Short answer: sanctions screening compares the names and details of customers, counterparties, payments and trade documents against government lists of sanctioned persons, entities and places. A true match means you must freeze (block) or refuse (reject) according to the applicable law, and usually report. The CGSS exam tests how you set up screening, how you resolve alerts, and what you do next.
Try the free CGSS practice test after reading.
Sourcing note. This post summarises widely published guidance, including OFAC's framework for compliance commitments. List names and procedures change, so confirm the current rules with the relevant authority.
What is screened
| Screening type | When | What is checked |
|---|---|---|
| Customer / onboarding | Account opening and periodic review | Customer, beneficial owners, directors, authorised signatories |
| Ongoing (list-change) | Whenever lists are updated | The full customer base against new entries |
| Payment | Before processing | Originator, beneficiary, banks, free-text fields, countries |
| Trade | Before issuing or paying letters of credit | Parties, vessels, ports, goods, destinations |
Which lists
| Authority | Main lists |
|---|---|
| United Nations | UN Security Council Consolidated List |
| United States | OFAC Specially Designated Nationals and Blocked Persons (SDN) List and other OFAC lists, such as the Sectoral Sanctions Identifications List |
| European Union | EU Consolidated Financial Sanctions List |
| United Kingdom | UK Sanctions List, with OFSI responsible for financial sanctions implementation |
| Local | Lists issued by national authorities in the countries you operate in |
Use all lists that apply to your firm. A US dollar payment may bring OFAC rules into play even for a non-US firm, and an EU subsidiary must comply with EU sanctions.
How matching works
Systems use name-matching algorithms, often "fuzzy matching", to catch variations such as spelling, transliteration, abbreviations and word order. Common elements:
- Exact match: identical strings.
- Fuzzy match: a similarity score above a threshold (for example for "Muhammad", "Mohammed" and "Mohamed").
- Phonetic algorithms: match similar-sounding names.
- Secondary identifiers: date of birth, nationality, address, passport number, vessel IMO number, registration number.
Setting the threshold is a trade-off. A low threshold produces many false positives; a high one risks false negatives, which are the more dangerous. Firms test and tune the system, document their reasoning and use the risk-based approach, but they never tune it to avoid catching a clear match.
Handling an alert
- Review the hit against the list entry, using secondary identifiers.
- Decide: false positive (documented and closed), true match, or unclear (escalate).
- For a true match, follow the law: block (freeze) or reject, notify compliance, and report to the authority within the required period.
- Document everything: the evidence reviewed, the reasoning, the decision and who made it.
- Do not tip off the customer where the rules prohibit it, and do not process the transaction in the meantime.
Block or reject?
| Action | When | Result |
|---|---|---|
| Block (freeze) | The property or interest of a blocked person is in your possession or control | The asset is frozen, an account is typically set up and reported to the authority |
| Reject | A transaction is prohibited but no blocked person's property interest exists (for example a transaction with a comprehensively sanctioned country) | The transaction is refused and reported where required |
In US practice, OFAC requires reports of blocked property and rejected transactions within 10 business days; verify current requirements in the OFAC regulations before relying on a figure.
Ownership matters
Screening only the named customer is not enough. Under OFAC's 50 percent rule, entities owned 50 percent or more in the aggregate by blocked persons are themselves treated as blocked, even if the entity is not on a list. The EU and UK have ownership and control tests. Read the OFAC 50 percent rule explained.
Common screening failures
- Lists out of date or not applied to all systems.
- Gaps in data: no date of birth or country, making clear matches impossible.
- Free-text payment fields not screened.
- Alerts closed with no rationale.
- Thresholds changed with no documentation or testing.
- Beneficial owners not screened.
Regulators regularly cite these in enforcement actions. See also the CGSS syllabus.
Exam tips
- "A screening hit is returned. What first?" Review and verify; do not process, and do not reject straight away.
- "Which is the best way to reduce false positives?" Better data, secondary identifiers and tuning, not turning screening off.
- "Which control addresses a sanctioned owner of a non-listed company?" Ownership and control due diligence.