Sanctions alert review that puts the member and the list entry face to face, every identifier cited, and leaves every decision to a person
Every hit cleared identifier by identifier; true matches with the officer within the hour.
See one case, screen by screen ↓Sanctions alert review is the work of clearing the hits that OFAC name screening raises on members, applicants and payments: proving that each false hit is not the listed person and escalating the ones that might be. Sanctions Alert Review puts the member and the list entry face to face, one identifier per row, each value cited, and seven agents compare, guard list versions and draft. An analyst closes or escalates, a QA reviewer re-checks a sample blind, and the OFAC Officer decides every potential match.
AI use cases in banking: a buyer's guide to agentic AI for bank and credit union operations →
Updated
Sanctions alert review is the work of clearing the hits that OFAC screening raises on members, applicants and payments. Fuzzy matching makes hits, and most of them are false, but each one must be proven false: an analyst opens the member in the core banking system, the application in digital account opening or the wire in the payments hub, opens the list entry on another screen, compares name, date of birth, nationality, address and ID by eye, and types a reason such as “not a match” into case management. A potential match goes to the OFAC Officer by email.
The failures are well known. A hit is closed as a duplicate of an earlier closure after the list entry has changed. A potential match waits in a queue. A rationale cannot be reproduced. QA samples closures on a spreadsheet days later and sees the analyst's answer first. A list update is applied days late. And after a block or a rejection, the report to OFAC is due within 10 business days. OFAC liability is strict: a violation needs no intent.
Estimated split of the about 3 minutes an analyst spends on one hit today (about 160 hits each in an 8-hour day), by hand and with the solution; under 1 minute is the design target.
Seven agents compare every identifier, guard list versions and draft the reports; an analyst closes, a reviewer re-checks blind, two officers block.
Norrell Federal Credit Union, Thursday, October 22, 2026. The evening before, OFAC added an entry for CASTILLO, Maria Elena, and a member since 2014 has that name. The same morning, a held wire matches another entry on every identifier. Here is what happens, screen by screen, in the working solution.
OFAC published 22 changed entries at 4:47 PM on Wednesday, October 21: 14 additions, 6 amendments and 2 removals. The List watch agent loaded the update at 5:02 PM, kept every entry's version, and re-screened 538,200 member and party records against the changed entries by 5:41 PM: 268 hits, each saying which change caused it. The new entry CASTILLO, Maria Elena caused 3 of them.
This month, 9 of 9 OFAC list updates were loaded the day they were published.
Jordan's Today screen shows 412 hits in today's work on a 24-hour clock, in three lanes: list re-screen 268, payments 83 and onboarding 61. 297 are closed and 115 open. The agents' brief cites the October 21 update, the duplicate guard's 54 linked and 7 reopened hits, and a 5 of 5 match on a held $48,250.00 wire. One next hit waits: Maria Elena Castillo.
Member Maria Elena Castillo faces SDN entry 59341, version 1, CASTILLO, Maria Elena, one identifier per row. The name matches at a score of 96. The date of birth does not: June 14, 1988 against March 7, 1961. Nationality and place of birth do not: United States, born Portland, Maine, against Mexico, born Culiacán, Sinaloa. The entry gives no address and no ID number, so those rows are marked missing.
“2 of 5 identifiers conflict; not the listed person.” Confidence 0.97 · FP-DOB · FP-NAT
A citation sits beside every value. The member's side opens the core banking record or the account-opening file; the list side opens the entry itself: OFAC SDN List, entry 59341, version 1, added October 21, 2026, with the alias CASTILLO RUIZ, Maria Elena, the date and place of birth, nationality Mexico and the program [ILLICIT-DRUGS-EO14059]. It shows that the entry lists no address or ID number and that it was loaded at 5:02 PM, and the view is logged.
Run again replays the agents' work on the hit: intake, the duplicate guard, OFAC's six steps for a potential match, and the QA sampler, each with what it found. Step 3 compares the full entry: 1 match, 2 no match, 2 missing. Step 4 asks whether it is a likely match and answers no, with two disqualifying conflicts. Step 6 records the rationale, kept 10 years. The duplicate guard found no earlier hit against the new entry.
The Comparison agent never proposes a close on a name alone: two identifiers must conflict.
Jordan agrees and closes SH-261022-0418 as a false positive. The agent's codes FP-DOB and FP-NAT are preselected and the rationale is drafted for the analyst to edit; changing the codes would require an override reason, OV-1 to OV-3, and put the closure in the QA sample. At the moment of closure the QA sampler draws it for today's sample, with a random draw of 0.041 under 0.10.
The closure is kept 10 years with the ledger and the list version it was decided on.
Grant sees the same ledger without the identifier marks, the agent's verdict or Jordan's decision, and answers first: not the listed person. Only then does the comparison appear, with his answer, Jordan's closure and the agent's verdict side by side, and he records QA-A, agree. The hit is one of 39 closures in today's sample: 31 drawn at random and 8 by rule.
Nobody re-reviews their own closure.
Keisha Monroe closed Samir Haddad's hit against entry 48807 on September 3, because version 2 of the entry had no date of birth. The October 21 amendment, version 3, adds 1984 and a place of birth, Beirut, and Samir was born on March 3, 1984 in Beirut. The guard does not link the new hit to the old closure: it reopens it, the comparison now finds 3 of 5 identifiers matching, and the hit goes to the OFAC Officer.
Today 61 hits had an earlier closure: 54 linked on an identical entry version, 7 reopened because the entry changed.
At 9:58 AM a held outgoing wire of $48,250.00 from member business Harborline Marine Repair LLC to Kestrel Bay Trading FZE in the Jebel Ali Free Zone hit an entry under the [NPWMD] program. All 5 identifiers match: name, registration number JAFZ-118204, country, address and entity type. Keisha Monroe escalated it at 10:03 AM, and it was on Renée's desk at 10:04 AM with the ledger, the wire and the clock, beside Samir Haddad and Elena V. Morozova.
October to date: 41 potential matches escalated, all within the hour, median 22 minutes.
Renée decides true match, block, at 10:46 AM. Nothing moves until Curtis Vang approves at 10:48 AM: then $48,250.00 goes to blocked account 9900-0417 and the drafted blocked-transaction report goes to OFAC reporting, due Thursday, November 5, 2026, 10 business days under 31 CFR 501.603. A confidential referral goes to the BSA team in case management.
What Harborline sees in online banking: “Could not be sent”. Never a list, a match or a referral.
The same hits, seen by the four people who carry them: what their day looked like, and what it looks like now.
Seven agents compare every identifier, guard list versions and draft the reports; an analyst closes, a reviewer re-checks blind, two officers block.
Takes each hit from the OFAC screening service (onboarding, payments and list re-screens), attaches the member record and the source item, sets the SLA clock and routes it by load.
Builds the face-to-face ledger, cites every value to the member record or the list entry and its version, runs OFAC's six evaluation steps and writes a one-sentence verdict with its confidence and reason codes.
Compares each hit with earlier closures for the same member and entry, links it only when the entry version is identical, and reopens and explains a hit whose entry has changed.
Loads each OFAC update the day it is published, records every entry's version, re-screens against the changed entries and tells the analyst which change caused each hit.
Draws the QA sample at each closure (10% at random, 25% for a new analyst, every override and every closure below 0.95 confidence) and prepares the blind view for the reviewer.
Assembles the OFAC Officer's packet (ledger, payment, member and history), drafts the block or rejection record and the report to OFAC, sets the 10-business-day clock and drafts the referral to the BSA team.
Reads every closure reason, finds the settings behind false hits, tests a proposed change on seeded names and writes the expected effect for the OFAC Officer and the Deputy BSA Officer.
Decides every potential match; a deputy approves each block. The agents propose; a named person decides.
Ask in plain words. The answers cite the member record, the list entry or the rule they come from, and open the screen that goes with them.
Why is Maria Elena Castillo not the listed person?
Two of five identifiers conflict. She was born June 14, 1988 in Portland, Maine; the person on SDN entry 59341, added October 21, was born March 7, 1961 in Culiacán, Mexico, with Mexican nationality. The entry lists no address or ID, so only the name matches. OFAC asks how much of the full entry matches: here, only the name. The close is yours to make.
What changed in yesterday's OFAC update?
OFAC published 22 changed entries at 4:47 PM on October 21: 14 added, 6 amended, 2 removed. It was loaded at 5:02 PM and 538,200 records were re-screened by 5:41 PM: 268 hits, 189 from additions and 79 from amendments. The amendment to entry 48807 added a date of birth and a place of birth.
Why did the duplicate guard reopen Samir Haddad?
Keisha Monroe closed his hit on September 3 because entry 48807, version 2, had no date of birth. Version 3, published October 21, adds 1984 and a place of birth, Beirut, both matching him. A closure is reused only on an identical entry version, so the guard reopened the hit; 3 of 5 identifiers now match and it is with the OFAC Officer.
Prepare the NCUA examiner pack for October
The pack holds October 1–22: 10,214 hits with their ledgers and citations, the 41 escalations, the 2 true matches with their OFAC reports, 1,092 QA results with the blind answers, and the list versions used. Tax IDs are masked to the last 4, and records are kept 10 years. Choose the audience and build it.
13 screens from the working solution, on its sample data. Pick one to see it large.
The Compliance Systems Administrator edits the settings and every save is a new version. Thresholds and QA rates wait for the BSA/OFAC Officer, and a tuning change needs the officer and the deputy before it is applied.
| Setting | Default | Choose from |
|---|---|---|
| The agent proposes a close only when | Two or more identifiers conflict and confidence is 0.92 or more | Your conflict count and confidence; a change waits for the BSA/OFAC Officer |
| The agent escalates whenever | Three or more identifiers match | Your match count; a change waits for the BSA/OFAC Officer |
| Bulk acceptance qualifies at | Confidence 0.95 or more with two conflicts | Your confidence floor; every bulk closure still enters QA sampling |
| A duplicate is linked only on | An identical entry version and identical member identifiers | A change waits for the BSA/OFAC Officer |
| QA sample | 10% of each analyst's closures a day; 25% in the first 90 days; every override; every closure below 0.95 | Your rates; the review is always blind and never by the closer |
| Screening service fuzzy threshold | 85 | 88 for single-token names proposed, tested on 2,400 seeded names; applied after the officer and deputy approve |
| SLAs | Payment hits 30 minutes; onboarding 1 business day; list re-screen 2 business days; a potential match to the officer within 1 hour | Your clocks; warn the analyst at 80% of an SLA and the officer at 100% |
| Records kept | Sanctions records 10 years (31 CFR 501.601); BSA records 5 years; the longer applies | Redaction profiles for the NCUA and state examiners, internal audit and the BSA Officer |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “estimated” = our estimate of where an analyst's minutes go on one hit · “typical” = published figures: OFAC civil penalties in 2025 and 2024 (a published law-firm review), the 8 days in OFSI's September 8, 2025 disclosure, and vendor and trade sources for the commonly reported 90–95% false-positive range, directional only. Rules: 31 CFR 501.603 and 501.604 (reports within 10 business days), 31 CFR 501.601 (10-year records, effective March 21, 2025), 31 CFR 1010.430 (BSA records), OFAC FAQ 5 and A Framework for OFAC Compliance Commitments (May 2, 2019). Norrell Federal Credit Union, its members, the businesses, the list entries and the people named on this page are fictional: characters and sample data in the working solution.
Sanctions alert review is the work of clearing the hits that OFAC name screening raises on members, applicants and payments: proving that each false hit is not the listed person and escalating the ones that might be. Sanctions Alert Review puts the member and the list entry face to face, one identifier per row, each value cited, and seven agents compare, guard list versions and draft. An analyst closes or escalates, a QA reviewer re-checks a sample blind, and the OFAC Officer decides every potential match.
An OFAC hit means the screening service found a name close enough to a list entry to need a person's review. Here the Intake agent attaches the member record and the source item and sets the clock, and the Comparison agent compares every identifier on the entry and writes a verdict with its confidence. The analyst then closes it with reason codes, escalates it to the OFAC Officer or asks for information.
On the full list entry, not the name: the Comparison agent proposes a close only when two or more identifiers conflict and confidence is at least 0.92, and never on a name alone. The analyst closes it with the agent's reason codes, such as FP-DOB and FP-NAT, or changes them with an override reason. The closure keeps the ledger, the citations and the list version for 10 years.
The analyst escalates it and the Escalation agent puts it on the OFAC Officer's desk with the ledger, the held payment, the member and the clock; in the sample month, 41 of 41 arrived within the hour. The officer decides true match (block or reject) or not the listed person. A block or rejection moves nothing until the Deputy BSA Officer approves, and the drafted report to OFAC carries its 10-business-day due date.
The List watch agent loads each OFAC update the day it is published, keeps every entry's version and re-screens against the changed entries, saying which change caused each hit. The Duplicate guard reuses an earlier closure only when the list entry version is identical; when the entry has changed, it reopens the hit and shows which earlier reason no longer holds.
The Tuning agent reads every closure reason, finds the settings behind false hits and tests a proposed change before anyone approves it. In the sample, raising the threshold for single-token names from 85 to 88 is expected to remove about 70 hits a day, while 180 of 180 list-derived variants still hit. The change is applied only after the OFAC Officer and the Deputy BSA Officer approve it.
Yes. Agents compare, cite, draft and propose; they never close, block, reject, release, file or change a setting. The analyst closes, a QA reviewer re-reviews a sample blind, the OFAC Officer decides potential matches, and the Deputy BSA Officer approves every block, rejection and OFAC report.
The Agentic Solution Engine builds and deploys it from your requirements and documents (your screening rules, reason codes, SLAs, QA rates and a sample of past hits), and it goes live once every quality gate has passed. We will walk you through it on your own hits first.
Held payments released or stopped in minutes, every decision with its reason and time.
1-min demoOFAC ReportingEvery OFAC report filed in 10 business days, every blocked dollar tied to the ledger.
1-min demoAdverse Media ScreeningA pile of articles becomes one cited story, decided in minutes.
1-min demoWe'll run Sanctions Alert Review on a sample of your own past hits and list updates.