How to review an OFAC sanctions alert at a bank

Summary

When the sanctions filter flags a payment or a customer, an analyst has to decide whether the hit is the person on the list, and whether a listed person owns the party even when its own name isn't listed. OFAC won't make that call for you. It "does not confirm potential matches or false positives," so the bank's own record has to show why each alert was cleared or escalated (OFAC FAQ 5). Compare the full list entry with every identifier the bank holds, test ownership under the 50 Percent Rule, and keep the record for at least 10 years.

For sanctions analysts and reviewers at U.S. banks. The OFAC officer and counsel decide whether to block, reject or seek a license.

What's required and what's bank practice

Topic	What applies	Source
Ownership	An entity owned 50% or more, directly or indirectly, by one or more blocked persons is blocked, even if it isn't listed	OFAC FAQ 398
Blocked property report	Within 10 business days of blocking, plus an annual report of property blocked as of June 30, due September 30	31 CFR 501.603
Rejected transaction report	Within 10 business days	31 CFR 501.604
Records	At least 10 years after the transaction; for blocked property, the blocking period plus 10 years	31 CFR 501.601
Alert review method, fuzzy-match settings, escalation rules	Not set by any rule; OFAC describes a risk-based review and the bank sets its own procedures	OFAC FAQ 5

The 10-year retention period is recent. OFAC extended it from five years to match the longer statute of limitations for sanctions violations, and the change was adopted as final in March 2025 (final rule). Older procedures that still say five years need updating.

Review a sanctions alert in six steps

1. Record the alert as it was screened

Save the alert ID, the screening date, the list version loaded in the filter, the field that hit (originator, beneficiary, intermediary bank, address or free-text payment details) and the list entry it matched. Attach the payment message or account record and the customer profile. If a spelling variant caused the hit, note the fuzzy-match setting.

Examiners test this record. The FFIEC's OFAC procedures have them sample potential matches and how the bank resolved them, and enter names similar to recent list additions to see whether the filter catches them (FFIEC OFAC examination procedures).

2. Compare the full list entry field by field

Open the complete entry, not the filter's summary line, and record where each of the bank's values came from.

Field	Compare	Bank source
Name and aliases	Every listed name and alias against the name screened and on file	Payment message, CIP record
Date of birth or registration	Listed date against date on file	CIP record, registry extract
Nationality or country	Listed country against country on file	CIP record
Addresses	Each listed address against the address on file or in the message	Payment message, profile
ID numbers	Passport, national ID, tax or registration number	ID copy, registry extract
Vessel or aircraft	IMO number, call sign or tail number	Trade or payment documents

A missing identifier is missing, not a conflict, so note what would resolve it. A single weak data point shouldn't decide the alert either way. OFAC points out that "an exact match on an address alone, may not be sufficient," since many businesses share an address. A clear conflict on hard identifiers, such as a different date of birth and nationality, is what supports closing an alert. Cite both values.

3. Classify the alert

Record it as a false positive with the conflicting identifiers cited, as a potential match with the missing information listed and requested, or as a likely match escalated to the OFAC officer the same day. For a likely match, check whether a general or specific license covers the activity (OFAC FAQ 5).

4. Test ownership under the 50 Percent Rule

Map every owner and holding company with percentages and the documents behind them. Add up the stakes of all blocked persons, because ownership counts in the aggregate. Count an indirect stake only when it runs through an entity that is itself blocked (OFAC FAQ 401).

Control is a separate question. An entity that a blocked person controls but owns less than 50% of isn't automatically blocked, but OFAC urges caution with significant minority stakes and warns that dealing with the blocked person directly is still prohibited (OFAC FAQ 398).

5. Decide whether to block or reject

Block when a blocked person or a blocked entity has an interest in the property, unless a license or exemption allows the transaction. Reject when the transaction is prohibited, for example because it involves a sanctioned country, but no blocked person has an interest in it (OFAC FAQ 5). Record who approved the decision and the evidence it rested on.

6. File the report and keep the record

File the blocking or rejection report through OFAC's Reporting System within 10 business days, save the filing reference, and add blocked property to the annual report. Keep the full review, including the comparison table and ownership map, because OFAC can ask for it.

Worked example

Illustrative example. All names and figures are fictional.

A $48,000 outgoing wire names Northgate Trading LLC as beneficiary. Northgate isn't listed, but its ownership file includes two people the analyst confirms against their full list entries as blocked persons X and Y.

Scenario	Ownership	Blocked ownership counted	Result
A	X owns 30%, Y owns 20%	30% + 20% = 50%	Blocked; block the wire and report within 10 business days
B	X owns 30%; Holding Co owns 45%, and Y owns 40% of Holding Co	30% (Holding Co isn't blocked, so its stake doesn't count)	Not blocked under the rule; escalate the minority stake and check whether X acts for Northgate
C	Same as B, but Y owns 50% of Holding Co	30% + 45% = 75% (Holding Co is blocked, so its whole stake counts)	Blocked

Scenario B is where reviews go wrong in both directions. Blocking it overstates the rule, and clearing it without looking at X's role ignores OFAC's warning about dealing with blocked persons.

Where sanctions reviews go wrong

The most common problem is a closed alert with no reason attached, often because the analyst compared the filter's summary line rather than the full entry. Another is treating missing data as a conflict, which clears alerts that should have stayed open. Ownership mistakes usually come from counting each blocked person's stake separately instead of adding them up, or from counting a stake through a holding company that isn't blocked. Finally, many procedures still set five-year retention, which no longer meets the rule.

How Bretton fits in

Bretton has templates for sanctions work, and its agents gather the evidence for each alert, apply your bank's policy and draft the finding for your team to approve, working on top of the systems you already use (Bretton platform). Verifying a sanctions match is one of the reusable skills built into Bretton's Agent Builder. Bretton's agent harness requires "a durable identifier connecting the evidence to the subject, not just a matching name," and records a failed check as failed rather than as "nothing found." Figures such as ownership percentages are computed in a controlled way, and the written finding has to match them.

Common questions

Does OFAC confirm whether a sanctions alert is a false positive?

No. OFAC says it does not confirm potential matches or false positives, so the bank makes a risk-based decision and documents it.

Is a company blocked if a sanctioned person owns less than 50% of it?

Not under the 50 Percent Rule, unless blocked persons together own 50% or more. OFAC still urges caution with significant minority stakes, and a company can be designated on its own.

How long do banks have to keep OFAC records?

At least 10 years after the transaction. Records of blocked property are kept for as long as it's blocked and for 10 years after it's unblocked.

Sources

OFAC, FAQ 5: How to determine whether a hit is a valid match, FAQ 398 and FAQ 401 on the 50 Percent Rule
31 CFR 501.601, 501.603 and 501.604, recordkeeping and reporting
OFAC, Final rule extending recordkeeping to 10 years, March 21, 2025
FFIEC BSA/AML Examination Manual, OFAC examination procedures
Bretton, Platform, Agent Builder and Agent harness

Book a demo to see how Bretton prepares sanctions alert reviews for your analysts.

Clearing or escalating a sanctions alert: matches, ownership and reporting