Sanctions Screening Explained
OFAC, UN, EU, UK OFSI & the 2026 Landscape
Sanctions failures carry the largest fines in compliance — BNP Paribas $8.9B, Standard Chartered $1.1B, Commerzbank $1.45B. This guide covers the major sanctions regimes, the 50% Rule, primary vs secondary sanctions, and real screening workflows from JPMorgan, Goldman Sachs, Barclays, and Emirates NBD.
Sanctions screening is the highest-consequence control in any KYC programme. Breach a sanction — even inadvertently — and you are not looking at a regulatory fine; you are looking at criminal liability, secondary sanctions exposure, and potential loss of USD clearing access. That is why sanctions enforcement produces the biggest fines in compliance: BNP Paribas $8.9B, Commerzbank $1.45B, Standard Chartered $1.1B, ING $775M, and HSBC $1.9B all trace, at root, to sanctions breakdowns.
This guide walks you through the six major sanctions regimes every KYC analyst must know, how primary and secondary sanctions actually work, the OFAC 50% Rule (the single most-tested sanctions question in interviews), sectoral vs country-based sanctions, the screening workflow from alert to disposition, false positive management, and the 2026 sanctions landscape with Russia, Iran, and new crypto/VASP obligations. Used daily by KYC teams at JPMorgan, Goldman Sachs, Barclays, BofA, Citi, BNY, State Street, Emirates NBD, HSBC, eClerx, Genpact, and Revolut.
What Is Sanctions Screening? The One-Sentence Version
Unlike CDD (which produces a risk rating) or PEP screening (which triggers EDD), sanctions screening is binary: either the customer is blocked or they are cleared. There is no “approve with conditions” option if a sanctions hit is confirmed.
The 6 Major Sanctions Regimes Every KYC Analyst Must Know
OFAC — Office of Foreign Assets Control (US)
The most consequential sanctions regime globally because it controls access to the USD financial system. Administered by the US Treasury Department. Key lists include the SDN (Specially Designated Nationals) list, the sectoral sanctions lists, the NS-MBS list, and country-based programmes (Iran, North Korea, Syria, Cuba, Russia-linked, Venezuela, Belarus).
Scope: Binds US persons, US subsidiaries, and anyone transacting in USD or touching US correspondent banking. This is why OFAC effectively reaches global finance — almost every cross-border transaction touches USD clearing.
UN Security Council Sanctions
Issued by the United Nations Security Council under Chapter VII resolutions. Member states are legally required to implement UN sanctions into domestic law. Focus areas include North Korea (DPRK), ISIL/Al-Qaida, Taliban, Somalia, Yemen, Libya, and others.
Scope: Globally binding in principle; actual enforcement depends on domestic transposition. Every UN Member State implements UN sanctions, but with national variations.
EU Consolidated Sanctions List
Administered by the European Commission; implemented through EU Council Regulations. Covers restrictive measures against third countries, entities, and individuals across the EU’s foreign policy tools. Major active programmes: Russia (heavily expanded post-2022), Belarus, Iran, Syria, Myanmar, Venezuela.
Scope: Binds all EU persons, EU-incorporated entities, and non-EU persons conducting business in the EU.
UK OFSI — Office of Financial Sanctions Implementation
Administered by HM Treasury. Post-Brexit the UK operates its own sanctions regime separate from the EU. OFSI maintains the UK Sanctions List, and sanctioned parties are identified under the specific UK statutory instruments.
Scope: Binds all UK persons worldwide and all persons within the UK — so any bank with a UK branch or UK-based customer must screen against OFSI.
HMT — HM Treasury Consolidated List
HM Treasury’s consolidated list of targets of financial sanctions sits alongside the UK Sanctions List and provides the operational list for financial institutions. Updates are frequent; screening providers refresh as near-real-time as possible.
Regional & National Sanctions
Every KYC operation in a given region must also screen local sanctions: DFSA (Dubai), CBUAE (UAE federal), MAS (Singapore), HKMA (Hong Kong), MOF Japan, RBI + FIU-IND (India, often via UN lists plus national targeted sanctions under UAPA), FINTRAC (Canada, enforcing SEMA & CCFA regimes), AUSTRAC (Australia, enforcing DFAT sanctions). Multi-jurisdictional banks screen against a union of all applicable lists.
Primary vs Secondary Sanctions (Why This Matters Globally)
The distinction between primary and secondary sanctions is one of the most-tested concepts in senior KYC and sanctions-officer interviews. It is also one of the most commonly misunderstood.
Primary Sanctions
Binding directly on persons within the jurisdiction of the sanctioning authority. OFAC primary sanctions bind US persons, US subsidiaries, and transactions touching US jurisdiction (USD clearing, US tech, US nexus). UK OFSI primary sanctions bind UK persons worldwide and anyone in the UK. EU primary sanctions bind EU persons and entities.
Secondary Sanctions
Extend the sanctioning authority’s reach beyond its own persons. OFAC’s secondary sanctions, for example, threaten non-US persons with loss of access to the US financial system if they transact with certain sanctioned parties — even when no US nexus exists in the transaction itself. This is the legal mechanism by which OFAC sanctions effectively reach global finance.
Real-world example: A UAE-based bank processing Iran-related transactions with no US nexus is not directly bound by US primary sanctions — but it could lose its US correspondent banking relationships (loss of USD access) under secondary sanctions exposure. Most global banks treat secondary sanctions compliance as equivalent to primary compliance for this reason.
The OFAC 50% Rule (The Most-Tested Interview Question)
Any entity owned 50% or more — directly or indirectly, individually or in aggregate across sanctioned parties — is itself treated as sanctioned under OFAC rules, even if not explicitly listed on the SDN list.
The 50% Rule forces banks to trace ownership chains and aggregate sanctioned shareholders across the structure. A company owned 30% by one SDN and 25% by another SDN — neither alone meeting 50% — is treated as sanctioned because the aggregate of sanctioned ownership is 55%. This rule is why UBO tracing accuracy is so important in sanctions screening.
Worked 50% Rule example
Structure: A Cyprus holding company is 30% owned by Ivanov (SDN-listed), 25% owned by Petrov (SDN-listed), 25% owned by a clean party, and 20% owned by another clean party.
Analysis: Aggregate sanctioned ownership = 30% + 25% = 55%. Under the 50% Rule, the entire Cyprus holding is treated as sanctioned — and any entity it owns above 50% inherits the same status.
Practical consequence: A bank approving this relationship without aggregating the two sanctioned owners is in breach of OFAC rules. This is the exact fact pattern that produced several multi-hundred-million-dollar fines between 2018 and 2024.
Sectoral vs Country-Based vs Targeted Sanctions
Country-Based Sanctions
Broad prohibitions against transacting with an entire jurisdiction. Examples: US sanctions on North Korea, Iran (with specific exceptions under nuclear agreements), Cuba, Crimea (regional). These are comprehensive programmes that touch most or all transactions with the named country.
Sectoral Sanctions
Target specific sectors of an economy (energy, defence, finance) or specific activities (new debt and equity issuance) rather than the country entirely. OFAC’s sectoral sanctions on Russian energy and financial firms are the most prominent example. Complex to operationalise — you may transact with a sectorally-sanctioned entity for permitted activities but be barred from others.
Targeted / List-Based Sanctions
Sanctions targeting specific named individuals or entities (the SDN list, UN 1267 Consolidated List, EU’s entity-specific designations). These are the day-to-day bread of screening — every customer, beneficial owner, director, authorised signatory, and counterparty is screened against these lists.
The Screening Workflow — From Alert to Disposition
Screening itself is highly automated. Where analyst judgement matters is the disposition of alerts — the decision of whether an alert is a true match requiring block, a possible match requiring investigation, or a false positive requiring clearance.
Automated Screening Engines
Customer onboarding triggers an automated screen across OFAC SDN, UN Consolidated, EU, UK OFSI, HMT, and local sanctions lists simultaneously. Matching algorithms use fuzzy-match logic — exact-match, sound-alike (phonetic), transliteration-aware, and name-order flexible — because sanctioned parties routinely use name variants.
Typical tools: LexisNexis Bridger, Dow Jones Risk & Compliance, Refinitiv World-Check, Accuity, Fircosoft, in-house engines for larger banks.
Alert Triage — The L1 Analyst Role
Every alert appears in a sanctions queue. The L1 analyst runs initial triage: compare secondary identifiers (DOB, nationality, place of birth, address, occupation, known family members, employer). Most alerts at this stage are false positives — the name matches but the secondary identifiers disprove the match.
Critical rule: Never clear a name-match alert based on the name alone. Always triangulate with at least two secondary identifiers.
Escalation to Sanctions Officer
Alerts that cannot be dispositioned cleanly as false positives at L1 go to a dedicated Sanctions Officer or L2 reviewer. This reviewer applies deeper investigation: open-source intelligence, cross-referenced screening across multiple vendors, direct engagement with the customer’s front-office relationship manager for additional context, and consultation with legal where the transaction structure is ambiguous.
Decision — Block, Freeze, Clear
Outcomes of the sanctions investigation:
- Confirmed true match: Block the relationship or freeze any accounts under domestic asset-freeze rules, file required regulator notifications (e.g., OFSI reporting in the UK, FinCEN notification in the US), and document the block decision.
- Possible match — investigation incomplete: Hold the transaction or relationship pending resolution; escalate to Head of Compliance where urgency demands.
- False positive: Clear the alert; document the basis of clearance with named analyst, date, and corroborating secondary identifiers. Add to the “known cleared” list with appropriate re-review cycle.
Ongoing Re-Screening
Sanctions lists are updated constantly. Every customer is re-screened on a cycle (daily for high-risk populations, weekly or monthly for lower-risk) to detect newly added parties. List updates drive most of the ongoing alert volume at tier-1 banks.
Managing False Positives
At any global bank, 95–99% of sanctions alerts are false positives. Managing this volume is its own discipline — if you drown in false positives, you miss real matches.
Why False Positives Are So Common
- Common surnames (Khan, Ahmed, Kim, Lopez, Petrov) have many sanctioned namesakes
- Fuzzy-match algorithms intentionally cast a wide net
- Transliteration from non-Latin scripts creates name variants
- Name-order differences (Western vs Asian vs Arabic conventions) trigger alerts
- Geopolitical events rapidly expand lists, driving alert surges
Managing Volume Without Missing True Matches
- Tune matching algorithms to your customer book’s demographic and geographic profile
- Use strong secondary-identifier triangulation — DOB, nationality, address
- Maintain a “known cleared” list with defined re-review cycles
- Invest in premium screening tools (Dow Jones, LexisNexis, Refinitiv World-Check are considered market standards)
- Use rule-based rejection of obvious false positives (e.g., a US-resident customer named Ivan Petrov matched against a Russia-based SDN with different DOB and no US ties)
Real-World Scenarios
Scenario 1 — Clear false positive
A customer named “Vladimir Ivanov” applies for a retail account at Revolut UK. Screening alerts: matches three SDN-listed Vladimir Ivanovs in Russia. Secondary identifiers: customer’s DOB differs from all three; customer is UK-resident with UK employer since 2015; customer has no Russia nexus in their file.
Outcome: Clear false positive. Disposition documented with named analyst, date, and the specific secondary-identifier basis for clearance. Customer added to known-cleared list with 6-month re-review cycle. Total resolution time: under 15 minutes.
Scenario 2 — Partial match requires investigation
A KYC analyst at JPMorgan London screens a new corporate customer. The Chief Financial Officer matches 80% to a Sectoral Sanctions List entry with the same nationality and same city of residence, but a different middle name.
Investigation: Sanctions Officer requests corporate HR records, LinkedIn verification, past employer references, and photograph (where available). Identifies that the CFO is a distant namesake but not the sanctioned individual — different employer history, different age band, different career trajectory.
Outcome: Cleared after investigation with detailed disposition memo. Sanctions Officer approval required given the partial match quality.
Scenario 3 — 50% Rule applied correctly
A Cyprus-registered holding company applies for USD correspondent services at Goldman Sachs. Direct shareholder screening shows no hits. UBO trace identifies four individual beneficial owners: two Russian nationals on the OFAC SDN list (aggregate 32%), and two clean individuals (aggregate 68%).
Analysis: Aggregate sanctioned ownership under 50% — structure not treated as sanctioned. However, given the material SDN exposure and the USD relationship nexus, Head of Compliance and dedicated Sanctions Officer approval required. Enhanced monitoring applied. Specific transaction-level screening will run whenever the sanctioned UBOs are involved indirectly.
Change one fact: If the two SDN shareholders together hold 52%, the entire structure is treated as sanctioned under OFAC 50% — no USD correspondent relationship is possible. This is the classic 50% Rule scenario regulators test.
Scenario 4 — Sanctions evasion pattern detected
An established corporate customer at Barclays GCC begins transacting with a new intermediary in Country B (not sanctioned) that routes goods to Country A (sanctioned). Invoice values are precisely at local customs thresholds. Historical activity had no Country A exposure.
Outcome: Immediate freeze of pending transaction. Sanctions Officer and MLRO review. Request for underlying contracts and end-beneficiary documentation. Customer cannot produce credible end-use documentation. SAR filed on sanctions-evasion typology; relationship exited. This is the exact fact pattern producing the largest enforcement actions in the past decade.
The 2026 Sanctions Landscape — What’s Changed
Three major shifts since 2022 have reshaped sanctions work and the associated hiring market.
- Russia sanctions expansion: Since February 2022, the US, UK, EU, Canada, Japan, and Australia have coordinated the largest Western sanctions programme ever imposed on a major economy. Thousands of entity and individual designations, full financial-sector restrictions on named banks, cross-sector prohibitions on energy and technology, and active secondary-sanctions enforcement. Sanctions analyst hiring surged 40–60% across tier-1 banks through 2023–2025.
- Crypto & VASP sanctions enforcement: OFAC has sanctioned individual wallet addresses (Tornado Cash mixer, Garantex exchange, multiple DPRK-linked addresses). The 2023 Binance $4.3B settlement was the largest-ever crypto enforcement, much of it grounded in BSA and sanctions failures. Crypto-focused sanctions analysts — the role C2KO (Certified Crypto KYC Officer) and C2AO (Certified Crypto AML Officer) are designed for — are in short supply at every major exchange and custody firm.
- UK OFSI expanding enforcement: Since Brexit, OFSI has ramped up enforcement, including UK-specific sanctions targeting and the introduction of strict civil-monetary penalties. UK sanctions roles are among the fastest-growing in London financial services.
Model Interview Answer — The 50% Rule
“Explain the OFAC 50% Rule and walk me through how you would apply it to a customer with a complex ownership structure.”
“The OFAC 50% Rule states that any entity owned 50% or more — directly or indirectly, individually or in aggregate across multiple sanctioned parties — is itself treated as sanctioned even if not explicitly listed on the SDN list. In practical terms, I trace the full ownership chain to natural persons or ultimately-controlled entities, identify every SDN-listed owner at every layer, and aggregate their holdings. If the total sanctioned ownership hits 50% or more, the entity is blocked. Critically, I do not assess each sanctioned shareholder in isolation — two owners at 30% each who are both SDN produce 60% aggregate sanctioned ownership. Missing the aggregation is the classic failure pattern in OFAC enforcement actions over the past decade.”
Common Sanctions Screening Failures
Analyst sees a common name, assumes false positive, clears without checking DOB, nationality, or other identifiers. The single most common cause of sanctions breach enforcement. Fix: never clear on name alone.
Structure has two SDN owners at 30% and 25% respectively. Analyst sees neither alone crosses 50% and clears. Missed aggregation produces a blocked-entity relationship that breaches OFAC. Fix: always aggregate sanctioned ownership.
A non-US bank with no US primary-sanctions nexus assumes OFAC does not apply. If any transaction touches USD clearing or US correspondent banking, secondary sanctions risk is material. Fix: treat secondary sanctions compliance as equivalent to primary for global banks.
Screening only the Latin spelling of a customer name misses sanctioned matches that appear only in Cyrillic, Arabic, Chinese, or other scripts with different transliteration conventions. Fix: multi-script screening is essential for international customer books.
Why Sanctions Expertise Accelerates Compliance Careers
Sanctions Officers are among the highest-paid specialists in compliance because sanctions failures carry the worst penalties. Banks pay premium for experienced sanctions analysts and dedicated Sanctions Officers — and the supply of candidates with deep sanctions knowledge is limited.
For KYC analysts building toward sanctions specialisation, role-based credentials help make the signal visible to recruiters. GO-AKS (Globally Certified KYC Specialist) and IKYCA (Internationally Certified KYC Specialist) cover the CDD/EDD and screening execution foundations. IR-KAM (Internationally Certified KYC Manager) extends into the approval and governance work that senior sanctions roles involve. For sanctions work in crypto and VASP contexts — now one of the fastest-growing specialist areas — C2KO (Certified Crypto KYC Officer) and C2AO (Certified Crypto AML Officer) map specifically.
Related Reading
- The Risk-Based Approach (RBA) in KYC: FATF Recommendation 1 Explained
- Source of Funds vs Source of Wealth: The Difference That Decides the EDD File
- Enhanced Due Diligence (EDD) Guide: The Complete 2026 Playbook
- KYC Regulations Explained: FATF, FinCEN, FCA, 6AMLD, DFSA & More
- Top 100 KYC Interview Questions & Model Answers
Nail the OFAC 50% Rule and Sanctions Scenarios
Sanctions officer interviews at Goldman Sachs, JPMorgan, Barclays, and Standard Chartered test the 50% Rule, primary vs secondary sanctions, and evasion typologies through scenarios. Practise out loud on AGZIT’s voice-based AI Mock Interview — with 10-dimension Scorecard feedback after every session.
ATS Resume Builder
Voice-based
10-dimension
Coaching
Elevator pitch
DPR-based
30-day roadmap
Silver/Gold/Platinum
Trusted by KYC candidates targeting roles in Mumbai · Dubai · London · New York · Toronto · Singapore