screening. It does not see through company structures, which is the 50 percent rule problem. And it is not the whole screening program, only its most repeated move. The sanctions screening guide in this family covers the process end to end, while this page slows down on the single lookup itself.
How to Run an OFAC Check, Step by Step
A working OFAC check has four moves: pin down the identifiers, run the search, judge the hit, and file the record. The official search tool makes the second move free, so the skill lives in the first and third. Do all four and one lookup becomes evidence; do only the second and it stays a glance.
| Move | What you actually do | Common failure |
|---|---|---|
| 1. Pin the identifiers | Collect full name, aliases, and address | Screening a nickname |
| 2. Search | Check against the current list | Searching a stale copy |
| 3. Judge | Decide hit or lookalike | Freezing on any match |
| 4. File | Store result, version, decision, date | No record kept |
Start with identifiers, because a check is only as good as its input. A passport spelling, a former company name, a receiving address: each is a search key. The list entry you are trying to catch may be stored under a transliteration, so gather the variants before searching, not after a miss.
For a one-off lookup, the official tool is the Sanctions List Search that OFAC hosts. Type the name, set how strict the match must be, and read the results with the program codes attached. The search approximates spellings on purpose, which means it returns maybes, not verdicts. For address-level checks in chain activity, the same list applies, but the lookup moves from names to the address itself, the angle the wallet screening family treats as its main subject.
Judging a hit is the part worth practicing. A shared name is not a match; a shared name plus country plus program code might be. OFAC's own FAQ guidance on screening matches tells you what the agency expects: work the false positives down with evidence, not with the delete key. The traps in the next section are the field guide.
Then file it. Input, list version, raw result, your decision, your name, the date. Six fields, one row, and the check becomes something you can hand to an examiner months later.
Two small habits make that record stronger. Note the exact list version, not just the date, because versions move within a day and the difference answers questions before they are asked. And store the query exactly as you ran it, including the strictness setting, because that is the only way a second person can repeat your check and land on your result.
When single checks add up to a program, the OFAC sanctions hub maps the wider ground.
Name-Match Traps: Why Clean Companies Get Flagged
Most OFAC check alerts are lookalikes, not hits: transliterated names that split and recombine, shared name fragments that read as one person, and common tokens doing double duty. Knowing the trap patterns is what separates fast triage from frozen payments and panicked escalations.
Transliteration is the deepest trap. A name moving between alphabets lands in several spellings at once, hyphens appear and vanish, and one record can split into fragments that each half-match something on the list. A single matching fragment is enough to hold a legitimate transfer while someone decides whether the match is real, and teams that have run a book for a year know the pattern firsthand.
Shared fragments are the second trap. List entries carry long formal names; customers type short ones. A two-token company name can sit inside a five-token listed entity, and a naive match calls it a hit. Country fields help, until the honest customer and the listed entity share one.
A third trap is quieter: the copy-paste identity. One field swapped between two customers, an address reused across accounts, a company number mistyped, and the check runs against a party that does not exist. Input hygiene is the defense, which is why the first move in the table above is not boilerplate; it is where a real share of the misses are actually caught.
The defense is triage with structure. Compare the full identifier set, not the single matching token: date of birth, country, program code, address history. Kill the lookalike with evidence and write one line saying why. Teams that batch this discipline keep false positives cheap; teams that improvise it either freeze clean customers or, worse, wave hits through to make the queue move.
OFAC Check Records That Hold Up in an Audit
An audit grades the paper trail: what was checked, which list information was relied on, who judged the hit, and when. Storing screening results as checks run supplies part of that trail. The institution must also retain the list evidence, human reasoning, approvals, and other records required for its process; an API screening log alone does not establish that the full file is complete.
The pattern regulators reward is boring on purpose. Before the transfer: the check ran. During the alert: a named person decided. After: the row exists, with the list version attached. Rebuild that for one customer out of ten thousand, on demand, and the audit takes an afternoon. Fail to, and the same audit becomes archaeology.
This is where address-level tooling fits the OFAC check itself. Phalcon Compliance covers the address side, screening addresses and transactions, with sanctioned entities among the risk categories it flags. Audit Logs write timestamped records of screening events and risk level changes. Your team's notes sit beside them, supporting the fourth move in the table without replacing person-side identity evidence or the institution's approval records.
The OFAC sanctions hub collects the full family: the list itself, the rules that reach past it, and the program a regulator expects you to have around all of it. The Phalcon Compliance page covers plans and pricing.