Sanctions screening for remittance companies is not optional — it is a legal obligation enforced by financial regulators in every major send-from jurisdiction. Every MTO must screen customers, beneficiaries, and transactions against the OFAC, UN, EU, UK and applicable local sanctions lists before funds are released. Failure to do so can bring criminal liability, licence action and civil penalties: under the main US sanctions statute, up to the greater of $377,700 or twice the value of the transaction for each violation.
Quick Answer: Sanctions Screening for MTOs
- What it is: The automated process of checking customers, beneficiaries, and transactions against government-maintained lists of sanctioned individuals, entities, vessels, and countries before funds are transferred.
- Key lists to screen: OFAC SDN and consolidated sanctions lists (USA), UN Security Council Consolidated List, the EU consolidated financial sanctions list, the UK Sanctions List, and the DFAT Consolidated List (Australia) — plus any lists required by your corridor countries.
- Screening frequency: Every transfer at the point of initiation, before funds move, with lists refreshed at least daily and everyone on your books re-screened when a list changes. FATF Recommendations 6 and 7 require targeted financial sanctions to be implemented without delay.
- False positive management: Apply documented fuzzy-match thresholds, conduct secondary human review for borderline alerts, record every decision with a timestamp, and tune thresholds periodically based on alert volume data.
- If you miss a hit: You may have processed a sanctioned transaction. You must self-report to OFAC (or your relevant authority), freeze the funds if still accessible, file a Suspicious Activity Report, and preserve all records. Under OFAC's Enforcement Guidelines, a voluntary self-disclosure halves the base penalty in a non-egregious case.
⚠ Operational Guidance Only: This article is written for money transfer operators and compliance teams seeking to understand sanctions screening obligations and system design. It does not constitute legal advice. Sanctions regimes are updated frequently — always verify current list versions with your legal counsel and directly from the issuing authority before making compliance decisions.
Why Sanctions Screening Is Non-Negotiable for MTOs
Money transfer operators occupy a uniquely exposed position in the global payments ecosystem. They move value across jurisdictions, often into corridors where sanctions exposure is highest, and they do so at high volume and speed. Regulators have concluded, consistently, that the risk of sanctions evasion through remittance channels is acute — and enforcement has intensified accordingly.
The legal basis varies by jurisdiction but the obligation is universal. In the United States, OFAC administers economic and trade sanctions under the authority of multiple Executive Orders and statutes including the International Emergency Economic Powers Act (IEEPA). In the UK, sanctions obligations arise under the Sanctions and Anti-Money Laundering Act 2018. In the EU, they flow from EU Regulations under the Common Foreign and Security Policy. In Australia, the Autonomous Sanctions Act 2011 governs.
What these frameworks share is a strict liability standard in many cases. OFAC's civil penalty regime does not require proof of intent — processing a payment to a designated person can result in a penalty even if the operator was unaware. This makes the technical design of your screening system a direct factor in your legal risk exposure.
- $377,700
or twice the transaction value, whichever is greater: maximum civil penalty per violation under the International Emergency Economic Powers Act - 50%
ownership by one or more blocked persons, in aggregate, blocks an entity that is not itself listed — OFAC - Hours
FATF's reading of "without delay" for UN designations: ideally within a matter of hours
Figure 1: Key enforcement data points. Sources: OFAC Sanctions Penalties Regulations (September 2026); OFAC FAQs; FATF Glossary.
The reputational consequences of a sanctions breach can be even more severe than the financial penalty. Correspondent bank relationships — essential for any MTO — can be terminated within days of a sanctions violation becoming public. For a money transfer business, losing correspondent banking is often an existential event.
Effective AML compliance for money transfer businesses begins with sanctions screening. It is the outermost gate — if a sanctioned party slips through, every other compliance layer is compromised.
The Major Sanctions Lists and Their Jurisdictions
Sanctions screening for money transfer operators means checking customer and transaction data against a defined set of government-maintained lists that identify individuals, entities, vessels, aircraft, and geographic regions subject to financial restrictions. The scope of lists you must screen depends on which jurisdictions you are licensed in — but any MTO with US-dollar-denominated flows, US customers, or US counterparties must include OFAC regardless of where it is headquartered.
| List Name | Issuing Authority | Jurisdiction | Update Frequency | Coverage |
|---|---|---|---|---|
| SDN & Consolidated Sanctions List | OFAC — US Treasury | USA (global reach) | As designations are made | Individuals, entities, vessels, aircraft; country programmes |
| UN Consolidated Sanctions List | UN Security Council | All UN member states | As designations are made | Designated individuals and entities from UNSC resolutions |
| EU consolidated financial sanctions list | European Union | EU / EEA | As designations are made | Persons, groups and entities subject to EU financial sanctions |
| UK Sanctions List | UK government (the only UK list since 28 January 2026, when the OFSI Consolidated List closed) | United Kingdom | As designations are made | All UK sanctions designations |
| Consolidated List | Department of Foreign Affairs and Trade (DFAT) | Australia | As updated | Autonomous and UN-derived designations |
| Consolidated Canadian Autonomous Sanctions List | Government of Canada | Canada | As updated | Individuals and entities listed under the Special Economic Measures Act and the Justice for Victims of Corrupt Foreign Officials Act (an administrative list; the regulations themselves have force of law) |
Figure 2: Principal sanctions lists for MTOs operating across major send-from corridors. Always verify list currency directly from the issuing authority.
OFAC's Extra-Territorial Reach: OFAC sanctions apply to US persons and US-dollar-denominated transactions anywhere in the world. If your MTO uses a US correspondent bank, clears transactions through a US financial institution, or has US-connected ownership, you are subject to OFAC jurisdiction even if you are incorporated outside the United States. Most global MTOs must treat the OFAC SDN list as mandatory regardless of their primary licence jurisdiction.
Beyond these core lists, some jurisdictions maintain sectoral or secondary lists. OFAC's Sectoral Sanctions Identifications (SSI) list targets entities in specific Russian sectors without full SDN designation. The EU maintains country-specific annexes with asset-freeze and travel-ban designations. MTOs operating in the Gulf may also need to screen against lists maintained by the UAE Executive Office for Control and Non-Proliferation and similar Gulf Cooperation Council bodies.
The practical implication is that most MTOs with multi-corridor operations need to maintain a consolidated screening database drawing from several separate official sources, refreshed at least daily and on demand when a major designation is announced.
FATF Recommendations 6 and 7 Explained
The FATF Recommendations set the global standard for anti-money laundering and counter-terrorism financing. For sanctions screening specifically, two recommendations govern MTO obligations.
- R6 Targeted Financial Sanctions — Terrorism & Financing of Terrorism
Countries must implement UN Security Council resolutions on terrorism financing (Resolutions 1267, 1373, and successors) without delay. Financial institutions must freeze the assets of designated persons without prior notice to the customer. For an MTO that means screening at the point of transaction initiation, not after funds move. - R7 Targeted Financial Sanctions — Weapons of Mass Destruction Proliferation
Countries must implement UN Security Council resolutions related to WMD proliferation financing (Resolutions 1718, 1737, and successors) with the same without-delay standard. Financial institutions must freeze funds without prior notification. This extends to preventing sanctioned entities from accessing financial services through intermediaries, shell companies, or nested accounts. - Key The "Without Delay" Standard in Practice
The FATF Glossary defines "without delay" for UN Security Council designations as, ideally, within a matter of hours of the designation. The obligation is placed on countries; your national regulator's rules set what it means for you. The practical reading for an MTO is to shorten two gaps: the time between a designation and your lists carrying it, and the time between a transfer being requested and its parties being screened. - R16 Wire Transfer Screening (Travel Rule)
Recommendation 16, which governs wire transfers and payment messages, requires originator and beneficiary information to travel with a transfer, which is what makes screening both parties possible. For MTOs, this means both sender and recipient must be checked, not just the initiating customer. FATF revised Recommendation 16 in June 2025, with the changes applying from 2030. Beneficiary data too thin to screen is a reason to hold the transfer and ask for more.
Figure 3: FATF Recommendations 6, 7, and 16 as they apply to MTO sanctions screening obligations. Source: The FATF Recommendations and the FATF Glossary.
Real-Time vs Batch Screening
The distinction between real-time and batch screening is one of the most operationally significant in sanctions compliance. It decides whether a transfer can leave before anyone has checked its parties. Keep two things apart when you assess a platform: when each transfer is screened (it should be at initiation, before funds move) and how often the lists behind that screening are refreshed (at least daily, with a way to load on demand).
| Real-Time Screening (Modern) | Batch Screening (Legacy) |
|---|---|
| Screen at transaction initiation — before funds move | Funds may move before screening completes |
| Consistent with the FATF "without delay" standard | Leaves a window in which a designated party can be paid |
| A list change re-screens the people already on your books | Existing customers checked only at the next scheduled run |
| Automated block/alert/clear workflow | Manual intervention required for every alert |
| Timestamped audit record per transaction | Audit trail gaps between batch cycles |
| Screening time recorded before payment time on every transfer | Hard to show an examiner that screening came first |
Figure 4: Real-time vs batch screening — compliance and operational comparison for money transfer operators.
Screening before the transfer is processed is the design that holds up across the major MTO jurisdictions. Sanctions liability attaches to the payment itself, so a check that runs after the money has moved can only tell you that a breach has already happened.
A well-designed real-time screening system also integrates with your broader transaction monitoring layer. A sanctions hit generates an alert that feeds into your case management workflow — not a separate manual process that has to be reconciled against a batch log.
How Fuzzy Matching Works
Exact-name matching alone is not sufficient for sanctions screening. Sanctioned individuals and entities are identified in lists using their names — but those names may appear in different transliterations, with alternative spellings, with aliases, or with date-of-birth or address variations. A screening system that only matches on exact strings will systematically miss hits.
Fuzzy matching is the set of algorithms that allow a screening engine to recognise that "Mohammed Al-Rashid" and "Muhammad Al-Rasheed" may refer to the same person. It typically involves several techniques working in combination.
- Phonetic matching — algorithms such as Soundex, Metaphone, or Double Metaphone convert names to phonetic representations and compare those, catching spelling variations that sound alike.
- Edit distance (Levenshtein distance) — measures how many single-character edits (insertions, deletions, substitutions) are needed to transform one string into another. A threshold of 1 or 2 edits catches common typos and transliteration variants.
- N-gram analysis — breaks names into overlapping character sequences and calculates similarity scores based on shared n-grams. Useful for names where character order matters but individual edits are unreliable.
- Token matching — splits multi-word names into tokens and checks whether a sufficient proportion of tokens match between the input and the list entry, allowing for name-order variations and middle name inclusion or omission.
- Alias database matching — sanctions lists often include known aliases. A sound screening system maintains an expanded alias index so that aliases listed in official records are checked alongside the primary name.
- Transliteration tables — dedicated lookup tables for Arabic, Cyrillic, Chinese, and other script-to-Latin character conversions ensure that names transliterated differently across source documents are still detected.
Threshold Configuration: Every fuzzy matching engine requires a similarity score threshold — a number between 0 and 100 that determines when a potential match is flagged for review. Setting the threshold too high (demanding near-perfect similarity) risks missing genuine hits. Setting it too low creates excessive false positives that overwhelm your analyst team and create customer friction. No regulator publishes a correct number. Set the threshold by testing against your own customer names and known listed names, then document the policy and review it periodically.
False Positive Management
False positives — alerts generated for customers who are not actually sanctioned — are an inherent feature of fuzzy matching systems. A system sensitive enough to catch genuine hits will also flag customers with common names that partially match a sanctioned person. Managing false positives without suppressing genuine alerts is one of the defining operational challenges in sanctions compliance.
- Name Matching Complexity
Sanctioned individuals' names appear in dozens of transliteration variants, aliases, and partial-name forms across official lists. No single matching algorithm catches all variants reliably. MTOs must run layered fuzzy-match logic — phonetic, edit-distance, token, and alias-based — simultaneously. Failing to do so creates blind spots that a well-resourced sanctions evader can exploit deliberately by using a specific name variant not caught by a simple algorithm. - List Freshness and Latency
Sanctions lists are updated without warning — OFAC, the UK and the EU all publish new designations at irregular intervals. The gap between a designation and your lists carrying it is an exposure window. Narrow it with at least daily loads, a way to load on demand when a major designation is announced, an alert when a load fails or the lists go stale, and re-screening of existing customers and recipients after every change. - Nested Accounts and Correspondent Risk
Sanctions evasion frequently occurs through intermediaries — a sanctioned entity uses a shell company, a trusted third party, or a nested account held at a correspondent bank to move funds without appearing directly in the transaction. Customer-level screening alone is insufficient. MTOs must apply enhanced due diligence to corporate customers, verify ultimate beneficial ownership, and monitor for transaction patterns consistent with layering through nested structures. - Customer Friction from False Positives
Every unnecessary alert that delays or rejects a legitimate customer transaction carries a direct cost — in customer service time, in customer dissatisfaction, and in potential churn. MTOs serving diaspora communities where certain names are extremely common (e.g., Mohammed, Ali, Chen) face particularly high false positive rates if matching thresholds are not properly calibrated. The operational solution is a tiered review workflow: low-confidence alerts auto-resolved with a documented justification, medium-confidence alerts queued for analyst review within defined SLAs, and high-confidence alerts escalated immediately. - Incomplete Beneficiary Data
Sanctions screening must cover both the sender and the beneficiary. In many corridors — particularly cash-pickup and mobile wallet payouts — complete beneficiary information is not always collected at transaction initiation. Regulators expect MTOs to have controls that prevent a transaction from proceeding if beneficiary data is insufficient to perform screening. This requires hard system controls, not just policy statements. - Audit Trail Completeness
Regulators do not just want to know that you screen — they want to see proof that every transaction was screened, which list version was used, what score was returned, who reviewed it, when the review decision was made, and what action was taken. A sanctions screening system without a complete, searchable, timestamped audit log cannot satisfy examination requirements. The audit record must be retained for a minimum period aligned with your jurisdiction's record-keeping requirements — confirm the period with each regulator that supervises you.
Figure 5: Six operational challenges in MTO sanctions compliance — name matching, list freshness, nested accounts, false positives, beneficiary data gaps, and audit completeness.
Effective false positive management requires a documented disposition process. Every alert — whether cleared, escalated, or resulted in a block — must be recorded with the reviewer's identity, the rationale for the decision, and the timestamp. This record is what regulators will examine when they assess your sanctions compliance programme.
Screening Configuration for Corridor-Specific Risk
Sanctions risk is not uniform across all corridors. A remittance business sending money from the UK to the Philippines faces a materially different sanctions exposure profile than one sending from the USA to Iran — which is prohibited in its entirety under OFAC's Iran sanctions programme. Corridor-specific risk calibration is a key element of a mature sanctions compliance framework.
- Transaction Initiation Customer submits a send request. System captures full originator details (name, date of birth, ID number, address) and beneficiary details (name, account or mobile number, country). No funds are moved at this stage.
- Real-Time Sanctions Screen The screening engine queries the consolidated sanctions database — OFAC SDN, UN, EU, the UK Sanctions List, the DFAT Consolidated List, and any corridor-specific lists — against both originator and beneficiary name fields, plus country-of-destination check for embargoed jurisdictions. Fuzzy matching algorithms return similarity scores for each.
- Alert Scoring and Triage Matches above the threshold generate alerts classified by confidence score under your documented policy. As an illustration: the strongest matches go to an immediate analyst queue with the transfer held, weaker ones enter the standard review queue, and scores below your threshold raise no alert. Whatever bands you choose, record them and the reasoning behind them.
- Analyst Review For queued alerts, a trained compliance analyst reviews the full customer record, the matching list entry, corroborating data (date of birth, nationality, address), and transaction context. The analyst documents whether the match is a true hit or a false positive, with specific reasoning recorded.
- Action: Clear, Block, or Escalate False positive — transaction is cleared and proceeds. Confirmed hit — funds are blocked, the customer is not notified (tipping-off prohibition applies), and the matter is escalated to the MLRO. Possible hit with insufficient data — transaction is held pending additional customer due diligence.
- Regulatory Action (On Confirmed Hit) For confirmed matches to OFAC SDN or equivalent: freeze the funds, file a Suspicious Activity Report (SAR) or equivalent, notify OFAC or the relevant authority, and preserve all records. In the UK, frozen assets and suspected breaches are reported to the Office of Financial Sanctions Implementation (OFSI), and any dealing with frozen funds needs a licence.
- Timestamped Audit Record Every step — initiation timestamp, screening timestamp, list version used, alert score, reviewer identity, decision, action taken — is written to the audit log. This log is retained for the minimum statutory period and is available for regulatory examination on demand.
Figure 6: End-to-end sanctions screening workflow for a money transfer operator — from transaction initiation to regulatory action and audit record.
Corridor risk configuration involves setting rules based on destination country risk levels. Transactions to or from jurisdictions under a comprehensive embargo in the regimes that apply to you must be blocked at the system level, not just flagged for review. Check the current position with the authority itself, because programmes change: OFAC's Syria sanctions programme, for example, was terminated with effect from 1 July 2025, while individual Syria-related designations remain on the SDN List. For high-risk corridors that are not comprehensively sanctioned, enhanced screening thresholds and additional due diligence requirements can be configured at the corridor level.
This type of corridor-specific configuration is part of a mature compliance and risk management framework. It ensures that your screening system is calibrated to the actual risk profile of your business — not a one-size-fits-all setting that either over-screens low-risk corridors or under-screens high-risk ones.
What Regulators Check in an Examination
When a financial regulator examines your sanctions compliance programme — whether OFAC, the FCA, FINTRAC, FinCEN, or AUSTRAC — they are not simply checking whether you have a screening tool. They are assessing whether your entire programme is fit for purpose and whether it actually catches sanctioned parties in practice.
Understanding what regulators look for allows compliance teams to build examination-ready systems from the outset rather than scrambling to produce documentation after an examination is announced. The key areas regulators assess include the following.
- Programme governance: Is there a written sanctions compliance policy approved by senior management? Is there a designated compliance officer with clear sanctions responsibility? Are staff trained on sanctions obligations and updated when regimes change?
- List coverage and currency: Which lists does your screening system cover? How frequently are lists updated? Regulators will check the version date of lists in use at the time of specific transactions. Stale lists are a common finding.
- Screening timing: Are transactions screened before funds move? Regulators will trace a sample of transactions from initiation to payment and verify that the screening timestamp precedes the payment timestamp for each one.
- Fuzzy matching configuration: What is your threshold setting? How was it determined? Is there documentation of threshold calibration based on alert data? Regulators expect a reasoned, documented methodology — not an arbitrary number.
- Alert disposition records: For a sample of cleared alerts, regulators will ask to see the analyst's recorded rationale. Dispositions recorded as "not a match" with no supporting reasoning are a finding. Dispositions that show genuine analytical work are not.
- True positive handling: Have you ever had a confirmed sanctions hit? If so, what did you do? Regulators expect to see that confirmed hits were blocked, reported to the relevant authority, and documented. Inability to produce records of how past hits were handled is a serious deficiency.
- System testing: Is your screening system periodically tested with known sanctioned names to verify it catches them? Testing records — including any failures found and remediated — demonstrate programme rigour.
- Beneficial ownership controls: For corporate customers, can you demonstrate that you screen ultimate beneficial owners — not just the legal entity name? OFAC's 50 Percent Rule means that an entity owned 50 per cent or more by blocked persons is itself blocked, even if not listed.
OFAC's 50% Rule: Any entity owned 50 per cent or more, directly or indirectly and in aggregate, by one or more blocked persons is itself treated as blocked, even if it does not appear on the SDN List by name. This means customer-level screening must extend to corporate ownership structures. An MTO that screens only the legal entity name without checking whether a listed person owns 50% or more of the business is leaving a gap in its screening.
Regulators also assess your sanctions programme's integration with your broader AML/CTF framework. A sanctions alert that is treated in isolation — without consideration of whether it also requires a SAR filing under your AML obligations — represents a process gap. The most examination-ready programmes have an integrated case management system where a sanctions alert automatically triggers the relevant AML workflow checks and vice versa. On RemitSo, sanctions screening, KYC and transaction monitoring sit in one admin panel, so the officer ruling on a match sees the customer's documents and risk triggers alongside it.
How RemitSo Powers Sanctions Screening for MTOs
RemitSo is built for money transfer operators who need compliance infrastructure that works from day one, not a module added after launch. Screening is part of the transfer flow: every sender and recipient is screened, and your team rules on each possible match.
- Eight official lists: Australian DFAT, Canada SEMA, EU financial sanctions, OFAC SDN, OFAC consolidated non-SDN, Swiss SECO, the UK Sanctions List and the UN Consolidated List. A list can be switched off where it does not apply to you.
- A signed, versioned dataset, checked before loading: the lists are published every day as a signed, versioned dataset, and every installation checks the signature before it loads anything. An examiner who asks which list version applied on a given day gets a precise answer, and a tampered or corrupted file never reaches your screening.
- Nightly loads with a visible result: each list shows its loaded version and when its publisher last changed it, with a load history and "Load now" on demand. Each load reports entries added, changed and delisted.
- Re-screening when lists change: the people whose names a change could affect are re-screened, customers, recipients and staff alike.
- Rulings kept per person: a name an officer has cleared is not flagged again for the same entry, which keeps repeat false positives off the queue.
- Confirm, not only dismiss: an officer can confirm a match as well as clear it, and "Sanction match confirmed" reaches the people subscribed to it. "Possible sanction match found" blocks nothing by itself; a person decides.
- Sanction lookup: every screening, what it matched (people, organisations, vessels or aircraft) and what an officer decided about each match, in one place.
- Alerts when lists go stale: "Sanction lists out of date" and "Sanction lists could not be loaded" tell the team before an examiner does.
- A searchable, plain-language audit log of who changed what, and when, and watched-name lists with their own rights to see, add, change, import and export.
Your team still owns the policy: which lists apply, how matches are reviewed, and when a confirmed match leads to a freeze and a report. Learn more about the RemitSo compliance features or book a demo.
Sources
- OFAC, Sanctions Penalties Regulations (Federal Register, 25 September 2026) and Inflation Adjustment of Civil Monetary Penalties (15 January 2025): IEEPA maximum civil penalty
- 31 CFR Part 501, Appendix A: Economic Sanctions Enforcement Guidelines (voluntary self-disclosure)
- OFAC FAQs: entities owned by blocked persons (the 50 Percent Rule)
- OFAC, Revocation of Syria Sanctions (30 June 2025)
- GOV.UK, Moving to a single list for UK sanctions designations, 28 January 2026 and The UK Sanctions List
- DFAT, Consolidated List
- Government of Canada, Consolidated Canadian Autonomous Sanctions List
- FATF Glossary ("without delay") and The FATF Recommendations (Recommendations 6, 7 and 16)
- FATF updates Standards on Recommendation 16 on Payment Transparency (June 2025)
Checked October 2026. Regulations change; confirm current requirements with the regulator or your adviser.
Frequently Asked Questions
Doing it with RemitSo
- Every sender and recipient screened against sanction lists loaded every night, with each officer decision recordedFewer manual checks, and a decision record for your auditor
- Risk rules built from 46 ready-made indicators, plus watched names, emails, domains and high-risk countriesOnly risky transfers wait for a person
- AML rules per currency and corridor, with document tiers and a history of changesAsk for more only when totals grow
- A searchable, plain-language audit log of who changed what, and whenProof ready for your next audit
What MTOs and Compliance Teams Ask About Sanctions Screening
1. What is sanctions screening for a money transfer business?
Sanctions screening is the automated process of checking customer names, beneficiary names, and transaction details against government-maintained lists of designated individuals, entities, vessels, and sanctioned countries before a money transfer is processed. The purpose is to prevent financial services from being provided to parties subject to economic sanctions — who may be involved in terrorism financing, WMD proliferation, drug trafficking, or other activities that governments have responded to with financial restrictions. For money transfer operators, sanctions screening is a legal obligation enforced by regulators in every major send-from jurisdiction, including the USA (OFAC), the UK (OFSI, part of HM Treasury), the EU, Australia (the Australian Sanctions Office in DFAT) and Canada. Processing a transaction involving a sanctioned party — even unknowingly — can result in civil penalties, criminal liability, and licence revocation.
2. Which sanctions lists must a remittance company screen against?
The required lists depend on your jurisdiction and transaction flows, but most MTOs must screen against at minimum: OFAC's SDN and Consolidated Sanctions List (USA — also applies to any MTO using US dollars or US correspondent banks), the UN Security Council Consolidated List (applicable to all UN member states), the EU consolidated financial sanctions list (for EU/EEA licensed MTOs), the UK Sanctions List (for UK-licensed MTOs; it has been the only UK list since 28 January 2026), and the DFAT Consolidated List (for Australian-licensed MTOs). Canadian MTOs should check the Consolidated Canadian Autonomous Sanctions List, which covers the Special Economic Measures Act and the Justice for Victims of Corrupt Foreign Officials Act, alongside Canada's UN and terrorist listings. MTOs operating in the UAE should also screen against UAE Executive Office for Control and Non-Proliferation lists. A screening programme for a multi-corridor MTO draws from several official sources and consolidates them into a single searchable dataset that is refreshed at least daily.
3. How often does a remittance company need to screen against sanctions lists?
FATF Recommendations 6 and 7 require targeted financial sanctions to be implemented "without delay", which the FATF Glossary defines for UN designations as, ideally, within a matter of hours. In practice, MTOs should screen every transfer at the point of initiation, before funds are moved; processing first and screening overnight leaves a window in which a designated party can be paid. MTOs should also re-screen existing customers and recipients whenever a list changes, to catch newly designated parties who are already on the books. The authorities publish designations as they are made, with no fixed schedule, so load the lists at least daily and on demand after a major announcement.
4. What is fuzzy matching in sanctions screening?
Fuzzy matching is a set of algorithms that allow a sanctions screening engine to identify potential matches between a customer name and a sanctioned person's name even when the spelling is not identical. This is essential because sanctioned individuals' names appear in official lists in specific transliterations, but those same individuals may submit documents or be referred to in other documents with different spellings, aliases, or name-order variations. Common fuzzy matching techniques include phonetic matching (Soundex, Metaphone), edit-distance algorithms (Levenshtein distance), n-gram analysis, token-based matching, and dedicated transliteration tables for Arabic, Cyrillic, and Chinese to Latin character conversions. A compliance-grade screening system also maintains an expanded alias index derived from the alias data published in official sanctions lists. Every screening system requires a configured similarity threshold that determines when a potential match is flagged for human review rather than auto-cleared.
5. What happens when a sanctions screening system generates a hit?
When a screening system generates a potential match (a "hit"), the transaction must be held — funds must not move — pending review. A trained compliance analyst reviews the alert by comparing the customer data against the list entry, checking corroborating identifiers such as date of birth, nationality, and address. If the match is determined to be a false positive (the customer is not the designated person), the transaction is cleared with a documented rationale and proceeds. If the match is confirmed as a genuine sanctions hit, the funds must be blocked or frozen immediately. The tipping-off prohibition means the customer must not be notified that the hold is sanctions-related. The MLRO or compliance officer must be notified, a Suspicious Activity Report must be filed with the relevant financial intelligence unit, and the sanctioned funds must be reported to the relevant authority — OFAC in the USA, the Office of Financial Sanctions Implementation (OFSI) in the UK, or the equivalent. All steps must be timestamped and recorded.
6. What is an acceptable false positive rate for sanctions screening?
There is no universal regulatory target for false positive rates — regulators focus on whether your programme catches true hits rather than on minimising false positives per se. From an operational standpoint, most alerts at an MTO with a high-volume, common-name customer base will be false positives. The practical management goal is to configure matching thresholds at a level where your analyst team can review all non-auto-cleared alerts within defined SLAs without the alert volume being so high that it creates a backlog that delays genuine transactions. Your threshold calibration methodology, alert volume trend data, and the average time-to-disposition for alerts are all metrics that regulators assess as indicators of programme health. MTOs should review and document their threshold settings at least annually, and adjust when alert volume data shows that the threshold is generating unsustainable analyst workloads or, conversely, is missing obvious near-matches.
7. What are OFAC penalties for a money transfer operator that misses a sanctions hit?
The maximum civil penalty under the International Emergency Economic Powers Act (IEEPA) is the greater of $377,700 or twice the value of the transaction, for each violation. That figure is adjusted for inflation; it was set in January 2025 and carried through 2026. Wilful violations can also be prosecuted criminally. OFAC operates a strict liability civil penalty standard — meaning that intent to violate sanctions is not required for a civil penalty to apply. However, OFAC's enforcement framework does consider several factors that influence the penalty amount, including whether the MTO voluntarily self-disclosed the apparent violation, the strength of the compliance programme in place, the nature and duration of the violation, and whether the violation was wilful or reckless versus unintentional. Under OFAC's Enforcement Guidelines, a voluntary self-disclosure sets the base penalty in a non-egregious case at one-half of the transaction value, so take legal advice promptly when a possible breach is discovered. MTOs should refer directly to the OFAC website for current penalty guidelines and enforcement actions.
8. How does RemitSo handle sanctions screening for money transfer operators?
RemitSo screens every sender and recipient against eight official lists: Australian DFAT, Canada SEMA, EU financial sanctions, OFAC SDN, OFAC consolidated non-SDN, Swiss SECO, the UK Sanctions List and the UN Consolidated List. The lists are published every day as a signed, versioned dataset; each installation checks the signature before loading and reloads every night, and the people a change could affect are re-screened, staff included. A possible match goes to a compliance officer, who can clear or confirm it; rulings are kept per person, so a cleared name is not flagged again, and the sanction lookup shows every screening, what it matched and what was decided. MTOs can book a demo to see it in operation.