Table of Contents
A sanctions hit on an existing customer is one of the tougher moments in compliance. You already sell to them. You may hold their money. Now a screening run flags their name against a government list. What you do in the next few hours matters, because the wrong move can turn one problem into two.
This guide walks through the full response. You’ll learn how to confirm the match, freeze the right things, report to the regulator on time, and handle the customer without breaking the law. It also covers the ownership rules and the paths back to a released account.
What a sanctions hit on an existing customer actually means
A hit means a customer you already deal with now matches a name on a sanctions or denied-party list. This can happen for two reasons. The customer was newly added to a list. Or your screening tool simply caught a match it missed before. Either way, the relationship cannot continue as normal until you resolve it.
Most hits come from lists run by the U.S. Treasury’s Office of Foreign Assets Control. You can view the primary source at OFAC. The most common one is the Specially Designated Nationals list, often called the SDN list. Other lists exist too, and each carries its own rules. For the difference between blocked and merely restricted parties, see our note on restricted versus denied parties.
The key point is timing. Sanctions rules apply the moment a party is listed. You do not get a grace period. If your customer is on the SDN list today, you must act today. This is why regular re-screening of your existing book matters as much as screening at customer onboarding.
Step one: confirm the match is real
Do not freeze anything yet. Many hits are false positives. A common name, a shared address, or a partial spelling can all trigger a flag. Rushing to block a real customer over a bad match causes its own harm.
Work through the match against what you know about the customer. Compare full name, date of birth, address, country, and any identifiers you hold. Look at the strength of the match score if your tool gives one.
- Full legal name, including middle names and known aliases
- Date of birth or company registration date
- Registered address and country of operation
- Passport, tax ID, or company number if available
- The exact list and program the hit came from
If the details clearly do not line up, record why and clear the alert. If they do line up, or you cannot rule it out, treat it as a live hit and move on. Our guide on resolving a false positive covers this step in more depth. Whatever you decide, write down your reasoning at the time.
Step two: block or reject, then stop all activity
Once a hit is confirmed, you must act at once. The core duty is simple. Stop the flow of value to the sanctioned party. How you do that depends on whether you hold blockable property.
Blocking
If you hold the customer’s funds or property, you block them. Blocked funds go into a segregated interest-bearing account. Only OFAC-authorized debits may leave that account. You cannot return the money to the customer. You cannot send it onward. It sits frozen until OFAC says otherwise.
Rejecting
If there is no blockable property in your hands, you reject the transaction instead. A wire passing through you toward a sanctioned party is a typical case. You refuse it and do not process it. You still owe a report, and you still must record what happened.
| Action | When it applies | What you do with the value |
|---|---|---|
| Block | You hold the sanctioned party’s funds or property | Freeze in a segregated interest-bearing account, no unauthorized debits |
| Reject | No blockable property is in your hands | Refuse the transaction and return or halt it |
Alongside this, freeze the wider relationship. Pause open orders. Hold pending shipments. Stop new invoices. Lock account changes. The goal is to make sure no value or benefit reaches the listed party while you sort out the next steps. For the mechanics, see how to process denied party screenings.
Step three: report to OFAC on time
Reporting is not optional, and the clock is short. You must report a blocked or rejected transaction to OFAC within 10 business days. Miss that window and you have a second violation on your hands, separate from the underlying dealing.
- Initial report: within 10 business days of blocking or rejecting
- Annual report: by September 30 each year for all blocked property still held
- Records: keep full documentation for at least five years
Your report should identify the party, the list, the property or transaction, and the date you acted. Keep a clean file of everything. Strong record keeping is your best defense if a regulator asks how you handled the hit later.
The 50 percent rule and hidden ownership
A customer does not have to appear on a list by name to be blocked. OFAC’s 50 percent rule pulls in companies owned by sanctioned parties. If one or more blocked persons own 50 percent or more of an entity, directly or indirectly, that entity is blocked too. It stays blocked even if its own name never shows up on any list.
This makes ownership checks part of your response. When a hit lands, look at who owns and controls the customer. A clean-looking company can be blocked through a parent or a shareholder. Our explainer on the 50 percent rule shows how to work through layered ownership. Watch also for red flags of sanctions evasion, since listed parties often try to hide behind new entities.
Communicating with the customer
You may tell the customer their funds are blocked, but be careful how. Do not coach them on how to move money or avoid the sanction. That itself can be a violation. Keep the message factual and short.
- State that the account or transaction is blocked under OFAC rules
- Cite the regulatory basis in plain terms
- Explain that release requires OFAC authorization, not your decision
- Point them to apply to OFAC for a license if they wish
Route the conversation through compliance or legal, not the sales team. Log every contact. If the customer pushes back or asks you to bend a rule, that request goes in the file too. Never process a payment to prove goodwill.
How blocked assets get released
Blocked property does not just sit forever with no way out. There are set paths, and each takes time. As the holder, you release funds only when OFAC authorizes it in writing.
| Path | What it does | Rough timeline |
|---|---|---|
| False positive correction | Shows the match was wrong | Weeks |
| Specific license | OFAC permits a defined transaction | Several months |
| Delisting petition | Challenges the designation itself | Many months to years |
The customer usually drives the license or delisting request. Your job is to hold the property correctly and act only on a real OFAC authorization. Do not release funds on the strength of a customer’s promise or a lawyer’s letter alone.
Preventing the next surprise
One hit on a live customer is a sign to check your process. Screening only at onboarding is not enough, because lists change all the time. Set a schedule for re-screening your existing base. Our guide on how often to screen suppliers and customers covers sensible intervals.
- Re-screen the whole customer book on a set cycle
- Screen again automatically whenever the lists update
- Keep an escalation path so hits reach the right people fast
- Train front-line staff to freeze first and ask questions second
- Store your reasoning for every hit and every clear
A steady program lowers the odds of a surprise and shows good faith if one slips through. For the wider picture, start with our hub on denied party screening.
Frequently Asked Questions
Can I keep serving a customer while I investigate a hit?
Only while you are confirming a possible false positive. Once the hit is confirmed real, you must stop. There is no grace period for a listed party. Keep the pause short and document your timeline.
Do I have to refund a blocked customer’s money?
No. You cannot return blocked funds to the customer. Doing so would move value to a sanctioned party. The money stays frozen in a segregated account until OFAC authorizes its release.
What if I only find the hit after a shipment went out?
Stop any further steps at once and preserve the records. Report the matter and consider a voluntary disclosure to OFAC. Acting fast and honestly counts in your favor if enforcement follows.
Who inside the company should handle the hit?
Compliance leads, with support from legal. Keep sales and account managers out of the decision. Give them a clear script that routes any customer questions straight to compliance.
Key Takeaways
A sanctions hit on an existing customer calls for speed and care in equal measure. Confirm the match before you act. Once it is real, block or reject the value, freeze the relationship, and report to OFAC within 10 business days. Check ownership under the 50 percent rule, keep the customer message factual, and release nothing without OFAC authorization. Then tighten your re-screening so the next hit does not catch you off guard. If you want help building a response process, contact us.