TL;DR: Sanctions screening requirements for banks are the controls that keep a U.S. institution from dealing with blocked persons and prohibited jurisdictions. OFAC does not prescribe one program design; examiners test list coverage, the timing of customer and payment screening, escalation, and whether block and reject reports and records meet the deadlines. On October 13, 2026, OFAC settled with Bank of America for $11,662,930 over 475 apparent violations tied to alert handling, list-update lag, and payments through blocked banks.
The Requirement Is a Program
Sanctions screening requirements for banks are a program obligation. OFAC FAQ 25 states that no single compliance program fits every institution, and that OFAC is not a bank regulator. U.S. banks, including foreign branches, are bound by every program OFAC administers. A payment to a blocked person is an apparent violation even when the manual never named that payment type.
OFAC's Framework for Compliance Commitments names five components it weighs in an enforcement case: management commitment, risk assessment, internal controls, testing and auditing, and training. The controls identify, interdict, escalate, report, and record prohibited activity, and they update when lists or programs change. Under the Economic Sanctions Enforcement Guidelines, an effective program at the time of an apparent violation can mitigate a civil penalty.
Examiners review the program in the FFIEC BSA/AML Examination Manual against the bank's products, customers, and geographies. OFAC FAQ 27 flags international wires and trade finance as the operations where OFAC risk usually concentrates. A filter that skips a line the risk assessment itself calls higher risk will not hold up.
A funds transfer through a U.S. bank with a designated party must be blocked. A payment order cannot be canceled or amended after the bank receives it without OFAC authorization, so the screen finishes before release.
Which Lists, and Which Names
Each list carries its own action, and the program has to say which. A confirmed match to the SDN List is ordinarily a block. The Sectoral Sanctions Identifications List, the Foreign Sanctions Evaders List, the Non-SDN Chinese Military-Industrial Complex Companies List, and the Correspondent Account or Payable-Through Account List restrict particular activity: a rejected payment, a barred correspondent account, or a limit on the transaction type.
Country and region logic sits beside the name check. Comprehensive sanctions programs prohibit a dealing with a jurisdiction even when no listed person appears on the instruction. Address, country, and region fields belong in the filter with the parties.
Related parties are screened with the accountholder. FFIEC procedures ask about beneficiaries, guarantors, principals, beneficial owners, nominee shareholders, directors, signatories, and powers of attorney. Intermediary and correspondent banks on a payment belong in that set. A clean result on the customer's own name leaves open whether owners, aggregated, make the entity blocked. That analysis is the OFAC 50 percent rule, run as its own control.
Offices outside the United States also screen United Nations designations, the European Union consolidated list, and the UK Office of Financial Sanctions Implementation list. FATF Recommendations 6 and 7 require a freeze, without delay, of assets tied to terrorism or proliferation designations. A U.S. exam tests OFAC. A foreign office that loads only the SDN file can miss a local designation.
Customers and Payments Are Separate Screens
Customer screening decides whether the bank should hold the relationship. Payment screening decides whether this instruction can move.
OFAC FAQ 28 leaves the rescreen schedule to the bank's procedures. The designation date still governs: a person added on Tuesday is blocked on Tuesday, before the next scan. Missing that window can mean a transfer to a blocked person and an enforcement action.
Payment screening follows the lines in the risk assessment: ACH, cross-border wires, trade finance, monetary instruments, check cashing, trusts, loans, deposits, and investments, with the method allowed to differ by line. The filter reads intermediary banks along with the originator and the beneficiary. In the Bank of America case, a routing directory sent customer payments through banks OFAC had already blocked.
Fuzzy Matching Is a Risk Setting
Examiners grade the calibration. FFIEC procedures ask whether the filtering criteria can reasonably identify an OFAC match, including misspellings and name derivations, at a sensitivity that fits the product. Higher-risk, high-volume activity calls for software that catches close name derivations, because the SDN List publishes variants and still omits others. Lower-risk, low-volume banks may screen manually. A high volume of false hits is a reason to review the interdiction program. Thresholds and transliteration are covered in sanctions screening name matching. The program requirement is a documented decision that this sensitivity matches this product.
Exact matches fail for a different reason. OFAC cited Bank of America for failing to prioritize alerts on customers who were exact name and date-of-birth matches to blocked persons.
Escalation, Block, and Reject
An alert opens a file. The institution assesses the information it holds, gathers more when the first comparison leaves the hit unresolved, and decides whether to block, reject, or proceed. FFIEC procedures test that investigation, the escalation path, and whether management hears about blocked and rejected items.
False hits are cleared outside the business line. The sanctions function, or a unit independent of the desk that wants the payment to go, owns the disposition. The file shows who decided, which fields they compared, and why the screened party and the list entry match or do not.
A true match then forks. A blockable interest goes into a segregated account earning a commercially reasonable rate of interest. Title stays with the blocked person, and debits require OFAC authorization. A prohibited transaction with no blockable interest is rejected. 31 CFR 501.603 requires the initial blocking report within 10 business days. 31 CFR 501.604 requires the rejection report in the same window, with the parties, the value, the legal authority, and a copy of the transfer instructions. Blocked property is reported again annually, due to OFAC by September 30.
Suppression rules sit under the same governance as the threshold. Bank of America automatically released a new alert when it shared the criteria of an earlier false-positive clearance. Payments involving newly blocked banks went out on that old decision. The rule has to distinguish a repeated false positive from a party designated after the original clearance.
Ten Years of Records
31 CFR 501.601 requires a full and accurate record of each transaction subject to OFAC's regulations, available for examination for at least 10 years. Blocked-property records are kept for the period of the block and for at least 10 years after the property is unblocked. OFAC's March 21, 2025 final rule extended retention from five years to 10, matching the statute of limitations for IEEPA and Trading With the Enemy Act violations. Section 3111 of the 21st Century Peace through Strength Act set that period at 10 years on April 24, 2024.
The FFIEC procedures still describe a five-year requirement. The regulation controls.
A record that holds up reconstructs the decision: list version and load time, parties screened, score and threshold, who disposed of the alert and on what information, the payment instructions, the OFAC report and its date, any license, and for a blocked account the amount, owner, interest, and each authorized debit.
What the Examiner Samples
Examiners sample against the risk assessment. They pull new accounts for the timing of the search, and transactions that never become accounts, including monetary instrument sales and check cashing. They check when the filter received the latest OFAC changes and whether each relevant database is in the run. Where the filter looks weak, the procedures tell the examiner to enter test names identical or similar to parties recently added to the list.
They read matches for the block or reject reasoning, and false hits for a clearance made outside the business line. Reports are checked for completeness and the 10-business-day window. Blocked accounts are checked for interest, ownership, the September 30 annual report, and the freeze. Independent testing is judged on independence, coverage of higher-risk lines, and whether findings were fixed. An unreported match triggers immediate notice to OFAC and to the examiner's own agency.
The October 13, 2026 OFAC enforcement release on Bank of America shows those tests failing in production. The bank paid $11,662,930 for 475 apparent violations valued at approximately $14,834,082, running from September 18, 2021 through April 24, 2025. OFAC called the case non-egregious and largely not voluntarily self-disclosed, with no reduction for remediation or cooperation. The programs were Russia, Belarus, Iran, Burma, Somalia, narcotics, and global terrorism. Of those, 403 transactions totaling $14,340,100 moved through 35 blocked banks from February 2022 to March 2025, alongside unprioritized exact name and date-of-birth matches and two blocked-person accounts mishandled by hand.
A name filter catches listed names. A sanctioned party who avoids listed names falls outside it, which is why sanctions evasion red flags are a separate control. An examiner can accept the filter and still cite the absence of a process for what the filter cannot see.
The Clearance Has to Be Explainable
Screening programs fail in the queue when a designation loads late, an exact match sits unworked, or a suppression rule reuses an old clearance. Sphinx's agents review screening alerts in the systems analysts already use, apply the bank's procedures to the parties and the list entry, and write the basis for each disposition. In production, Sphinx reports 87 percent fewer false positives and an 80 percent reduction in case review time, with 98 percent of cases resolved the same day.
Frequently Asked Questions
Does OFAC require a bank to buy screening software?
No. OFAC FAQ 27 says adequacy depends on customers and business, and that the lists are published as text and PDF for manual review, with a free search tool. The FFIEC manual allows manual filtering where risk and volume are low. Wires and trade finance are where examiners expect a system that keeps pace with list changes.
How often must a bank rescreen its customers?
OFAC FAQ 28 leaves frequency to the bank's procedures. A designation takes effect when OFAC publishes it, and the scan calendar does not postpone that. The test is whether a newly listed customer or related party can still transact before the book is compared to the updated list.
What is the difference between blocking and rejecting a transaction?
Blocking applies when a blocked person has an interest in the property. The bank places the funds in a segregated interest-bearing account and reports the block within 10 business days under 31 CFR 501.603. Rejection applies when the transaction is prohibited and there is no blockable interest. The bank does not process it and reports the rejection within 10 business days under 31 CFR 501.604.
How long must a bank keep sanctions screening records?
At least 10 years under 31 CFR 501.601, for each covered transaction, and for blocked property through the block plus 10 years after release. OFAC extended the period from five years effective March 21, 2025. FFIEC procedures that still describe five years lag that rule.
What will an examiner sample in an OFAC review?
New accounts, non-account transactions, and the timing of list updates in the filter. Potential matches and false hits, including whether false hits were cleared outside the business line. Block and reject reports, for the 10-business-day deadline. Blocked accounts, for interest, ownership, and the September 30 annual report. If the filter looks weak, the examiner enters test names from recent list additions.
.png)
