AI for sanctions screening: one OFAC hit, traced second by second

AI for sanctions screening today means software that reads a screening hit the way an analyst does, compares the customer with the full list entry, and writes down what it found, so that a person can decide faster and on better evidence. Research from the Federal Reserve suggests language models can tell true from false name matches far better than fuzzy matching alone, though much more slowly. The open questions are control questions: who decides, what the AI may never do, and what record proves it. Botminds' Sanctions Alert Review is built on that line: seven agents read, compare, cite, draft and propose, and an analyst, a QA reviewer and two officers make every decision. This guide traces one hit through the agents, second by second.

The traced hit is from a fictional sample, Norrell Federal Credit Union, as it runs through the solution; the timings are the solution's on that sample. The research and supervisory texts are quoted from their publishers.

What AI for sanctions screening does today

AI is already part of sanctions compliance. The U.S. Treasury's 2024 report on AI in financial services found it "widely used ... for AML/CFT and sanctions compliance, including analyzing large sets of data, detecting anomalies, flagging suspicious activities, and verifying customer identities under Bank Secrecy Act (BSA) obligations" (U.S. Treasury, Artificial Intelligence in Financial Services, December 2024). Most of that use sits in scoring and prioritization: machine-learning models that rank alerts, so people see the likely ones first.

What is new is software that does the reviewer's reading, not just the ranking. A language model can take a hit, the customer's details and the full list entry, compare them field by field, and explain the result in a sentence. The Federal Reserve's test is the best public evidence of how well that works on names: "across a range of realistic matching thresholds, the LLMs in our study reduced sanctions screening false positives by 92 percent and increased detection rates by 11 percent relative to the best-performing fuzzy matching baseline" (Allen and Hatfield, 2025). The same paper found the models "over four orders of magnitude slower than the fuzzy methods" and proposed "a model cascade that escalates higher uncertainty screening cases to LLMs". The practical shape follows: the filter stays, and AI works on the hits it raises.

Can AI clear sanctions alerts?

AI can do the work of clearing a sanctions alert, the look-ups, the comparison and the written rationale, but in a well-governed program it should not make the decision. OFAC's own guidance expects many screening alerts to be false positives and leaves each one to the organization's people to verify or rule out, gathering more identifying information from the parties where the record falls short (OFAC FAQ 5; FAQ 42). FATF's 2021 review of new technologies reached the same view more broadly: the tools sharpen where compliance effort goes, but they do not retire the human reviewer (FATF, 2021). The payments version of that split, where agents prepare and a person releases, is worked through in real-time payment screening.

The useful line is between proposing and deciding. An agent that proposes a close, with every identifier it compared cited and its confidence stated, saves the analyst the minutes that are not judgement and leaves the judgement in place. An agent that closes on its own is a suppression rule with better language, and the risks of suppression rules are a matter of record, as false-positive procedures when the list entry has changed sets out.

One OFAC hit, traced second by second

At 5:38 PM on October 21, the sample credit union's re-screen raised hit SH-261022-0418: member Maria Elena Castillo against SDN entry 59341, CASTILLO, Maria Elena, added to the list that afternoon. Here is what the agents did with it, in order, with the time each step took and what it wrote.

Intake, 0.8 seconds. The intake agent took the hit from the screening service, recorded its source as a list re-screen, attached the member's details from the core banking system, set the two-business-day clock for re-screen hits and routed it to an analyst by load. It cannot release or close anything.

Duplicate guard, 0.9 seconds. It searched for earlier closures for this member against this entry and found none: the entry was new that afternoon. Had there been one, it would have reused it only on an identical entry version.

OFAC's steps 1 and 2, 1.6 seconds. The comparison agent confirmed the hit was against the OFAC SDN List, entry 59341 version 1, under the illicit-drugs program, and that it was a listed name rather than a country or other target, with a name score of 96 on the full name.

Step 3, 1.0 second. It set the member and the entry side by side, one identifier per row, each value cited: name, a match; date of birth, June 14, 1988 against March 7, 1961, no match; nationality and place of birth, United States and Portland, Maine against Mexico and Culiacán, Sinaloa, no match; address and ID number, missing on the entry. One match, two conflicts, two missing.

Steps 4 to 6, 2.2 seconds. With two disqualifying conflicts there was no valid match, so no licence check, no block and no rejection; the member's account stayed as it was. The agent drafted a one-sentence verdict, "2 of 5 identifiers conflict; not the listed person", with confidence 0.97 and the reason codes FP-DOB and FP-NAT, and a rationale citing every value, to be kept 10 years.

QA sampler, 0.6 seconds. It prepared to draw the closure for blind re-review the moment a person made it. Then the agents stopped. The next morning the analyst opened the hit, checked the cited values, agreed and closed it at 10:41 AM. The sampler drew it, a random draw of 0.041 under the 0.10 rate, and the QA reviewer answered blind: not the listed person.

Sanctions Alert Review's agents on the hit, step by step, beside the comparison they built

How AI compares identifiers on a sanctions hit

AI compares identifiers the way OFAC asks a person to: field by field, against the full entry, and with an explicit result for each field. What makes it auditable is not the model but the output format. Each identifier gets a row; each value on each side gets a citation to where it came from; each row gets match, no match or missing; and the verdict counts them. The analyst checks the rows, not the model.

The rules around the comparison matter more than its accuracy. In the sample settings, the comparison agent never proposes a close on a name alone or with fewer than two conflicting identifiers, escalates whenever three or more identifiers match, and proposes a close only at 0.92 confidence or more. Bulk acceptance of proposals is allowed only at 0.95 with two conflicts, and every bulk closure still enters QA sampling. A missing identifier is never treated as a conflict, the mistake behind more than one enforcement case.

Is AI allowed for OFAC screening?

Yes. No OFAC regulation prescribes or forbids any screening technology, and OFAC's guidance is risk-based throughout: FAQ 5 asks organizations to follow their own procedures and decide each potential match on a risk basis, and OFAC endorses no product. What OFAC holds the organization to is the outcome and the record: no prohibited dealings, reports within 10 business days, and records that show how each potential match was investigated.

The Wolfsberg Group's principles for AI and machine learning in financial crime compliance set the governance expectation in two parts. Accountability does not move with the model: a bank answers for every decision that leans on AI, whether it built the system or bought it. And the bank is expected to work out, before go-live, whether the system's results will be fair, effective and explainable, not to discover it afterwards (Wolfsberg Principles for Using AI and ML in Financial Crime Compliance, 2022).

Does SR 26-2 cover AI agents?

No. SR 26-2, the revised model risk management guidance the Federal Reserve, the OCC and the FDIC issued on April 17, 2026, places generative and agentic AI outside its scope and leaves their controls to each bank's own governance. It replaces SR 11-7 and SR 21-8, the 2021 statement on model risk for BSA/AML systems, and says it is most relevant to banking organizations with over $30 billion in total assets.

Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance. Nonetheless, a banking organization's risk management and governance practices should guide the determination of appropriate governance and controls for any tools, processes, or systems not covered in this document.

SR 26-2, Revised Guidance on Model Risk Management, April 17, 2026

For a sanctions team that is a responsibility, not a gap. Without a model-risk template to follow, the bank has to show its own controls on an agent: what it may do, what it may never do, how its prompts and models are versioned, how its proposals are checked, and how overrides are reviewed. The guidance still covers "traditional statistical and quantitative models and non-generative, non-agentic AI models", so a machine-learning alert scorer in the same program stays inside it.

Will examiners accept an AI rationale? What the trace must show

An examiner will accept a rationale they can check, whoever drafted it. The test is the one Wolfsberg sets for any screening application: it "must present all relevant data from the FI and the sanctions lists for decision making and allow reviewers to make a decision based on the validity of that data and, thereafter, record relevant rationale" (Wolfsberg Guidance on Sanctions Screening, 2019). An AI rationale that cites each value and the list version meets that test better than most typed reasons; one that says "low risk, model score 0.12" does not.

Who signs off when AI recommends a close?

The analyst signs off every close, and the AI's recommendation is one input to it. In the sample, the agent's reason codes are preselected and its rationale drafted, but the analyst must choose to close; changing the codes requires an override reason, OV-1 to OV-3, and puts the closure in the QA sample automatically. A potential match goes to the BSA/OFAC Officer, and a block or rejection needs the Deputy BSA Officer's approval before funds move; the officer who decided cannot approve.

The analyst closes: the agent's codes preselected, the rationale drafted and editable

Where this fits and where it does not: Sanctions Alert Review works after an existing screening service raises hits. It does not replace the filter, the payment interdiction or the list feed, and it does not decide matches. It suits a team whose minutes go to look-ups and whose reasons are hard to reproduce; it adds less where hit volumes are tiny and every hit already gets a full, documented review. A buyer comparing it with other approaches will find four approaches compared on one hard hit useful, and the way to trust it is a pilot on alerts you have already closed. To see the trace, start from Sanctions Alert Review.

Questions people ask

Will AI replace sanctions analysts?

Not in a program that follows OFAC's and FATF's guidance, both of which stress human review. AI takes the look-ups, the side-by-side comparison and the first draft of the rationale; the analyst still decides each close, a reviewer checks a sample blind, and officers decide matches. The freed time goes to the hits that need judgement.

Does AI reduce sanctions false positives?

In the Federal Reserve's test on synthetic organization names, language models cut false positives by 92% against the best fuzzy-matching baseline while finding 11% more true matches. That is a working-paper result on test data, not a bank's production figure, and the models were far slower, which is why the authors propose a cascade.

Is machine learning sanctions screening the same as AI agents?

No. Machine-learning screening usually means a model that scores or ranks alerts, and it falls within SR 26-2's model risk guidance. AI agents read, compare, draft and propose in steps, often using generative models, which SR 26-2 leaves to each bank's own governance and controls.

What should AI never do in sanctions screening?

Close, block, reject, release, file a report or change a screening setting on its own. The enforcement record shows the cost of automation that releases without review: Payoneer's filter let flagged payments go automatically during backlogs, and Bank of America's suppression rule released alerts on earlier decisions.

How fast is AI on a sanctions hit?

In the sample, the agents finished their work on one re-screen hit in 7.1 seconds, from intake to a drafted rationale. Our estimate for an analyst clearing a hit by hand is about three minutes; with the agents' work done first, the design target is under one. Language models are much slower than fuzzy matching, so they belong on the hits a filter raises, not on every transaction.