What Is an OFAC Check and Who Needs to Run One
October 6, 2026
An OFAC check is a search of a person's or company's name against the sanctions lists published by the Office of Foreign Assets Control, a part of the U.S. Department of the Treasury. You run it before you onboard a customer, pay a vendor or ship goods, so you don't end up doing business with someone the U.S. government has blocked.
That's the short answer. The longer one matters more, because the rules behind the check are strict, and a lot of businesses only find out they're covered after something goes wrong.
What OFAC actually publishes
OFAC administers and enforces U.S. economic and trade sanctions. It doesn't publish one list. It publishes several, and an OFAC check normally covers all of them.
- The Specially Designated Nationals and Blocked Persons List (SDN list). This is the big one. It names individuals, companies, vessels and aircraft tied to sanctioned countries, terrorism, narcotics trafficking, weapons proliferation, cyber crime and other programs. Property of anyone on it is blocked, and U.S. persons are generally barred from dealing with them.
- The Consolidated Sanctions List (non-SDN lists). These carry narrower restrictions. Examples include the Sectoral Sanctions Identifications list, the Foreign Sanctions Evaders list and the Non-SDN Chinese Military-Industrial Complex Companies list. A name here doesn't always mean a full block, but it does mean some dealings are off limits.
Each entry is more than a name. It can include aliases, dates of birth, nationalities, passport and registration numbers, addresses and a tag showing which sanctions program it falls under. Those extra details are what let you tell a real match from a stranger who happens to share a name.
Who has to comply
OFAC rules bind all U.S. persons. That covers U.S. citizens and permanent residents wherever they live, anyone physically in the United States, and every company organized under U.S. law, including its foreign branches. For a couple of programs, such as Cuba and Iran, foreign companies owned or controlled by U.S. firms are covered too.
Non-U.S. businesses aren't off the hook either. If a deal touches the U.S. financial system, for example a payment in U.S. dollars that clears through a U.S. bank, it can cause a U.S. person to break the rules, and OFAC has fined foreign companies for exactly that.
In practice, these are the businesses that run OFAC checks every day:
| Business | Who gets checked | When |
|---|---|---|
| Banks and credit unions | Account holders, beneficiaries, wire parties | At account opening and on every payment |
| Fintechs and payment apps | Users, merchants, payees | At signup and before money moves |
| Crypto exchanges | Users and listed wallet addresses | At onboarding and on withdrawals |
| Exporters and freight forwarders | Buyers, consignees, end users | Before each shipment |
| Marketplaces | Sellers and payout recipients | Before the first payout |
| Car dealers, title and escrow companies | Buyers and parties to the deal | Before closing |
| Insurers and accounts payable teams | Claim payees and vendors | Before payment |
Why one missed match is a big deal
OFAC enforces its rules on a strict liability basis. You can be fined even if you didn't know the customer was on the list. Good intentions don't remove the violation, although they do affect how big the penalty is.
Civil penalties under the main sanctions law are adjusted for inflation every year and can reach twice the value of the transaction. When OFAC decides how hard to come down, its Enforcement Guidelines look at things like whether the violation was willful, how much harm it did, whether you reported it yourself and, importantly, whether you had a working compliance program. A company that screened, documented and fixed its gaps is treated very differently from one that never looked.
There's no single federal rule that tells every business exactly how to screen. Instead, OFAC published A Framework for OFAC Compliance Commitments in 2019. It asks for a risk-based program built on five parts:
- Management commitment, with real resources behind it
- A risk assessment of your customers, products and geography
- Internal controls, which is where screening lives
- Testing and auditing to prove the controls work
- Training so staff know what to do with a hit
Banks get examined on this directly. Everyone else is judged on it after the fact, which is a worse time to discover a gap.
What a good OFAC check looks like
Typing one name into a search box once is a start, but it's not a program. A check holds up when it does these things well.
It catches spelling variations
Names on the list are often transliterated from Arabic, Cyrillic or Chinese script, so the same person can appear as Mohammed, Muhammad or Mohamed. An exact text match misses those. Good screening uses fuzzy and phonetic matching and checks every listed alias, not only the primary name.
It uses the current list
OFAC doesn't update on a fixed schedule. New designations and removals can land several times a week. A list downloaded last month can already be wrong, so the data should refresh automatically and show when it was last updated.
It doesn't stop at onboarding
A clean customer today can be designated tomorrow. That's why teams re-screen their whole customer base whenever the list changes, instead of checking once and forgetting about it.
It leaves a record
If a regulator or auditor asks why you approved someone, you need to show what you searched, which list version you used, what came back and who decided. In March 2025 OFAC extended its recordkeeping requirement from five to ten years, to match the longer statute of limitations for sanctions violations. Ten years is a long time to rely on screenshots.
What to do when you get a hit
Most hits are false positives. A common name will match someone on the list who shares nothing else with your customer. Before you panic, compare the details: date of birth, nationality, address and ID numbers. If they clearly don't line up, document why you cleared it and move on.
If the details do line up, stop the transaction. U.S. persons must block the property of a true match and report it to OFAC within 10 business days. Transactions you reject rather than block, such as a payment you refuse to process, also need to be reported within 10 business days. Holders of blocked property file an annual report as well. When you're unsure, OFAC runs a compliance hotline you can call before you act.
How to run your first check
You can search the official OFAC tool one name at a time, and for a handful of names a year that may be enough. Once you're screening customers every day, you need batch uploads, alerts when the list changes, a review queue for possible matches and a saved record of every decision.
That's what OfacScanner does. It screens names against the current SDN and consolidated lists with fuzzy matching on aliases and transliterations, re-screens your saved records whenever the lists update and keeps an evidence record of every check. The result supports your decision, and the decision stays with you. Plans start at $49 a month, and you can see them on the pricing page.
Want to see it on a real name first? Try a free OFAC search and see the match score, the list entry and the details side by side.