Screening a vendor master file of thousands against OFAC
To screen a vendor master of thousands of records, download OFAC's SDN and Consolidated list files, export your vendors with names, other names, country and tax ID, and match the two in a batch. Do not run thousands of names through OFAC's Sanctions List Search: OFAC says that tool is for individual users and is not intended for automated systems running searches continually, and points organizations to its CSV, XML and other data files instead (OFAC FAQ 287).
Get the list files
OFAC publishes the SDN list as a CSV that opens in a spreadsheet (OFAC FAQ 80), and offers the SDN and Consolidated lists in several machine-readable formats through its Sanctions List Service (Sanctions List Service). Each file is complete, so you can replace last month's copy with this month's rather than applying updates (OFAC FAQ 89).
Record the publication date of the files you use. It goes on every result row.
Export the right columns from the ERP
| Column | Why |
|---|---|
| vendor_id | Joins results back to the ERP record |
| legal_name | Primary name to match |
| other_names | DBA and trading names, one per row or separated |
| country | First detail to compare when a name matches |
| address | Second detail to compare |
| tax_id or registration number | Separates companies with the same name |
| status | Screen active vendors; decide whether to include inactive ones |
| last_paid | Lets you prioritise vendors that are actually paid |
Split other names into separate rows before matching. A vendor that trades under a different name is screened under each one.
Match fuzzily, then review
Exact matching misses spelling variants and word order. OFAC's framework names failing to account for alternative spellings among the root causes of past violations (OFAC framework). Use a fuzzy name match, keep every pair above your threshold as a candidate, and write the threshold into your policy.
Expect candidates. Common names and generic company words produce hits that are plainly not your vendor. OFAC also marks some aliases as weak, because broad names are likely to generate false hits; it keeps them to help confirm matches triggered by other identifiers (OFAC FAQ 122).
Working through candidates at volume
- Sort candidates by score and by how recently the vendor was paid.
- Clear the easy ones first: different country and different registration number.
- For the rest, compare the full list entry with the vendor record, as OFAC's FAQ 5 sets out (OFAC FAQ 5).
- Record a decision and a reason for every candidate. Our false positive guide has wording you can reuse.
- Escalate anything you cannot clear, and hold payments to that vendor until it is decided.
The first full run is the heavy one. After that, keep last run's decisions so the same cleared pair is not reviewed from scratch every month, and re-review it only if the vendor's details or the list entry changed.
Don't forget owners
A vendor not named on any list can still be blocked if blocked persons own 50 percent or more of it, directly or indirectly, in the aggregate (OFAC FAQ topic 1521). A name match against the vendor file will not catch that. For vendors you pay regularly or abroad, hold owner names in the vendor record and screen them in the same batch. See sanctions checks in vendor due diligence.
If a vendor is a true match
Stop payments to the vendor and follow what to do after a true match. Blocked property and rejected transactions are each reported to OFAC within 10 business days (31 CFR 501.603, 31 CFR 501.604).
Keep each run
Save each month's results file with the list dates it used. OFAC requires records of transactions subject to its rules for at least 10 years (31 CFR 501.601). For the file layout, see the monthly vendor scrub; for how often to run it, see how often to re-screen.
This is screening data, not legal advice. Run a free OFAC check on any vendor the batch flagged before you clear it.