AML Sanctions Screening: A Complete Guide for Fintechs

Sanctions screening is the process of checking customers, counterparties, and transactions against government-issued lists of prohibited individuals, entities, and countries to ensure that a fintech does not process transactions that violate sanctions laws. It is one of the most non-negotiable compliance obligations in financial services — the consequences of sanctions violations are among the most severe in the regulatory landscape.

This guide covers what sanctions screening is, what programs it must cover, how to implement it, and what happens when it fails.

What Sanctions Screening Is

Sanctions screening involves comparing customer names, transaction counterparties, and other relevant identifiers against sanctions lists maintained by regulatory authorities. For US businesses, the primary sanctions authority is the Office of Foreign Assets Control — OFAC — which maintains the Specially Designated Nationals list and administers dozens of country and program-specific sanctions regimes.

An OFAC match — a true positive where a customer or counterparty is confirmed to be on the SDN list — requires the transaction to be blocked and the blocking to be reported to OFAC. Processing a payment to a sanctioned person or entity is a strict liability violation — intent is not a defense.

For a comprehensive overview of OFAC's compliance framework, see our guide on OFAC sanctions screening. For a detailed guide on how to conduct OFAC screening, see our guide on how to conduct OFAC sanctions screening.

What Programs Sanctions Screening Must Cover

OFAC administers more than 30 separate sanctions programs, including country-based programs covering Cuba, Iran, North Korea, Russia, and Syria, and list-based programs covering narcotics traffickers, weapons proliferators, terrorist organizations, and corrupt government officials.

Depending on your business model and international exposure, additional screening may be required against sanctions programs administered by the European Union, United Nations, UK Office of Financial Sanctions Implementation, and other international bodies.

When Screening Must Occur

Sanctions screening must occur at customer onboarding, when existing customer information changes, when new transaction counterparties appear, and — for payment fintechs — at or before the time of payment processing. Screening at onboarding alone is insufficient; customers who were not sanctioned at onboarding may become sanctioned later, and transactions may involve counterparties who were not previously screened.

Fuzzy Matching

Sanctions evasion frequently involves minor variations in name spelling, use of transliterations, and alternative entity names. Effective sanctions screening requires fuzzy matching — algorithms that flag names that closely resemble sanctioned names even without exact character matches. Systems relying solely on exact matching create unacceptable gaps.

Managing False Positives

Fuzzy matching generates false positive alerts — names that resemble but are not actually the sanctioned person or entity. Managing false positives requires a defined alert review process, clear criteria for clearing non-matches, documented rationale for cleared alerts, and escalation procedures for potential true positives.

High false positive rates that are poorly managed — alerts that pile up unreviewed — are a significant examination finding. Both the screening coverage and the alert review process are evaluated by regulators.

Consequences of Sanctions Violations

OFAC civil penalties can reach $1 million or more per violation — or twice the transaction value, whichever is greater. Criminal penalties for willful violations include substantial fines and imprisonment. Beyond penalties, sanctions violations can result in loss of correspondent banking relationships, reputational damage that is difficult to recover from, and loss of financial services licenses.

OFAC's enforcement history includes penalties against fintechs and cryptocurrency businesses for failures in sanctions screening — these are not theoretical risks.

Frequently Asked Questions

Is sanctions screening the same as AML screening?

Sanctions screening is a component of AML compliance, but the two are distinct obligations with different legal bases. Sanctions screening is required by OFAC regulations and applies regardless of whether a transaction is suspected of involving money laundering. AML screening includes broader transaction monitoring for suspicious activity patterns that extends beyond sanctions compliance. Payment screening often incorporates both.

What should I do if I discover I processed a transaction to a sanctioned party?

Immediately escalate to senior compliance leadership and legal counsel. OFAC requires prompt blocking of any property that comes under control of a sanctioned party. Voluntary self-disclosure is treated as a significant mitigating factor by OFAC and typically results in substantially reduced penalties compared to discovered violations. Do not delay self-disclosure.

How ComplyOne Helps

ComplyOne helps fintechs design and implement sanctions screening programs — from coverage mapping and technology selection through alert management, OFAC reporting procedures, and examination preparation — through advisory services, compliance technology, or both.

Talk to the ComplyOne team to get started.

The information in this article is for general educational purposes and does not constitute legal or regulatory advice. Consult a qualified compliance professional for guidance specific to your situation.