Sanctions Compliance Is a Data Quality Problem

Why effective screening depends on accurate identifiers, disciplined review and risk-based controls, not simply longer sanctions lists

Sanctions compliance is often measured through scale.

How many lists are covered? How frequently are they updated? How many customers and transactions are screened? How many alerts are generated?

These are relevant measures, but they do not answer the most important question: does the screening process identify the right risk?

The latest sanctions-modernisation action by the U.S. Treasury provides a useful reminder that effective compliance depends not only on adding names, but also on maintaining accurate, current and usable data.

On 27 July, OFAC removed 84 individuals and entities, improved identifying information for 22 entries and resolved 18 sets of duplicate listings. Treasury said the review focused partly on older records involving deceased individuals, defunct entities and targets for which available information was insufficient for effective screening.

This is not a retreat from sanctions enforcement.

It is an acknowledgement that list quality is part of enforcement quality.

Longer lists do not automatically create stronger controls

A sanctions list is useful only when financial institutions and businesses can apply it effectively.

When a record contains a complete name, date and place of birth, nationality, identification number, address and known aliases, a potential match can be assessed with greater confidence.

When the record contains only a common name or incomplete historical information, the screening process becomes less precise.

The practical result can be a large number of alerts involving people or companies that are not actually sanctioned. Compliance teams then spend time reviewing low-quality matches, requesting documentation and delaying legitimate payments.

This creates an important distinction:

A screening system can be highly active without being highly effective.

The number of alerts generated says little about the quality of the underlying control. A useful programme should detect genuine exposure while allowing ordinary business to continue with proportionate friction.

Treasury’s latest action reflects that principle. Where an older designation remained relevant, OFAC added identifiers such as dates and places of birth, nationality, gender and unique identification numbers. Where the target was no longer a current policy priority, removal was considered more appropriate.

Screening is only the first step

Sanctions screening is sometimes treated as a binary process.

A name either matches or it does not.

Real cases are rarely that simple.

A potential match needs to be examined against additional information:

• legal name and aliases;
• date and place of birth;
• registration or identification numbers;
• ownership and control;
• addresses and jurisdictions;
• counterparties and transaction purpose;
• relevant sanctions programme;
• applicable licences, exemptions or restrictions.

A fuzzy name match is therefore an alert, not a conclusion.

The institution still needs a documented process for determining whether the customer, counterparty, vessel, wallet, bank or transaction is genuinely connected to a sanctioned target.

OFAC itself promotes a risk-based sanctions compliance model built around management commitment, risk assessment, internal controls, testing and auditing, and training. It also expects organisations to update their compliance programmes according to their products, customers, counterparties and geographic exposure.

This means sanctions compliance cannot be delegated entirely to a screening engine.

Technology finds possible relationships. People, procedures and reliable data determine what those relationships mean.

Poor data creates operational consequences

The cost of weak sanctions data extends beyond the compliance department.

A payment held for investigation may affect supplier relationships, customer support, liquidity planning and contractual deadlines. A customer incorrectly identified as a sanctions match may face repeated requests for information or loss of access to financial services.

At the same time, excessively broad thresholds can create alert fatigue.

When analysts repeatedly review obvious false positives, there is a risk that genuinely important cases receive less attention. This is an operational inference from the Treasury’s focus on outdated and hard-to-screen entries: reducing unnecessary ambiguity should allow institutions to direct more resources toward material threats.

The objective should not be zero alerts.

That would likely mean that the controls are too weak.

The objective should be a manageable and explainable alert population in which higher-risk cases can be identified, prioritised and investigated properly.

Data quality begins inside the business

Regulators can improve official lists, but businesses also need reliable internal data.

A sanctions-screening system cannot distinguish two similarly named companies when the customer record contains only a trading name and an email address. It cannot test ownership exposure when beneficial-owner information is incomplete. It cannot explain a payment when the transaction record lacks a meaningful purpose or counterparty reference.

This makes customer and payment data part of the sanctions-control environment.

Useful information may include:

• full legal names rather than only commercial brands;
• registration and tax numbers;
• verified beneficial ownership;
• date and country of incorporation;
• structured addresses;
• bank and wallet counterparties;
• commercial purpose of payments;
• supporting invoices and contracts;
• geographic and sector exposure.

The stronger this information is at onboarding and transaction initiation, the easier it becomes to assess a sanctions alert without repeatedly returning to the customer.

Compliance efficiency is therefore connected directly to data architecture.

Ownership risk remains outside the list

Even a perfectly maintained list cannot identify every prohibited relationship.

Under OFAC’s rules, entities owned 50% or more, directly or indirectly and in aggregate, by one or more blocked persons can themselves be treated as blocked even when their own names do not appear on the SDN List. OFAC also expects payment processors and digital-asset businesses to implement tailored, risk-based programmes rather than relying on a single standard solution.

This is why list screening alone is not sufficient.

A business may receive no direct name match while still facing exposure through ownership, control, intermediaries or a transaction designed to evade restrictions.

The compliance process needs to connect list data with corporate ownership, customer behaviour, geography and transaction context.

That requires judgement.

A clean screening result should not automatically override other risk indicators.

Delisting is part of a credible sanctions framework

Sanctions are sometimes treated as permanent labels.

In reality, circumstances can change. A company may cease the activity that led to its designation. An individual may die. A legal or factual basis may no longer apply. A listing may have been duplicated or may lack sufficient information.

A credible sanctions framework therefore needs both designation and removal processes.

Treasury states that the integrity of the system depends partly on its willingness to remove targets when doing so is legally appropriate and consistent with national-security and foreign-policy objectives. In June, OFAC also launched an online reconsideration portal to formalise and streamline requests for removal.

This matters for compliance teams.

Delisting is not simply an administrative event. When official data change, organisations need to update screening systems, reassess blocked or rejected relationships and maintain evidence explaining any resulting action.

A customer should not remain restricted indefinitely because an internal database failed to process an official removal.

List updates must work in both directions.

What firms should review

The latest OFAC action gives financial institutions, payment companies, digital-asset providers and international businesses a useful reason to test their own sanctions operations.

The relevant review is broader than confirming that the latest list file has been downloaded.

Firms should examine:

• how quickly additions, amendments and removals enter production systems;
• whether customer and counterparty records contain enough identifiers;
• how matching thresholds are calibrated across different names and languages;
• how duplicate alerts are identified and consolidated;
• whether analysts can see the reason and programme behind a listing;
• how ownership and control are assessed beyond direct name screening;
• how false positives and confirmed matches are documented;
• whether previously restricted relationships are reconsidered after delisting;
• whether management information measures quality rather than only alert volume.

OFAC’s Sanctions List Service now supports delivery of sanctions data through standard formats, customised layouts and an API. That improves access to official data, but firms remain responsible for integrating and applying those data appropriately.

The availability of better information does not guarantee better decisions.

The operating process still matters.

Better data should support better judgement

Automation is essential for screening large customer and transaction populations.

But sanctions compliance is not a pure matching problem.

Names can appear in different alphabets. Corporate structures can obscure ownership. Addresses may be incomplete. Several people may share the same identity details. Payments may involve intermediaries that are not visible from a basic transaction record.

Technology should therefore support prioritisation, not replace investigation.

The strongest screening environments combine:

1. reliable regulatory data;
2. complete internal customer and transaction information;
3. appropriately calibrated matching;
4. ownership and network analysis;
5. experienced human review;
6. documented escalation and decision-making;
7. regular testing of control effectiveness.

This combination reduces unnecessary friction without lowering the standard of compliance.

MetaNord’s view

At MetaNord, we see sanctions compliance as an information-quality and workflow-design challenge as much as a regulatory one.

A longer sanctions list may create the appearance of stronger enforcement, but its real value depends on whether institutions can identify targets accurately and act consistently.

Businesses need more than a screening result.

They need to understand which party was screened, which identifiers produced the alert, how the decision was reached, what happened to the payment and what evidence remains for audit or regulatory review.

That requires structured data, clear ownership and reliable operating procedures.

The latest OFAC review sends a useful message: sanctions programmes should be measured by their effectiveness, not their volume.

The same standard should apply inside every compliance function.