OFAC hit: what to do, in OFAC's own six steps (updated Sept 2026)

When you get an OFAC hit, do not release, block or tell the customer anything yet: follow OFAC's six steps. Confirm which list the hit is against, decide whether it is a listed name or another kind of sanctions target, compare every detail in the full list entry with what you know about your customer, then check licences, decide between blocking and rejecting, and report and keep records. OFAC set those steps out in its FAQ 5, updated on September 9, 2026, and it will not confirm a match for you. The hard part is step 3, where most hits are cleared and where the costliest mistakes are made. Botminds' Sanctions Alert Review exists for that step: agents set the customer and the full list entry side by side, cite every value, and leave the decision to a person.

The worked examples come from a fictional sample, Norrell Federal Credit Union, as its hits run through the solution. OFAC's text and the enforcement cases are quoted from OFAC's own pages, linked where they appear.

What to do when you get an OFAC hit

An OFAC hit means screening software found a name close enough to an entry on a sanctions list that a person has to look. It is not a finding. OFAC's own procedure starts by asking organizations to "follow their own sanctions compliance policies and procedures for investigating potential matches" and then recommends six steps (OFAC FAQ 5). The steps are sequential: each answers one question and either closes the hit or sends it to the next.

Three things should happen before step 1. Hold whatever the hit is attached to, a wire, an application or an account change, under your policy's rule for that channel. Note the time, because a payment hit has hours, not days. And say nothing to the customer: at the sample credit union, a held wire reads "Could not be sent" in online banking and an application reads "Routine review", and neither names a list, a hit or a decision.

Steps 1 and 2: which list, and which kind of target?

Step 1 asks whether the hit is against an OFAC list at all. Screening tools often load other lists too: OFAC's text names the Commerce Department's Entity List, the FBI's Most Wanted List and the State Department's Debarred Parties List, as well as vendor and internal lists. If the hit is against another agency's list, OFAC says to "contact the relevant agency that maintains the list"; it gives no guidance on those.

Step 2 sorts OFAC hits into a listed name, which goes to step 3, and every other nexus: a sanctioned jurisdiction, a sanctioned government, or a company that appears on no list but is blocked by law all the same, such as one owned 50% or more by blocked persons (how to trace those is set out in sanctions ownership research). For those, OFAC advises escalating to a supervisor or compliance "before taking action because OFAC regulations may prohibit the transaction or require blocking" (FAQ 5, step 2).

Skipping step 2 is a known failure. In 2023 American Life Insurance Company's screening of a prospective customer licensed in Dubai raised alerts, and the company closed them as false positives for one reason: the entity's own name was not on the SDN List. The entity's trade licence, in Arabic, named the Iranian embassy as its owner (OFAC, American Life Insurance Company, November 14, 2024). A hit that does not match a listed name can still be a sanctions hit.

Step 3: how to clear an OFAC hit by comparing the full entry

You clear an OFAC hit by comparing every detail in the complete list entry with what you know about your customer and the transaction, and closing only when the details reasonably show it is a different person or entity. OFAC's step 3 is explicit that the name is where the work starts, not where it ends: "compare all of the details in the OFAC listing with the information available to you about the data in your transaction or activity that led to the 'alert' or 'hit.'" It lists the fields an entry can carry: full names, former names, aliases, nationalities, passport, tax and national ID numbers, place and date of birth, business registration numbers and addresses.

The questions OFAC poses are the ones a reviewer should answer in writing: "does only the first or last name match the listed name or aliases? Does the party to your transaction or activity have a different date of birth, identification number, or nationality? Is the listed address distinct from the address of the party to your transaction or activity?" If, after that review, "you can reasonably determine the match is not valid, then you may proceed with the transaction or activity" (FAQ 5, step 3).

Take the sample hit Norrell's analyst opened on Thursday morning: member Maria Elena Castillo against SDN entry 59341, CASTILLO, Maria Elena, added the evening before under the illicit-drugs program. The full name matched at a score of 96. The date of birth did not: June 14, 1988 against March 7, 1961. Nationality and place of birth did not: United States, born in Portland, Maine, against Mexico, born in Culiacán, Sinaloa. The entry lists no address and no ID number, so those two rows could prove nothing. Two identifiers in conflict, documented, are a reasoned disqualification; the analyst closed it as a false positive with the reasons cited.

Step 3 in Sanctions Alert Review starts from the complete entry, in the version that raised the hit

What makes an OFAC match valid?

A match is likely valid when more than the name agrees and nothing you have found disqualifies it. FAQ 5 gives the threshold for moving on from step 3: "if multiple pieces of information in OFAC's listing match the person involved in your transaction or activity (e.g., name and date of birth for individuals or organization name and location for entities), proceed to Step 4." Step 4 then describes the likely match: "an exact match, or a close match with multiple similarities (e.g., a full name, date of birth, and country location matching, but different city locations)".

The rule cuts both ways, and the second direction is where banks are penalized. In TD Bank's case, a customer's first name, last name and date of birth matched an SDN entry. The bank's records showed "Esperanza Maradiaga Lopez"; the entry read "Esperanza Caridad Maradiaga Lopez". The reviewer dismissed the alert because there was:

“no match on full name DOB and geographical location.”

OFAC, settlement with TD Bank, N.A., December 23, 2021

Four more high-confidence alerts followed over four years, and three were dismissed for similar reasons. Only the fifth, in February 2020, was confirmed as a true hit, "triggering the blocking of Lopez's accounts four years late" (OFAC, TD Bank). A missing middle name is not a conflict; it is an identifier your system did not capture. The reviewer treated an absence of evidence as evidence of difference, which is the single most common way step 3 goes wrong. How the screening score itself fits into this judgement is covered in what a sanctions screening threshold can and cannot say.

Does OFAC confirm whether a match is real?

No. FAQ 5 ends: "Please note that OFAC does not confirm potential matches or false positives to our sanctions lists and instead encourages organizations to make risk-based determinations consistent with the guidance above." The decision, and the record of it, are the organization's.

You can still call, but for a different purpose than older procedures assume. FAQ 5 says "You may contact the OFAC Compliance Hotline for questions related to this guidance", which means questions about how to apply it, not a verdict on a name. The older invitation has gone: FAQ 48, which told a bank with a reasonably close match to contact OFAC and advised against blocking without discussing it first, no longer appears among OFAC's published FAQs. What OFAC asks instead, in FAQ 42 as rewritten on October 26, 2026, is that the bank verify the party really is the listed person before acting, asking for more identifying information where the name is similar but the rest does not match (OFAC FAQ 42; how that check feeds the block-or-reject decision is in OFAC block vs reject). A procedure that still says "call OFAC to confirm the hit" needs rewriting; the call, if any, comes after steps 1 to 3 are written up.

Steps 4 and 5: licences, then block or reject

Once a match looks valid, step 4 asks whether anything authorizes the transaction anyway: a general licence, a specific licence held by the customer, or a statutory exemption. If one applies, the organization "may process the transaction or proceed with the activity consistent with your organization's risk tolerance and internal policies". If none applies, step 5 decides between blocking and rejecting, and OFAC's chart sets the default for each situation.

In the sample, the decision is the BSA/OFAC Officer's, never the analyst's or an agent's. On Thursday morning a held $48,250.00 wire from a member business to Kestrel Bay Trading FZE in the Jebel Ali Free Zone matched an entry under the weapons-proliferation program on all five identifiers: name, registration number, country, address and entity type. The officer decided true match, block. Nothing moved until the Deputy BSA Officer approved; then the funds went to a blocked account and the drafted report went to OFAC reporting with its due date.

Step 5 and step 6 on one screen: the block, the second approval and the report clock

Step 6: what records to keep after an OFAC hit

Keep a record of every hit you clear, not only the ones you block. Step 6 asks organizations to "keep complete, accurate records detailing the steps taken to investigate the potential match and the information relied upon to ultimately determine whether the potential match was valid", and notes that OFAC may request them under 31 CFR 501.602 (FAQ 5, step 6).

The deadlines are set in regulation. A report of blocked property is due 10 business days after the day the property is blocked (31 CFR 501.603), and a report of a rejected transaction 10 business days after the rejection (31 CFR 501.604); where that count starts in practice is the subject of OFAC reporting in 10 business days. Transaction records must stay available to examiners for 10 years after the transaction (31 CFR 501.601), up from five since March 2025.

Where the six steps fail in practice

The six steps fail less often because people disagree with them than because the evidence for each step is scattered. An analyst who has to open the customer in one system, the wire in another and the list entry in a third will compare fewer identifiers, under time pressure, than the procedure asks. The TD reviewer compared three identifiers and stopped. The ALICO reviewer stopped at step 2.

The other failure is reuse. A hit that looks like one cleared last month is tempting to close on the old reason, and that is safe only if nothing has changed on either side. False-positive procedures when the list entry has changed works through that test. And the record in step 6 is only as good as what it captured: a closure that cites the entry version and every value compared can be re-checked; a closure that says "different DOB" cannot. To see the steps laid out on one screen, start from Sanctions Alert Review.

Questions people ask

When should I call OFAC about a hit?

Only with a question about OFAC's guidance, and only after your own review: FAQ 5 directs such questions to the Compliance Hotline, but OFAC will not confirm whether a match is real. The FAQ that once invited a call before blocking a near match, FAQ 48, is no longer published; FAQ 42 now asks the bank to verify the party itself before it blocks.

What is a weak alias?

A weak alias is a broad or generic alias, often short, that OFAC marks as weak because it produces many false hits. FAQ 5 says your screening tool "may exclude these aliases as part of a risk-based decision". A weak alias can still help confirm a match raised by other identifiers.

Do I block or reject after a true match?

Block if a blocked person has an interest in the property, for example an SDN or an entity owned 50% or more by blocked persons. Reject if the transaction is prohibited, for example because it involves a sanctioned jurisdiction, but no blocked person is involved. Both are reported to OFAC within 10 business days.

What if my customer matches the name and date of birth but our file has no middle name?

Treat it as a likely match and escalate. FAQ 5 names "name and date of birth for individuals" as enough to move to step 4, and in TD Bank's case a missing middle name was the reason a true match was dismissed four times over four years.

Can I proceed with the transaction after clearing a false positive?

Yes. FAQ 5 says that if "you can reasonably determine the match is not valid, then you may proceed with the transaction or activity". Keep the record of the steps and the information you relied on.