Table of Contents
Denied party screening for SaaS companies is often skipped. Many software teams assume trade rules are for people who ship physical goods. That is a costly mistake. If you sell software, host data, or grant access to a platform, you can still onboard a customer who sits on a sanctions or denied party list. Screening checks names against those lists before you provide the service.
This guide explains why software and SaaS firms need to screen. It covers what to check, when to check, and how to build a simple process. You will see where the risk hides in a digital business. You will also find links to deeper guides on each topic.
Why software companies are not exempt
Sanctions law does not care if your product is a box or a login. It cares who you deal with. Providing a service to a sanctioned person can break the rules. That includes granting a SaaS subscription, an API key, or cloud access. The denied party screening hub explains the core idea in full.
Software also touches export controls. Source code, encryption, and technical data can be controlled items. Sending them to the wrong country or person may need a license. If you are new to this area, start with what export controls are and the difference between export controls and sanctions.
Where the risk hides in a SaaS business
Physical exporters see the risk at the loading dock. SaaS teams see it at signup. The danger points are less obvious. Here are the common ones.
- New account signups and free trials.
- Paying customers and their billing details.
- Resellers, partners, and affiliates.
- Vendors and contractors you pay.
- Users you grant admin or API access.
- Investors and beneficial owners of accounts.
Each of these is a party you deal with. Each one should be checked. Self-serve signup is the hardest case. A user can create an account in seconds with no human review. That is why automated screening matters for software firms.
Which lists to screen against
You do not need to memorise every list. You need to screen against the main ones for your markets. Most SaaS firms with US exposure start with these.
| List | Who runs it | Why it matters to SaaS |
|---|---|---|
| OFAC SDN List | US Treasury | Blocks dealings with sanctioned people and firms. |
| BIS Entity List | US Commerce | Limits exports of software and tech to listed parties. |
| Denied Persons List | US Commerce | People barred from export transactions. |
| Consolidated Screening List | US government | One combined source for several US lists. |
Read more on the OFAC SDN List, the BIS Entity List, and the Consolidated Screening List. If you sell into other regions, add their lists too. Local rules may also apply where your users are based.
Do not forget the 50 percent rule
A clean name is not always a clean party. A company can be owned by sanctioned people even if its own name is not listed. The 50 percent rule treats such firms as blocked too. So you may need to check who owns your customer, not just the customer.
This matters for B2B SaaS. Your customer might be a shell or a subsidiary. Learn how it works in the guide to the 50 percent rule.
How to build a screening process
You can start small. A simple process beats no process. Here is a basic flow for a software team.
- Decide what to screen. Signups, paid accounts, and vendors are a good start.
- Screen at onboarding. Check the name before you grant access.
- Rescreen on a schedule. Lists change often, so recheck existing customers.
- Review any hit. A match may be a false positive with a common name.
- Block or escalate real hits. Freeze access and get advice.
- Keep records. Save what you checked and when.
For the detail behind each step, see how to do denied party screening. A written policy helps your team act the same way each time.
Automate it inside signup
Manual checks do not scale for self-serve products. Build screening into your signup and billing flow. Many tools offer an API you can call at account creation. Compare the options in automated versus manual screening.
Handle false positives well
Common names create false matches. A good process clears these fast without blocking real users. Set clear rules for who reviews a hit. See how to manage a false positive so genuine customers are not turned away.
What happens if you get it wrong
Penalties for dealing with a denied party can be severe. Fines can be large. In serious cases there can be criminal exposure. Reputational harm can also hurt a young software brand. The scale is explained in the guide to penalties for dealing with a denied party.
Watch for warning signs too. Odd payment routes and hidden owners can point to sanctions evasion red flags. A screening step at signup is a strong first defence against them.
Frequently Asked Questions
Does a free trial need screening?
Yes, it can. Granting access to your platform is a dealing, even without payment. If a trial gives a sanctioned party the use of your service, that is a risk. Screen at signup, not only at first payment.
We only sell in one country. Do we still need this?
Often yes. Users can sign up from anywhere online. Your payment provider or cloud host may also apply US or other rules. Check who your product reaches. The guide on who needs to do denied party screening can help you decide.
How often should we rescreen customers?
Screen at onboarding and again on a regular basis. Lists update frequently. A customer who was clean last year may be listed now. See how often to run screening for practical timing.
Key Takeaways
Software and SaaS firms are not outside trade rules. You deal with people every time someone signs up, pays, or gets access. Screen those parties against the main lists, build the check into onboarding, and rescreen over time. Start simple, keep records, and clear false positives with care. To learn more, visit the denied party screening guide or contact us for help setting up a process that fits your product.