Sanctions Screening API: OFAC vs UK vs EU Lists

In August 2026 OFSI fined Citibank's London branch £4,732,830.58, and part of the case came down to three letters. The bank's screening system did not treat "PAO Sovcomflot" in its customer records as a match for "Sovcomflot" on the sanctions list, so 32 accounts stayed unrestricted and 328 transactions worth about £5.4 million went through.

Most screening failures look like that: a legal-form prefix, a transliteration, a list update that arrived nearly fourteen hours late. The pages ranking for "sanctions screening API" are mostly vendor product pages that skip the official download URLs, the thresholds open-source engines ship with and the licence terms on the data. The counts below come from the OFAC, UK, EU and UN files as I downloaded and parsed them on 29 October 2026.

How Does Sanctions Screening Work in Payments?

A screening system keeps a local copy of one or more government lists, compares names (and ideally dates of birth, passport or IMO numbers) against it, and sends anything above a score threshold to an analyst who decides whether the hit is real.

Most firms screen at two points. Customer screening runs at onboarding and again whenever a list changes, because a customer who was clean on Monday can be designated on Tuesday. Payment screening checks every party in a transfer, intermediary banks and free text included, before the money moves. The hard part is the comparison: names are not identifiers, and every list writes them differently.

OFAC SDN List vs UK Sanctions List vs EU Consolidated List

The four lists a UK or EU payment firm usually screens differ in size, in scope and in what counts as an entry.

OFAC's list is the largest because it spans 72 programmes, with 6,346 entries under Russia EO 14024 alone, and carries 1,075 digital currency addresses. Only 5,743 UK entries impose an asset freeze: 668 of the 683 ships are under shipping sanctions only. Alert on every UK entry and your payments queue fills with vessels that freeze no funds. The EU file has no ship type at all.

The UN list feeds both the UK and EU lists, but you cannot reliably join them on UN reference number. The UK list gives HAI0012 (Dimitri Herard) the reference HTi.009, which the UN assigns to Kempes Sanon.

Is There an OFAC SDN List API?

Not a documented one. What OFAC publishes is the Sanctions List Service (SLS), launched on 6 May 2024, with every file at a stable URL:

https://sanctionslistservice.ofac.treas.gov/api/PublicationPreview/exports/SDN.XML
https://sanctionslistservice.ofac.treas.gov/api/PublicationPreview/exports/SDN_ADVANCED.XML
https://sanctionslistservice.ofac.treas.gov/api/PublicationPreview/exports/CONSOLIDATED.XML

Three behaviours catch people out. A request without a User-Agent header gets a 403; OFAC warned .NET users about this in May 2024, and curl with an empty agent still gets one today. Each URL answers with a 302 to a pre-signed S3 link valid for an hour, so cache the file, not the redirect. And the old treasury.gov/ofac/downloads/ paths still redirect to SLS, so a 2019 scheduler keeps working until the day it doesn't.

The SLS web app calls an undocumented POST /api/PublicationPreview/SdnList endpoint that returns each file's size, date and SHA-256/384/512 hashes, so verifying a list before you swap it into production costs one request. Delta files go back to September 2022, but OFAC's FAQ 90 says to refresh from the full files. There is no schedule: by the delta archive, the list changed on 138 days in 2024, 123 in 2025 and 110 so far in 2026.

Parse SDN_ADVANCED.XML (about 122 MB, against 28 MB for SDN.XML) if you want identity documents and relationships to match on. And don't skip the 486-entry non-SDN Consolidated list: OFAC's FAQ 5 says some activity involving it must be rejected.

The UK Sanctions List in 2026: OFSI's Consolidated List Has Closed

The OFSI Consolidated List of Asset Freeze Targets stopped updating on 28 January 2026. The FCDO's UK Sanctions List is now the only source, at sanctionslist.fcdo.gov.uk/docs/UK-Sanctions-List.xml, with the same file in six other formats. The old OFSI blob-storage URLs return HTTP 409. A job still fetching ConList.csv either fails loudly or, worse, has been screening against a January copy.

Three details matter for code:

• Unique IDs are per regime designation, a three-letter prefix plus four digits, so one person can hold several. The 720 designations made since 28 January have no OFSI Group ID, so a table keyed on Group ID breaks for every new name.
• Parse the XML, not the CSV. The CSV is denormalised into 58,572 data rows for 6,420 designations. One Iranian entry, INU0075, expands to 3,780 rows.
• Liability is strict. Since 15 June 2022 OFSI need not show you knew, and civil penalties reach the greater of £1 million or 50% of the breach value.

The 50% Rule: OFAC vs EU vs UK Ownership Tests

Lists name only the designated parties. The companies they own are frozen too, and no two of the three regimes measure ownership the same way.

A company held 30% and 25% by two designated persons is blocked in the US and EU but not automatically frozen in the UK. One held exactly 50% escapes the UK ownership limb. HM Treasury's 2026 call for evidence floated moving to "50% or more" with aggregation. Deutsche Bank's London branch paid £165,000 in May 2026 partly because its vendor's list held no ownership data for a company wholly owned by a designated entity, and ownership data is the hardest part to build yourself.

How Does Fuzzy Name Matching Work in Sanctions Screening?

OFAC documents its own search tool in FAQ 249. It first discards candidates that don't share the first letter or are less than 50% similar by edit distance. It then scores the full name with Jaro-Winkler and the individual name parts with Jaro-Winkler plus Soundex, and shows whichever score is higher. A January 2021 upgrade added a third algorithm that OFAC has never named.

Jaro-Winkler rewards shared characters and prefixes, so most engines start with it. The spelling problem is bigger than most test suites assume. In OFAC's SDN and alias files I counted 560 occurrences of MUHAMMAD, 403 of MOHAMMAD, 255 of MOHAMMED, 240 of MOHAMED and 78 of MOHAMAD, plus rarer forms such as MOHD and MEHMET. Moov's documentation also notes that Jaro-Winkler scores close to zero when a Cyrillic or Arabic query meets a Latin-script entry.

The failures in OFSI and FCA findings are mostly pre-processing, not the choice of algorithm:

• Legal-form tokens. Citi's calibration did not account for the Russian corporate prefix "PAO".
• Transliteration. Bank of Scotland's £160,000 penalty, published in January 2026, followed its automated systems missing a spelling variation of a designated individual's name.
• Titles and limits. The FCA's May 2026 review found honorifics pushing scores below alert thresholds, one-word names and names containing digits excluded by default, and long names breaching character limits and failing without an alert. In its testing, 90% of alerts on exact names correctly identified the sanctioned party. For minor spelling variations it was 75%.

What Match Threshold Should Sanctions Screening Use?

OFAC won't say: FAQ 250 says users "must make their own match threshold determinations". Wolfsberg asks for a documented, tested, risk-based choice without naming a number. The open-source engines do publish defaults.

OpenSanctions' yente matches at a default threshold of 0.7 and suggests 0.8 to 0.85 where false positives are costly. Its own documentation shows a query for Aleksandr Zacharov, born 1965, returning a "Захаров Олександр" at 0.75 with match: true, even though that record's birth year is 1951. Moov Watchman's minMatch defaults to 0 for backward compatibility, and Moov recommends 0.80 for a production queue. One of its benchmark tables, run on OpenSanctions name pairs:

Recall of 0.689 means roughly three true matches in ten never reach an analyst, which the "cut false positives" pitch skips over. The much-quoted "98–99% false positives" traces back to an unsourced slide from an ECB payments advisory group in December 2020. The FCA's evidence is better: of firms running automated repeat customer screening, 95% had found no true sanctions match among clients since 2022, and 98% none in screened payments.

OpenSanctions vs Moov Watchman vs ComplyAdvantage: Build or Buy?

The trap is the data licence. The yente code is MIT, but OpenSanctions data is free only for non-commercial use, the same code-versus-data split I found in open source money transfer stacks. Watchman avoids the question by pulling government lists directly, which also means no PEPs, adverse media or ownership graph. LSEG World-Check and Dow Jones publish no prices.

A yente request is a batch of FollowTheMoney entities:

POST /match/sanctions?algorithm=logic-v2&threshold=0.8
{
  "queries": {
    "c-1042": {
      "schema": "Person",
      "properties": {
        "name": ["Arkadii Romanovich Rotenberg"],
        "birthDate": ["1951"],
        "nationality": ["ru"]
      }
    }
  }
}

Each result returns a score, a boolean match and explanations breaking the score into features such as name_match and dob_year_disjoint. Store them with every analyst decision; that is your audit trail.

Sanctions Screening for Instant Payments: EU Article 5d vs the UK

The EU went the other way from most bank architectures. Article 5d of the SEPA Regulation, inserted by the Instant Payments Regulation, has applied since 9 January 2025 to every PSP offering euro instant transfers. PSPs must check their own customers against EU targeted financial sanctions at least once every calendar day and straight after any new designation, and must not re-check payer or payee against those measures during each transfer. Per the Commission's Q&A, a listing published after the day's run means re-screening that day. UK and Swiss PSPs are out of scope, as are transfers where one PSP sits outside the EEA. The rest of the regulation is in my SEPA Instant guide.

The UK has no equivalent rule, so Faster Payments firms still screen inline and list latency is the risk. OFSI's 2023 disclosure about Wise shows the clock. A designation published at 11:05 on 29 June 2022 reached Wise's vendor list at 00:59 the next day, nearly 14 hours later. The alert fired at 04:20 and the account was suspended, but the debit card was not, and £250 went out as a cash withdrawal at 07:25.

Does Stripe or Adyen Do Sanctions Screening for You?

Partly, and for their own sake. Stripe's Connect documentation says it screens all accounts, connected accounts included, to meet Stripe's sanctions obligations, and pauses payouts to a flagged account while it asks the platform for information. Adyen checks each payout transfer against its policies and reports flagged ones by webhook. Checkout.com's Lite platform accounts get card scheme screening only; sanctions checks come with Full accounts. None of these documents says the PSP's screening covers a platform's own obligations. If you are an FCA-authorised firm, your screening is yours.

My View: Sanctions Screening Will Move From Names to Identifiers

This is opinion. Fuzzy name matching is a workaround for missing data, and the data is arriving. FATF's revised Recommendation 16, published in June 2025, requires name, address and date of birth on cross-border peer-to-peer payments above USD or EUR 1,000 by the end of 2030. Structured ISO 20022 addresses give a screen a town and country to compare instead of a free-text blob. Watchman already sets the score to 1.0 on a matching passport, IMO number or crypto address, and multiplies it by 0.70 when identifiers conflict.

My prediction: by 2030 the alerts that matter will be identifier-first, with names as the fallback, and most of today's queue will auto-close on date-of-birth conflicts. I also expect the UK to adopt the US and EU aggregation test, since the Treasury's own consultation points that way. Keep LLMs off the hot path. A Federal Reserve paper from September 2025 found they cut false positives by 92% against the best fuzzy baseline but ran over four orders of magnitude slower, and its authors send only scores between 45 and 98 to the model. Fuzzy matching inline, model review on the queue.

What This Means for Payment Engineers in the UK

• Fetch the primary lists even if you buy a vendor feed. Compare the vendor's list version with the FCDO file's Last-Modified header and alert when the gap passes a few hours; Wise's was nearly 14. For OFAC, send a User-Agent, verify the SHA-256 and reload full files.
• Key UK entries on UniqueID. Expect one person to have several, and never join lists on UN reference numbers.
• Normalise before matching. Strip legal forms (PAO, OOO, PJSC, LLC, Ltd) and honorifics, transliterate Cyrillic and Arabic, and put one-word and very long names in your test set.
• Re-screen after enrichment. Citi's processor screened payments before correspondent banks were added automatically and never screened the finished chain.
• Freeze every channel at once. Accounts, cards and payouts should all hang off one sanctions flag, because Wise's card kept working after the account was suspended.
• Write down your threshold and the test set behind it. OFAC and Wolfsberg both expect you to justify the number, and under strict liability "the system didn't alert" is no defence.