TL;DR: The OFAC SDN List is the U.S. Treasury's register of Specially Designated Nationals and Blocked Persons — individuals, entities, vessels, aircraft, and digital currency addresses whose property U.S. persons must block and with whom they may not transact. It has no fixed update schedule; according to the Center for a New American Security, 1,764 persons were added in 2025 alone. Liability for a miss is strict, and the IEEPA civil penalty ceiling is $377,700 per violation or twice the transaction value, whichever is greater.
What the SDN List Is and Who Maintains It
The Specially Designated Nationals and Blocked Persons List is maintained by the Office of Foreign Assets Control, a unit of the U.S. Department of the Treasury. OFAC's own definition is compact: SDNs are individuals and companies owned or controlled by, or acting for or on behalf of, targeted countries, plus terrorists, narcotics traffickers, and others designated under programs that are not country-specific. Their assets are blocked, and U.S. persons are generally prohibited from dealing with them.
Designations rest chiefly on the Trading With the Enemy Act, IEEPA, the Antiterrorism and Effective Death Penalty Act, and the Foreign Narcotics Kingpin Designation Act, implemented through Executive Orders and program regulations in 31 CFR Chapter V.
The list is not the whole universe of blocked parties. OFAC FAQ 91 notes that some programs block persons who never appear on it — most Cuban nationals, blocked foreign governments, and any entity caught by the 50 Percent Rule. Screening the SDN List is necessary. It is not sufficient.
What Actually Gets Listed
An SDN entry is more than a name. Individuals are listed with aliases, addresses, date and place of birth, nationality, and passport or national ID numbers. Entities carry former names, addresses, and registration numbers. Vessels are identified by IMO number, flag, and owner; aircraft by registration and serial number. Digital currency addresses appear as identifiers on a blocked person's record, and OFAC's virtual currency FAQs warn these listings are not likely to be exhaustive.
Every record is tagged with one or more program codes, and these are the part most often skimmed and most often misread. A record tagged SDGT falls under the Global Terrorism Sanctions Regulations; one tagged IRAN sits under the Iranian Transactions and Sanctions Regulations, which also block Iranian financial institutions whether or not they are named. Each program carries different licensing carve-outs, and OFAC's Sanctions List Search tool tells users to pay close attention to program codes because they dictate how a true hit should be treated. A confirmed match is the start of the analysis, not the end.
SDN vs. the Non-SDN Lists
OFAC publishes several lists that are not the SDN List and bundles them into a single download it calls the Consolidated Sanctions List. Parties on these lists face restrictions narrower than full blocking. The Sectoral Sanctions Identifications List covers Russian entities in sectors designated under E.O. 13662; a hit requires applying the relevant Directive's debt and equity restrictions, not freezing assets. The Non-SDN Menu-Based Sanctions List covers parties subject to a menu of measures under CAATSA and E.O. 14024. The CAPTA List names foreign financial institutions whose U.S. correspondent accounts must be closed or conditioned. The Foreign Sanctions Evaders and NS-PLC lists call for rejecting transactions rather than blocking them.
OFAC's FAQs put it plainly: U.S. persons are not required to block the property of parties on the FSE and SSI lists unless those parties are also SDNs, but other prohibitions apply.
Block, Reject, and the 50 Percent Rule
A true match against the SDN List triggers a blocking obligation. The U.S. person must freeze any property in which the SDN has an interest, hold it in an interest-bearing account from which only OFAC-authorized debits can be made, and refuse to open accounts or provide services. OFAC FAQ 42 uses the image of a bouncing ball: once a transaction with an SDN interest starts moving, whoever receives it must stop it and hold it, not return it.
Rejection is different. Under OFAC's blocking and rejecting FAQs, a transaction is rejected when the underlying activity is prohibited but no blocked person has an interest in the funds — a wire that finances an export to a non-designated party in Iran, for example. There is nothing to freeze, so the payment is refused and returned.
The blocking obligation also reaches parties never named. Under the 50 Percent Rule, any entity owned 50 percent or more, individually or in the aggregate, directly or indirectly, by blocked persons is itself blocked. Ownership analysis is covered in Sphinx's 50 Percent Rule compliance guide; a clean screen on the counterparty's own name does not settle the question.
Strict Liability and What a Violation Costs
OFAC violations are strict liability offenses. A U.S. person that processes a prohibited transaction has violated the law whether or not it knew the counterparty was designated. Intent affects the penalty, not the existence of the violation.
The penalty framework sits in the Economic Sanctions Enforcement Guidelines at 31 CFR Part 501, Appendix A. OFAC first decides whether a case is egregious, weighing willfulness, awareness, and harm to program objectives, then sets a base penalty from a matrix built on egregiousness and voluntary self-disclosure, and adjusts it for factors including compliance program adequacy, remediation, and cooperation. Under the January 2025 inflation adjustment, the IEEPA maximum is $377,700 per violation or twice the transaction value, whichever is greater.
OFAC's 2025 enforcement record shows 14 public actions totaling $265.7 million, the largest a $216 million statutory-maximum penalty against venture firm GVA Capital for managing capital for a designated Russian national through a proxy. The 2019 Framework for OFAC Compliance Commitments lists screening software and filter faults among the root causes of prior violations. A filter that was never tuned is not a defense. It is an aggravating fact.
The List Changes Constantly. Screening Has to Keep Up.
OFAC updates the SDN List with no predetermined timetable. CNAS counted 1,764 additions in 2025 — down from 3,135 in 2024, but still roughly 34 new designations a week, concentrated in Iran-related evasion networks and counternarcotics targets.
Screening at onboarding alone is therefore inadequate. A customer who cleared in March may be designated in April, and the blocking obligation attaches the moment the designation is published. Re-screening the full customer base against each list update is the supervisory expectation, and the screening platforms compliance teams evaluate are judged on how quickly they ingest changes and how they handle the resulting alerts. Delta screening — running only the changed records against the customer base — is what makes this feasible, provided a periodic full re-screen also catches records affected by changes to matching logic.
What to Do After a True Hit
Once a match is confirmed, the obligations under OFAC's Reporting, Procedures and Penalties Regulations are specific and time-bound.
How Screening Works in Practice
Sanctions screening compares customer and transaction data against the list using approximate string matching, because exact matching would miss transliterated names, reordered name components, and deliberate misspellings. OFAC's own Sanctions List Search tool uses fuzzy logic with an adjustable confidence threshold, and OFAC declines to recommend a setting. That choice is the most consequential tuning decision in the program: too tight misses true matches, too loose buries them.
Most alerts are false positives — a customer's name resembles an SDN's but the secondary identifiers disagree. Clearing one means comparing date of birth, nationality, address, and identification numbers against the list record, then recording what was compared and why the match was rejected. FAQ 42 anticipates this: a similar name with non-matching descriptors is a false positive, not a hit. The reasoning has to be on file, because examiners review cleared alerts as closely as confirmed ones, and this is where backlogs form.
Where Sphinx Fits
Sphinx's agents handle the analyst work that follows a screening alert. When an engine flags a potential SDN match, the agent compares the customer's identifiers field by field against the list record and its aliases, checks program tags and 50 Percent Rule exposure, and writes a disposition explaining why the alert was cleared or escalated. Confirmed matches route to a human for the blocking decision and OFAC reporting. Every step is logged, so the file an examiner reads shows the reasoning — which is how review time per alert falls without the documentation standard falling with it.
Frequently Asked Questions
Is the SDN List the same as the OFAC sanctions list?
No. The SDN List is OFAC's primary list, but OFAC also publishes non-SDN lists such as the Sectoral Sanctions Identifications List and the Non-SDN Menu-Based Sanctions List, distributed together as the Consolidated Sanctions List. Only SDN entries carry a full blocking obligation.
How often is the OFAC SDN List updated?
There is no fixed schedule. OFAC adds, modifies, and removes names as designations and delistings occur, often several times a week. CNAS counted 1,764 additions in 2025 and 3,135 in 2024. Institutions are expected to ingest changes promptly and re-screen their customer base against each update.
What is the difference between blocking and rejecting a transaction?
Blocking applies when a blocked person has an interest in the property: the funds are frozen in an interest-bearing account and cannot be returned. Rejecting applies when the transaction is prohibited but no blocked person has an interest in it: the payment is refused and returned. Both must be reported to OFAC within 10 business days.
Is a company blocked if it is not on the SDN List but is owned by someone who is?
Yes, if ownership meets OFAC's 50 Percent Rule. Any entity owned 50 percent or more, individually or in the aggregate, directly or indirectly, by blocked persons is itself blocked even though its name does not appear on the list. Ownership analysis, not name screening, surfaces this exposure.
What penalties apply for a missed SDN match?
OFAC applies strict liability, so a violation exists regardless of intent. Under the Economic Sanctions Enforcement Guidelines, OFAC determines whether the case is egregious and self-disclosed, sets a base penalty, and adjusts for factors including compliance program adequacy. The IEEPA maximum, adjusted in January 2025, is $377,700 per violation or twice the transaction value, whichever is greater.
.png)
