OFAC does provide machine access to its sanctions data: the Sanctions List Service publishes the SDN List and the consolidated non-SDN lists as downloadable XML, CSV and other files, with delta files of each change, and OFAC's Technical Support covers its API. What OFAC does not offer is its Sanctions List Search tool as an API: OFAC says the tool "should not be utilized by automated systems that are configured to continually run searches through the tool". For a free, government-run search API across lists, the Commerce Department's Consolidated Screening List combines OFAC's lists with those of Commerce and State. Those sources answer "is this name listed?". They do not answer whether a program prohibits a payment or a general license covers it. Botminds' OFAC Sanctions Search sits beside the bank's screening service rather than replacing it: it calls the screening that already runs on OFAC's data, reads the regulations and licenses in force that day, and writes a cited, confirmed answer back to the payment and the case file.
Sources are OFAC, the Commerce Department's International Trade Administration, the UN Security Council and the FFIEC, linked where they appear. The integration examples come from the solution's fictional sample bank.
What OFAC's list data holds, October 26, 2026
19,471
primary entries on the SDN List
SDN.CSV, our count
1,568
of them vessels, and 342 aircraft
486
primary entries on the consolidated non-SDN lists
our count
72
distinct program tags across SDN entries
our count
Does OFAC have a sanctions search API?
OFAC has machine-readable data and an API behind its Sanctions List Service, but its search tool is for people. The Sanctions List Service "provides users with easy access to the most up-to-date Sanctions Lists and Sanctions list data ready for immediate download", lets users build a custom dataset by list or program, and keeps an archive of published delta files (OFAC Sanctions List Service). OFAC's contact page lists "OFAC's API functionality" among the issues its Technical Support handles (Contact OFAC).
Sanctions List Search, the free name-search screen, is a different thing. OFAC's FAQ 287: "It is intended to be used by individual users that are looking for potential matches on OFAC's sanctions lists. It should not be utilized by automated systems that are configured to continually run searches through the tool. For a copy of files that can be easily interpreted by automated systems and software programs, please see the list of XML, CSV, PIP, DEL, and FF files" (OFAC Sanctions List Search FAQs). A system that screens payments should load OFAC's files, not script the search page.
The nearest thing to a free government search API is the Consolidated Screening List run by the International Trade Administration. "The CSL API enables computers to freely access the CSL in an open, machine-readable format", combining "multiple export screening lists of the Departments of Commerce, State, and the Treasury", including OFAC's SDN and non-SDN lists, and "All the tools are updated automatically every day at 5:00 AM EST/EDT" (trade.gov, Consolidated Screening List). The same page warns that users "must check the official publication of restricted parties in the Federal Register", and a once-a-day refresh can miss an OFAC update made at 10 a.m.
How do I download the SDN list, and in what formats?
From the Sanctions List Service, as XML, CSV, fixed-field or delimited files, or as OFAC's advanced XML. OFAC's FAQ 79: "OFAC's SDN list is available in XML, fixed-field and delimited formats that can be imported into a variety of software programs"; FAQ 80 adds a CSV that opens in any spreadsheet (OFAC list file FAQs). The advanced format carries more than the legacy files; FAQ 5 notes that "OFAC's enhanced list data formats include additional information such as date of designation, and names and aliases in non-Latin character sets" (OFAC FAQ 5).
Every entry carries a unique identifier that links it to its aliases, addresses and identifiers, and OFAC sometimes publishes only those UIDs in a recent-actions notice when it makes a clerical change "to underscore the fact that these types of actions are solely administrative and that there have been no new entries" (FAQ 1031). A loader that keys on names instead of UIDs will treat a corrected spelling as a new person.
OFAC's list files, and what each is good for
| File or service | What it contains | Use it for | Watch out for |
|---|---|---|---|
| SDN List, CSV, delimited and fixed-field files | Primary entries, with addresses and aliases linked by UID | Loading a screening database; quick analysis | Join on UID; a spreadsheet view hides the alias and address files |
| SDN List, XML | The same data in one structured file | Systems that parse XML | Larger file; same content as the flat files |
| Advanced sanctions data model (XML) | Fuller data, including date of designation and non-Latin script names | Screening that matches original scripts and dates | A different schema from the legacy files |
| Consolidated (non-SDN) list files | Non-blocking lists such as SSI, MBS and CMIC | Sector and menu-based restrictions | Different prohibitions from the SDN List; do not block on them by default |
| Delta files | What changed in each publication | Knowing what changed, to re-screen | OFAC advises a complete refresh of the data itself |
| Sanctions List Search | A fuzzy name search over SDN and consolidated lists | A person checking a name | Not for automated use; no history of removed names |
Sanctions List Search vs a screening tool vs an answer service
They answer three different questions, and a bank needs all three. Sanctions List Search answers "does this name look like a listed name?" for a person at a screen, scoring how close the name typed is to each result with the Jaro-Winkler and Soundex algorithms, and OFAC "cannot make" a threshold recommendation (FAQs 247, 249, 250; what a score can and cannot say is in sanctions screening threshold). A screening tool answers the same question for every customer and payment, automatically, against the bank's own threshold. An answer service answers the question neither of them can: given this payment, today, which program applies, is it prohibited, does a license cover it, and what does each condition need?
Three tools, three questions
List search and screening (OFAC's tool, the bank's screening service): Is this name, or something like it, on a list?
A cited-answer service (OFAC Sanctions Search): Is this payment prohibited, licensed or not covered, and why?
List search and screening (OFAC's tool, the bank's screening service): OFAC’s list files, and other lists the bank loads
A cited-answer service (OFAC Sanctions Search): The screening result, plus 31 CFR chapter V, general licenses, FAQs, executive orders and the bank’s policy, each with its date
List search and screening (OFAC's tool, the bank's screening service): A score and a possible match
A cited-answer service (OFAC Sanctions Search): A verdict line, the passage and dates, each license condition matched to a fact
List search and screening (OFAC's tool, the bank's screening service): An analyst clears or escalates the match
A cited-answer service (OFAC Sanctions Search): The BSA/OFAC Officer confirms the answer; payments operations proposes the release or rejection
List search and screening (OFAC's tool, the bank's screening service): Judge programs, countries or licenses
A cited-answer service (OFAC Sanctions Search): Clear a possible list match, or decide 50 percent ownership
Delta files or a full refresh?
Use both: delta files to know what changed, full files to load the data. OFAC's own advice is explicit. The lists "are comprehensive", so "Database administrators can overwrite any old data in their systems with the latest versions" (FAQ 89); the delta file in the Sanctions List Service "may" be used by the public, but administrators "should use the comprehensive data files available on OFAC's website and completely refresh the list" (FAQ 90) (OFAC list file FAQs).
On how often to download, OFAC declines to set a rule: "OFAC cannot give specific advice on how to design an automated system for downloading its sanctions list data", and institutions "conduct their own risk assessments and decide how often they need to download the lists" (FAQ 88). The delta still matters downstream, because it is the list of names whose arrival should trigger re-screening of existing customers, open questions and held payments. In the sample bank, an SDN update at 8:02 a.m. added 23 entries and removed 4; the solution's watch agent re-screened 1,184 parties through the bank's screening service and reopened the one earlier answer whose party had been added.
Can a search tool connect to our wire system?
A screening service connects to the wire system; an answer service connects to both. Payment screening reads the message fields as the payment moves and holds what may match. The FFIEC manual expects the bank to decide which parties and fields to screen, and for international ACH it is blunt that a U.S. originating bank may not lean on screening by a receiving bank abroad (FFIEC manual, OFAC section; what IAT holds cost is in the price of an OFAC hold). The same manual reminds banks that a vendor does not take the duty away: the bank still answers for what its provider does.
OFAC Sanctions Search connects one step later. It reads a held or drafted payment from the payments hub, field by field, asks the bank's existing OFAC screening service to screen every party, and attaches its confirmed answer back to the payment. It never releases, rejects or blocks the payment itself; payments operations proposes, and the BSA/OFAC Officer or Deputy approves.
The integration path, system by system
Six connections, all to systems a bank already runs, and none that moves money on its own. The order matters: the payment's facts first, the screening result second, the law as it reads today third, the bank's own policy fourth, and a named person before anything goes back to the payment. Each step below is a read or a write, and each agent step goes on the audit trail with the answer.
The integration path, system by system, in OFAC Sanctions Search
Agent
Payments hub → intake agentReads the held or drafted wire, ACH IAT or remittance: parties, addresses, banks, amount and remittance line, marking each field it uses; masks account numbers.
Agent
Screening service ← screening agentSends every party to the bank’s OFAC screening service, which runs on OFAC’s list data; again on every list update.
Never: clears a possible match; it goes to sanctions alert review.
Agent
eCFR, Federal Register, OFAC pages → sources agentReads the program, prohibition, general licenses and FAQs in force today, with passages and dates; checks them at 6:00 AM daily and on demand.
Agent
Policy library → policy agentApplies the bank’s sanctions policy and sets who confirms and on which clock.
A person decides
BSA/OFAC OfficerConfirms, edits or returns the answer with a reason code in one queue.
Agent
Hand-off agent → payments hub and case managementAttaches the confirmed answer to the payment, or opens an ownership review, an alert review or the OFAC report with the facts filled in.
Never: releases, rejects or blocks a payment.
The answer travels with the payment, with the fields it used marked
How do we keep answers in our case file?
Attach each confirmed answer to the payment it cleared, keep the passages it cited, and keep it for 10 years. OFAC's record rule covers each transaction for 10 years after it (31 CFR 501.601), and FAQ 5 asks for a record of how each potential match was investigated and what the decision rested on (OFAC hit: what to do walks the six steps). A case file that holds the verdict but not the dated passage cannot show what the bank relied on.
Rejections need a report as well. A rejected transaction must be reported through the OFAC Reporting System within 10 business days of the rejection (31 CFR 501.604). In the sample bank, the hand-off agent opened the rejected-transaction report for a held wire to Sevastopol the day it was rejected, due November 4, 2026, while the customer notice was drafted to the bank's policy and named no screening result, review or report.
A rejection, its second check, the report and the customer notice in one place
What to check before you connect anything
Data lineage first: which list, which file, which time, and what happens when a feed is late. The questions below apply to any connection between list data, screening, an answer service and payments.
Eight integration checks before go-live
- Which OFAC files feed screening, and when are they loaded?
Name the format (legacy or advanced), the download schedule and the time from OFAC publication to live screening.
- Are other lists in scope, and on what clock?
UN, UK or EU lists for partner programs. The UN Security Council list is published as XML, HTML and PDF and says when it was last updated.
- What happens when a feed is late?
Answers that depend on it should go to a person, and the screen should say the feed is delayed.
- Does a list update trigger re-screening?
Of customers, open questions, held payments and past answers, using the delta to find what changed.
- Are entries tracked by UID, not by name?
So a corrected spelling is an update, not a new person.
- Which payment fields are read, and is each use visible?
Beneficiary address, bank identifier and remittance text decide most program questions.
- Where does the confirmed answer land?
On the payment and in the case file, with the passages and dates it rested on.
- What can the integration never do?
Release, reject or block a payment, or clear a possible match, without a named person.
The freshness of each source should be visible where the question is asked, not buried in a log. In the sample bank, the line under the question box showed regulations, licenses and FAQs checked at 6:00 a.m., the SDN List updated at 8:02 a.m., the policy version, and a warning that the EU list feed was delayed, so a partner-program answer that needed it went to the Officer.
Source freshness shown where the question is asked
Whether a free check plus a careful officer is enough for a smaller institution is a cost question; the total cost of a free sanctions check against a cited answer works it through.
Questions people ask
Is there a free sanctions API?
Yes. The International Trade Administration's Consolidated Screening List API is free and covers lists from Commerce, State and Treasury, including OFAC's SDN and non-SDN lists, refreshed daily at 5:00 a.m. Eastern. OFAC's own list files are also free to download from the Sanctions List Service.
Can I use OFAC's Sanctions List Search in an automated process?
No. OFAC's FAQ 287 says the tool "should not be utilized by automated systems that are configured to continually run searches", and points automated users to the downloadable files. FAQ 892 adds that users of the free service rely on it "at their own risk" and should re-test it when OFAC changes it.
Does Sanctions List Search show removed names?
No. FAQ 467: it "does not contain historical information", and names removed from OFAC's lists are not included. For history, OFAC keeps an archive of changes to the SDN List.
What is the difference between the SDN List and the consolidated list?
The SDN List names persons whose property is blocked. The consolidated non-SDN lists name persons subject to other, non-blocking restrictions, such as sectoral or menu-based sanctions, and some appear on both. On October 26, 2026 the SDN List had 19,471 primary entries and the consolidated list 486.
How fast should a list update reach our screening?
OFAC sets no deadline and leaves the download schedule to each institution's risk assessment (FAQ 88). The test is practical: how long a newly listed party could transact before the bank's screening and re-screening would catch it.