Table of Contents
A sanctions screening workflow is the repeatable set of steps you use to check people and companies against government watchlists. It runs before you onboard a customer, before you ship, and on a schedule after that. Done well, it stops a prohibited deal before money or goods move. Done badly, it drowns your team in false alerts and misses the real hit.
This guide shows you how to build one from scratch. You will see which lists to load, when to screen, how to handle a match, and what to keep on file. It is written for compliance staff at small and mid-size exporters, not just banks. If you want the wider picture first, start with our denied party screening hub.
What a sanctions screening workflow does
The job is simple to state. You take a name and other details, compare them to restricted party lists, and decide if you can deal with that party. Sanctions screening and denied party screening overlap heavily, so the same workflow covers both. If the terms confuse you, read our note on restricted versus denied parties.
A working process answers four questions every time:
- Who are we dealing with, and what data do we hold on them?
- Which lists must we check them against?
- Did we get a match, and is it real?
- What did we decide, and can we prove it later?
Step 1: Decide who and what you screen
Start with scope. You cannot screen well if you do not know which parties matter. Screening only your direct customer leaves gaps. Sanctions risk hides in the wider chain.
Screen every party to a transaction. That means customers, suppliers, banks, end users, and the freight forwarders who move your goods. Forwarders are a common blind spot, so see our guide on screening freight forwarders. If you are unsure whether the rules even apply to you, read who needs to do denied party screening.
- Customers and prospects
- Suppliers and vendors
- End users and consignees
- Freight forwarders and carriers
- Owners and directors of the above
Ownership matters because of the 50 percent rule. If a listed party owns half or more of a company, that company is blocked too, even when its own name is clean. Most beginners miss this. Read the 50 percent rule in sanctions screening before you finalize scope.
Step 2: Load the right lists
Your workflow is only as good as the lists behind it. Loading too few leaves holes. Loading every list on earth buries you in noise. Pick lists by your jurisdiction, your customers, and your products.
US exporters usually start with the Consolidated Screening List, which bundles the main US restricted party lists into one search. The most cited components are below.
| List | Agency | What it flags |
|---|---|---|
| SDN List | OFAC | Blocked persons and entities under sanctions |
| Entity List | BIS | Parties needing a license for exports |
| Denied Persons List | BIS | Parties stripped of export privileges |
| Unverified List | BIS | Parties BIS could not verify, extra due diligence |
Each of these has its own detail. See our pages on the OFAC SDN list, the BIS Entity List, the Denied Persons List, and the Unverified List. If you sell to government buyers, also add the SAM.gov exclusions list.
Sell into Europe or the UK, and you need their lists too. Match the list set to where your goods and money go. Set lists to update at least daily. Governments change them without notice, and a stale list is a false sense of safety.
Step 3: Fix your data before you match
Bad input data breaks screening. If a name is misspelled or a country is blank, the match logic cannot help you. Clean data first.
- Capture full legal names, not nicknames
- Record country, city, and address where you have them
- Add date of birth for individuals when available
- Strip out junk like “Inc.” mismatches and stray punctuation
- Store the same fields the same way every time
More detail here helps the tool sort a real hit from a common name. A birth date or a country turns a vague match into a clear yes or no. This single habit cuts your false positives more than any clever setting.
Step 4: Choose your match logic
Names rarely match exactly. Spelling varies, and bad actors change letters on purpose. So screening tools use fuzzy matching. It scores how close a name is to a listed one and flags anything above a set point.
Setting the threshold
The threshold is a dial. Set it high and you catch only near-exact names, so you miss variants. Set it low and you catch everything, including noise. Most teams start near the middle and tune from there.
- Too loose: thousands of alerts, staff burn out, real hits get lost
- Too tight: fewer alerts, but a disguised name slips through
- Right: tuned by testing against known cases, then reviewed
Test your settings in a sandbox before you go live. Feed in names you know should hit and names you know should not. Adjust until the results make sense. This choice between automated and manual screening is a real one, and we cover it in automated versus manual screening.
Step 5: Handle alerts and false positives
Most alerts are not real. A common name will match a listed one by chance. Your workflow needs a clear path to clear the noise and stop the true hits. Never auto-clear an alert without a look.
Work each alert the same way every time:
- Compare the full details, not just the name. Check country, date of birth, and address.
- Decide if the differences rule the party out. A different country often does.
- If it clears, write down why and move on.
- If it does not clear, hold the transaction and escalate.
- Save a screenshot or record of the list entry you compared.
A false positive is a match that turns out to be the wrong person. Clearing them fast and consistently is a core skill. Our guide on resolving a false positive walks through it. Watch for the opposite risk too. Some parties hide behind fronts, so learn the red flags of sanctions evasion.
When you get a true match
Stop. Do not ship, pay, or release goods. Hold the deal and tell your compliance lead. Depending on the list and the facts, you may need a license or a report to the agency. The cost of getting this wrong is high, as our page on penalties for dealing with a denied party makes clear.
Step 6: Set your screening timing
Screening once is not enough. Lists change, and a clean party today can be listed tomorrow. Build screening into set moments and a repeat cycle.
| When | What you screen |
|---|---|
| At onboarding | Every new customer, supplier, or partner |
| Before each shipment | All parties on that specific order |
| On a schedule | Your whole party database, re-screened |
| On list update | Existing parties against the new entries |
Screening at onboarding is the first gate, and we cover it in sanctions screening in customer onboarding. For how often to re-run your files, see how often you should re-screen. High-risk destinations may need tighter timing, as with exporting to China.
Step 7: Keep records you can defend
If you cannot prove you screened, you did not screen, as far as a regulator is concerned. Records turn a good process into a defensible one. Keep them from day one.
- The party details you screened
- The lists and version or date used
- The result, including any alert and how you cleared it
- Who reviewed it and when
- Any license or approval tied to the deal
This is your audit trail. It shows a clear line from the check to the decision. Learn the standard in what is an audit trail and the specifics in record keeping for denied party screening. Many US export records must be held for five years.
Put the workflow together
Each step above links to the next. Here is the whole flow in order, so you can map it onto your own tools.
- Define which parties you screen
- Load the lists for your markets and products
- Clean the input data
- Run the match with a tuned threshold
- Review each alert and clear or escalate
- Re-screen on your set schedule
- Record everything you did
Start simple. A small exporter can run this with a spreadsheet of parties and a free government search, then add software as volume grows. For a practical starting point, use our screening checklist and the guide to screening for small businesses. To sharpen an existing process, review denied party best practices and the full steps in how to process denied party screenings.
Frequently Asked Questions
What is the difference between sanctions screening and denied party screening?
The two overlap so much that one workflow covers both. Sanctions screening focuses on financial and trade sanctions lists like the OFAC SDN list. Denied party screening is the broader export term and includes lists like the BIS Entity List. In practice you screen against a combined set.
Can a small business build a workflow without expensive software?
Yes, at low volume. You can use the free government Consolidated Screening List search and keep records in a spreadsheet. The steps stay the same. As your order count grows, manual checks get slow and error-prone, and screening software starts to pay off.
How do I stop getting so many false positives?
Improve your input data first. Full names, countries, and birth dates let the tool rule out common-name matches. Then tune your match threshold by testing. A clear, written clearing process keeps decisions consistent across your team.
How often should I re-screen existing customers?
Re-screen your whole party base on a set cycle and whenever a list updates. Many firms re-screen against changes daily and run a full sweep on a regular schedule. Higher-risk customers and destinations justify more frequent checks.
Key Takeaways
A sanctions screening workflow is a fixed sequence you can hand to any staff member and trust. Set your scope wide, load the right lists, clean your data, tune your matching, work every alert, re-screen on time, and record it all. Start small and grow the tooling as your volume rises. The steps do not change, only the scale. If you want help designing a process that fits your trade, contact our team.