Sanctions follow a different logic
Everything else in this course is risk-based. Sanctions are not, and mixing the two is a common conceptual error in this area. The Gambling Commission reminds casino operators that politically exposed persons and financial sanctions cannot be conflated: the money laundering rules do not prohibit doing business with a PEP, whereas doing business with a designated person is prohibited.
Anti-money-laundering obligations turn on suspicion, materiality and proportionate response. Sanctions prohibitions are absolute: dealing with a designated person's funds, or making funds or economic resources available to them, is prohibited whatever the amount. There is no threshold below which it is permitted, no risk rating that excuses it, and no de minimis. In the two regimes that reach most operators, liability is also strict. OFAC may impose civil penalties generally on a strict liability basis, so a US person can in many cases be liable even where it did not know or have reason to know it was committing a violation, and for breaches on or after 15 June 2022 OFSI no longer has to show knowledge or reasonable cause to suspect before imposing a monetary penalty. The EU is the main exception: under its Russia asset-freeze regulation, a person incurs no liability if they did not know, and had no reasonable cause to suspect, that their actions would breach the measures. That defence rewards screening; it does not excuse its absence.
That difference drives everything about how screening is built. A monitoring rule can be tuned for volume. A sanctions screen cannot be tuned down because the false positives are annoying. The compliance programme around the screen is still designed on a risk basis, as OFAC's compliance framework expects, but the prohibition it enforces is not.
The regimes and lists
Several authorities designate persons and entities, and an operator is subject to more than one at a time.
United Nations designations flow into national regimes through domestic implementation: the Security Council requires member states to implement its sanctions, and in the UK new UN listings take effect through regulations made under the Sanctions and Anti-Money Laundering Act 2018.
National and bloc regimes include the European Union's consolidated list of persons subject to EU financial sanctions, the United Kingdom's UK Sanctions List, maintained by the Foreign, Commonwealth and Development Office, and the United States lists administered by the Office of Foreign Assets Control, of which the Specially Designated Nationals list is the best known. Since 28 January 2026 the UK Sanctions List has been the only source of UK designations: HM Treasury's OFSI Consolidated List of Asset Freeze Targets closed on that date and is no longer updated, so a screening system still pointed at it is screening against a frozen list.
Jurisdictional reach is the trap. US sanctions can apply to non-US firms through use of the US dollar, US persons, US-origin goods or US financial infrastructure: OFAC's enforcement record includes non-US firms that processed dollar payments through US financial institutions for business involving sanctioned persons or countries. An operator with no US presence can still be exposed through its payment chain, and "we are not a US business" is not an analysis.
Ownership and control rules extend designations beyond the named person. An entity owned or controlled by a designated person is generally treated as designated whether or not it appears on any list, with thresholds and definitions varying by regime. Under OFAC's 50 Percent Rule an entity owned 50 per cent or more, individually or in aggregate, by blocked persons is itself blocked; in the UK the test is more than 50 per cent of shares or voting rights, or control, and OFSI does not simply aggregate separate designated persons' holdings. Screening only against the published names therefore misses a category of exposure by design.
Who and what gets screened
Customers, at onboarding and on an ongoing basis. Initial screening alone is insufficient because lists change, and the whole point of a designation is that it happens at a moment in time.
List changes against the existing book. When a list updates, the entire customer base must be rescreened against the delta. OFAC's guidance calls for ongoing screening and risk-based re-screening to account for updates to its sanctions lists. An operator that screens at onboarding and never again will not notice a customer designated last month.
Payment counterparties, including the names on instruments funding an account and the destinations of payouts.
Business relationships: affiliates, suppliers, B2B partners, and their beneficial owners. OFAC lists improper due diligence on customers, supply chains, intermediaries and counterparties, including their ownership, among the recurring root causes of its enforcement cases, and the values involved are usually larger than any individual customer's.
Employees and contractors, where the operator's policy includes them, since a salary or fee paid to a designated person is making funds available like any other payment.
Geography. Some regimes are comprehensive and territorial, prohibiting most dealings with an entire jurisdiction rather than with named persons. That is a market access question, not a screening question, and it belongs in the geoblocking and licensing design rather than in a name-matching engine. OFAC's guidance for the virtual currency industry recommends geolocation tools and IP address blocking to stop access from sanctioned jurisdictions, and the same logic applies to any online operator.
Matching, which is where the difficulty lives
Name matching sounds trivial and is not.
Transliteration produces many valid spellings of the same name from non-Latin scripts. Common names generate very large numbers of coincidental matches. Diminutives and given-name conventions vary by culture. Ordering of family and given names differs. Dates of birth are frequently absent from list entries and from customer records alike.
Systems therefore use fuzzy matching with a similarity threshold, which OFAC itself recommends to account for common name variations and misspellings, and the threshold is a genuine trade-off. Set it loose and the team drowns in false positives, which leads to superficial clearing, which is how a true match gets closed as noise. Set it tight and true matches with a spelling variation pass through.
Three practices make this workable.
Use secondary identifiers. Date of birth, nationality and place of birth, which the UK Sanctions List records where available alongside passport and national ID details, cut false positives sharply where both records carry them. Collecting date of birth at onboarding is worth it for this reason alone.
Whitelist deliberately and reviewably. A customer cleared against a recurring false match should not be re-alerted every time, but the whitelist entry must record who cleared it, when and on what basis, and must be re-examined when the underlying list entry changes.
Tune with evidence and record it. Threshold changes need a documented rationale and a before-and-after measurement. It is an obvious place for a supervisor or auditor to ask why a number is what it is.
When there is a match
The sequence is prescriptive and the order matters.
Freeze first. Do not process the transaction, do not release funds, do not return the deposit. Making funds or economic resources available to a designated person is the prohibited act, and returning a deposit is making funds available. The Gambling Commission's guidance for casinos is explicit: no funds should be returned to the designated person, and the transaction should be suspended pending OFSI's advice.
Escalate immediately to the nominated officer or sanctions lead. This is not a decision for a first-line agent.
Assess whether the match is genuine, using all available identifiers and the list entry's own detail. OFSI distinguishes a name match from a target match, and asks to be contacted immediately where a close match could be a new alias.
Report to the relevant competent authority within the required timeframe. In the UK the holder of a casino operating licence is a relevant firm that must inform OFSI as soon as practicable when it knows or has reasonable cause to suspect that a customer is a designated person, so the duty can arise before the match is certain. In the US, blocked property reports are due within 10 business days. Reporting obligations here are separate from and additional to suspicious activity reporting: OFSI states that a SAR to the National Crime Agency does not meet the sanctions reporting obligation.
Apply for a licence or authorisation if any dealing is needed, including releasing funds. Some regimes provide licensing routes for specific purposes; none of them permit acting first and asking later, and OFSI's guidance states that licences cannot be issued retrospectively.
Do not tip off. Where the match also leads to a suspicious activity report, the money laundering tipping-off offences apply; and warning a designated person so that they can move assets out of reach risks circumventing the prohibitions, which is itself an offence.
The error to avoid is the well-meaning one: a customer matched, an agent apologises and refunds the deposit to close the complaint, and the operator has just committed the prohibited act while documenting that it knew.
Adverse media and the wider screen
Adverse media screening searches public sources for information suggesting a customer is involved in financial crime, corruption or other relevant conduct. It is not universally mandated but is common in enhanced due diligence, including for politically exposed persons and other high-risk relationships, and the Gambling Commission notes that open source information, such as press reports, may be helpful in carrying out customer due diligence checks.
Its value is real and its limits should be stated. Coverage is uneven across languages and jurisdictions. Allegation is not conviction, and a hit is a prompt for assessment rather than a conclusion. Name matching has the same difficulties as sanctions screening without the discipline of an authoritative list. And data protection constraints apply to retaining and acting on this material.
The useful discipline is to treat an adverse media hit like any other piece of evidence: record what was found, assess what it means for this relationship, record the conclusion and the reasoning, and set a review trigger. A folder of press cuttings with no assessment is the same failure as a folder of bank statements with no assessment.
Testing the screen
Sanctions screening is testable in a way most controls are not, and an operator that has not tested it has no basis for confidence in it.
Seed a test record matching a real list entry and confirm it alerts. Seed near-miss variations, a transliteration, a middle name dropped, a date of birth one day out, and see which the threshold catches. Push a list update and confirm the existing book is rescreened rather than only new customers. Check that payment counterparty names, not just account holder names, reach the screen. Confirm that B2B partners and affiliates are screened at all, because they sit outside the customer onboarding flow that most screening is built around.
None of these is a large exercise, and the failures they look for, screening software not updated for list changes and alternative spellings missed, are among the root causes OFAC has identified in its enforcement actions.