Name screening vs transaction screening: two controls, two clocks

Name screening and transaction screening are two different sanctions controls. Name screening, also called customer screening, compares the bank's own customers and related parties with the sanctions lists at onboarding and again when a customer's details or the lists change. Transaction screening compares the contents of each payment, every party, bank, vessel, place and free-text word, with the lists before the money moves. Name screening has days to resolve a hit; transaction screening has until the payment's cut-off. Banks need both because each sees data the other cannot. Botminds' Payment Sanctions Screening works on the transaction side: the payments the filter has stopped, which wait on a clock until a person decides.

What is the difference between name screening and transaction screening?

The difference is what each control looks at: a relationship, or a movement of money. The Wolfsberg Group, the banking standards body, defines the pair this way: "Transaction screening is used to identify transactions involving targeted individuals or entities. Customer or Name screening is designed to identify targeted individuals or entities during on-boarding or the lifecycle of the customer relationship with the FI" (Wolfsberg Guidance on Sanctions Screening, 2019). Wolfsberg describes the two together as "a robust set of controls for identifying sanctions targets", which is another way of saying neither is enough alone.

OFAC's own FAQs treat them as different tools. Asked what to look for in compliance software, OFAC noted: "Some packages are used to interdict sanctioned countries and names on the Specially Designated Nationals or other sanctions lists in wire transfers. Others are used to check the names of new customers or to routinely filter the names of all account holders" (OFAC FAQ 31). They often run on separate systems with separate queues, worked by different teams.

Name screening: who the customer is, checked when lists change

Name screening runs on the bank's reference data, which changes slowly, so it can run in batches. The examiners' manual sets the expectation: "New accounts should be compared with the OFAC lists prior to being opened or shortly thereafter (e.g., during nightly processing)". Existing customers are to be checked again whenever OFAC adds or changes an entry, though a lower-risk bank may do it on a fixed weekly, monthly or quarterly cycle (FFIEC BSA/AML Examination Manual, OFAC; how fast that cycle has to be is the subject of OFAC sanctions list updates).

The scope goes beyond the account holder. European supervisors expect customer screening to cover "beneficial owners through ownership interest", "beneficial owners through control" and "any person purporting or being authorised to act on behalf of the customer" (EBA Guidelines on restrictive measures, 2024, guideline 18). In the U.S., a customer owned 50% or more by blocked persons is itself blocked, so the owners matter just as much.

The weakness of name screening is the gap between a new designation and the next rescreen. Customer data is good; timing is the risk.

Transaction screening: every party, bank and word, before the money moves

Transaction screening runs on the payment message, and must finish before the payment is executed. The FFIEC is direct: "Transactions such as funds transfers, letters of credit, and noncustomer transactions should be checked against OFAC lists prior to being executed." Wolfsberg adds that screening "should be performed at a point in time where a transaction can be stopped and before a potential violation occurs" (Wolfsberg, 2019, section 5.3).

The payment carries names the bank has never screened as customers: the beneficiary abroad, the beneficiary's bank, intermediaries, the ship carrying the goods, the port of discharge. For a bank acting solely as an intermediary, OFAC has said it would not expect research into non-account parties that do not appear on the SDN List, where the bank has no relationship with them and no reason to know their status. But a bank that "currently has information in its possession leading the bank to know or have reason to know" that a party is blocked answers for the payment if it fails to block it (OFAC FAQ 116). Anything written in the message is information the bank has.

Transaction screening's queue: names the bank has never seen, on a clock

What fields are screened in a payment?

A payment is screened on every field that names a party, a bank, a place or a thing, and on the free text. The EBA guidelines list the minimum for European payment providers: information on payer and payee, "the purpose of the transfer of funds", "other free-text fields that provide further information on the actual sender/recipient", and the "details of PSPs and CASPs involved in the transfer of funds or crypto-assets, including intermediate institutions, correspondents, with screening of identification codes such as BIC, SWIFT and other" (EBA guidelines, 21). U.S. guidance points the same way.

Where each of those fields sits in an ISO 20022 payment message, and which ones carry identifiers that clear a hit, is laid out in ISO 20022 sanctions screening, field by field.

Why payment hits differ from customer hits

Payment hits differ because the data is thinner and the vocabulary is wider. A customer hit compares a listed person's name with a customer whose date of birth, address and ID number the bank already holds, so most hits close on one comparison. A payment hit compares a listed name with a string typed by a stranger, often with no date of birth or registration number at all.

The vocabulary of a payment is also broader than a customer list. Common words in vessel names, place names inside street addresses and company names that share a word with a listed entity all generate hits that would never appear in customer screening. On a sample bank's desk, one OFAC update listing a Dubai shipping company called Crescent Harbor produced 31 payment hits the next morning, among them a seafood company, a dental office, a marina and two streets in four U.S. states, none sharing an address, registration, owner or bank with the listed company. The bank, payments and list entries in that example are fictional.

The difference changes how hits should be cleared. A customer hit can wait a day for a document; a payment hit needs identifiers fast, from the message, the customer file, a registry or the other bank. That is the work Payment Sanctions Screening prepares for the analyst.

Name screening knows the customer and waits for the list. Transaction screening knows the list and meets strangers on a deadline.

Is transaction screening the same as transaction monitoring?

No. Transaction screening checks each payment against sanctions lists before it moves and stops it if something matches. Transaction monitoring looks back across activity, often weeks of it, for patterns that suggest money laundering or other suspicious activity, and leads to a suspicious activity report rather than a stopped payment. The first is a sanctions control with a cut-off; the second is an anti-money-laundering control with a review cycle.

The two meet at the edges. A sanctions evasion pattern, such as payments routed through a series of new intermediaries, shows up in monitoring rather than screening; a monitoring alert can lead to a customer's names being added to a bank's internal screening list. But the queues, data, staff and deadlines differ, and so do the tools. The monitoring side has its own solution in Botminds' range, AML Alert Triage.

Do you need both, and which one does OFAC require?

OFAC requires neither by name; it requires the outcome. "Every transaction that a U.S. financial institution engages in is subject to OFAC regulations", in OFAC's words (OFAC FAQ 45), and a bank that processes a payment for a blocked person has violated them however it screens. How a bank meets that duty is a risk-based choice, which in practice means both controls for any bank that sends or receives cross-border payments: the FFIEC lists "International funds transfers" and "Cross-border automated clearing house (ACH) transactions" among higher-risk areas.

Where the line falls for domestic payments is less settled. Wolfsberg observes that screening domestic payments in real time "may be unnecessary" where every account holder is already screened under the same rules, and the EU has turned that idea into law for euro instant payments. Instant payment regulation and sanctions screening compares the EU and U.S. positions.

Where each control fails: two enforcement cases

Each control has failed in a way the other would have caught. MidFirst Bank's vendor screened new customers and changed records daily, but ran the whole existing customer base against the list only once a month. Two customers were designated, and the bank processed 34 payments for them before the vendor flagged them, "14 days after their addition". Almost all of the money, 98% by value, had moved within six hours of the designation (OFAC Finding of Violation, MidFirst Bank, July 2022; the case is traced hour by hour in OFAC sanctions list updates). Screening those payments against an updated list would have stopped them; the customer rescreen came two weeks late.

The opposite failure is a transaction filter with the right timing and the wrong data. Deutsche Bank Trust Company Americas processed 61 payments to a designated Crimean bank whose BIC code and near-identical name and address were in every message, because it had not loaded the BIC into its filter and had set the filter to send only exact matches to a designated entity for review (OFAC, Deutsche Bank Trust Company Americas, September 2020; what a match score can and cannot tell you is in sanctions screening threshold). The payments were screened on time; the screening could not see what was there.

A payment hit cleared with the payment's own identifiers

The practical lesson is to treat the two as one program with two clocks. The lists, the versions and the decisions should be shared, so that a name cleared on the customer side is not re-litigated from scratch on the payment side, and a payment hit on a customer's owner reaches the customer team. When a wire is held and a client asks why, why would a bank hold a wire transfer gives the plain answer, and Payment Sanctions Screening shows the transaction side in full.

Questions people ask

Is name screening the same as sanctions screening?

Name screening is one form of sanctions screening: the check of the bank's customers and related parties against the lists. Transaction screening is the other. Name screening is also used for politically exposed persons and adverse media, which are not sanctions controls.

How often should existing customers be rescreened?

Whenever the lists change, by risk. The FFIEC says banks with lower OFAC risk may compare the customer base periodically, for example weekly, monthly or quarterly. MidFirst's monthly rescreen let 34 payments through in the 14 days after two customers were designated, which is why many banks rescreen on every list update.

Do domestic ACH payments need transaction screening?

For domestic ACH the FFIEC places the duty on each end: the originating bank verifies its originator is not blocked, and the receiving bank verifies its receiver, "relying on each other for compliance". International ACH (IAT) entries carry more stringent expectations, including review of the payment details.

Why do payment hits have more false positives than customer hits?

Because the data that rules a match out, such as a date of birth or a registration number, is usually in the customer file and usually missing from the payment. Payments also carry words that customer lists do not, such as ship names, street names and free-text references, each of which can resemble a listed entry.

Which teams own name screening and transaction screening?

It varies, but they are often separate: customer screening sits with onboarding and KYC teams, transaction screening with a payments sanctions team that works to cut-offs. A Sanctions Officer often approves blocks and rejects from both, and OFAC reports from either side are filed through the same OFAC Reporting System.