OFAC sanctions list updates arrive several times a week: in the two weeks from October 8 to October 21, 2026, OFAC posted Sanctions List Updates on seven separate days, for new designations and for removals. Each update starts a clock that no regulation sets in hours. The FFIEC manual asks banks to check existing customers when the list changes, at a frequency based on risk; the enforcement cases show what the frequency costs when it is too slow, from a vendor that re-screened monthly to an alert that waited eight days for review. The work is hard because an update touches every customer at once and lands on a team already working the day's payments. Botminds' Sanctions Alert Review loads each OFAC update the day it is published, re-screens against the changed entries and tells the analyst which change caused each hit.
The timed update on this page is a fictional sample, Norrell Federal Credit Union, as it runs through the solution. OFAC's publication record and the cases are quoted from the agencies' own pages.
The pace of OFAC list updates, and what slow ones cost
7days
with OFAC Sanctions List Updates in the two weeks October 8–21, 2026
98%
of the value MidFirst processed for two new SDNs moved within six hours of designation
14days
before MidFirst's monthly vendor re-screen found the two customers
8days
before Vanquis Bank restricted a designated customer's account
How often is the OFAC sanctions list updated?
OFAC updates its sanctions lists whenever it designates, removes or amends a listing, which in practice means several times a week and sometimes on consecutive days. There is no fixed schedule. In the two weeks before this page was written, OFAC's Recent Actions page carried Sanctions List Updates for counter-narcotics and counter-terrorism designations, Iran-related designations, a Venezuela-related removal, intellectual-property designations and others, on October 8, 9, 13, 14, 15, 19 and 21, 2026 (OFAC Recent Actions).
An update is not only additions. Removals mean a customer who was blocked may now be dealt with; amendments add dates of birth, aliases, addresses and identification numbers to existing entries. An amendment can turn yesterday's false positive into today's potential match, which is why an update should re-screen against changed entries as well as new ones. The SDN List itself held 19,471 primary entries on October 26, 2026, by our count from OFAC's published file: 10,042 entities, 7,519 individuals, 1,568 vessels and 342 aircraft.
How fast must a bank screen after a new designation?
No U.S. rule sets a number of hours. The FFIEC examination manual expects banks to have "policies, procedures, and processes in place to check existing customers when there are additions or changes to the OFAC list", with a frequency "based on the bank's OFAC risk", and gives an example for low-risk banks: "periodically (e.g., weekly, monthly or quarterly) compare the customer base against the OFAC list" (FFIEC BSA/AML manual, OFAC section). The same section expects funds transfers to be checked "prior to being executed".
What sets the real clock is liability. Prohibitions apply from the moment of designation: in OFAC's words, "Upon designation, any property in which an SDN has an interest of any nature whatsoever, direct or indirect, becomes effectively radioactive" (OFAC, Pegasus Worldwide Logistics, October 9, 2026). The FFIEC manual adds that OFAC treats "the continued operation of an account or the processing of transactions post-designation" as a factor in deciding its enforcement response. A low-risk bank may be permitted a monthly cycle, but it carries the exposure for every day in between. The cases below show how quickly that exposure is used.
From designation to restriction: four cases where the list or the review ran days late
- May 24 to June 28, 2023: file stale35 d
- Designation to vendor report14 d
- Designation to account restricted8 d
- February 7 to 12, 20255 d
The first afternoon: where MidFirst's money went
The MidFirst case shows why a monthly cycle is longer than it sounds: most of the money moves in the first hours. OFAC designated two individuals under the weapons-proliferation program at 12:36 p.m. EDT on September 21, 2020. Between 2:00 p.m. and 5:48 p.m. that same day, MidFirst processed five transactions totaling $604,000 for their accounts. Over the next two weeks it processed 29 more, totaling $9,879.02. In OFAC's words: "Ninety-eight percent of the value of the post-designation transactions occurred within six hours of designation" (OFAC, MidFirst Bank, July 21, 2022).
Most of the money moved before the first evening
Why monthly? Because of a contract nobody read closely. The vendor screened new customers and changed customer records daily, "the vendor only screened MidFirst's entire existing customer base once a month", and "MidFirst misunderstood the scope of the contract with its vendor", believing the daily run covered everyone. The fix was a manual process to be told of every list update and "to manually rescreen the entire customer base whenever there are updates to the SDN List". A same-day re-screen would not have stopped the first afternoon's transactions either; it would have stopped the next two weeks'. Only payment screening against the updated list stops the first afternoon.
Do you have to rescreen every customer when OFAC adds names?
You have to check existing customers against every addition or change, but you do not have to re-screen every customer against the whole list each time. The FFIEC wording is to check existing customers "when there are additions or changes to the OFAC list". Screening the full customer base against only the changed entries meets that test and is far lighter than a full re-run, as long as amendments are included, not just additions.
Frequency is a risk decision, and supervisors read it against the bank's size. The FCA's 2024 final notice to Starling Bank found it "was screening its customers against the Consolidated List only once every 14 days", a period it called "a leftover metric from when Starling was a smaller institution", and recorded that the bank moved to daily screening (FCA, Starling Bank Limited, 2024). OFAC's own closing note in MidFirst makes the same point from the other side: the frequency of screening existing customers "should be based on the financial institution's assessment of its unique sanctions risk."
What happens when the vendor's list is late
The bank is liable, not the vendor. The FFIEC manual leaves no room on this: a bank that hands its OFAC checks to a service provider still answers for whatever that provider gets wrong (FFIEC BSA/AML manual, OFAC section), and OFAC repeated it in October 2026: "Each organization remains responsible for its own compliance regardless of whether it relies upon third-party providers" (OFAC, Bank of America).
Bank of America's case shows the two ways a list goes stale. From May 24 to June 28, 2023, "due to human error by a third-party vendor", the watchlist file the bank screened against was not updated, and it processed six transactions totaling $100,828 for newly designated entities. The bank did not find the error until July 2023, about a month after another U.S. bank blocked one of those payments downstream. Then on February 7, 2025, the bank's own systems failed to load the previous day's designations; it processed 26 transactions totaling $146,543 for a designated ship-management company that day, and "fully activated the relevant updates on February 12, 2025, almost a week later."
Both failures were silent: nothing in the screening told anyone the list was old. The control that catches them is a reconciliation, not a re-screen: compare the list version in use with the one OFAC published, every day an update appears, and alarm when they differ.
From publication to re-screen: one OFAC update timed, minute by minute
In the sample data, an OFAC update published at 4:47 PM on Wednesday, October 21, carried 22 changed entries: 14 additions, 6 amendments and 2 removals. The solution's list watch agent loaded it at 5:02 PM, recorded every entry's version, and re-screened 538,200 member and party records against the changed entries by 5:41 PM. The run raised 268 hits, 189 from additions and 79 from amendments, each labelled with the change that caused it; the new entry for CASTILLO, Maria Elena caused 3.
One OFAC update through Sanctions Alert Review: 54 minutes from publication to re-screened
- OFAC publishes, 4:47 PM, to loaded, 5:02 PM15 min
- Re-screen of 538,200 records against 22 changed entries, to 5:41 PM39 min
An OFAC update in Sanctions Alert Review: what changed, and which hits each change caused
Speed of the re-screen is the smaller half of the clock. A 268-hit block that lands at 5:41 PM still has to be cleared, by people, before the next morning's payments start. That is where the second half of the clock runs, and where the UK's recent case broke. The amendment behind Samir Haddad's hit is also where old closures expire, which is covered in false-positive procedures when the entry has changed.
The days after the hit: queues, staffing and the eight-day alert
A re-screen that raises a hit on time does not restrict an account; a person does, and only when someone reviews it. Vanquis Bank's case is the clearest record of that gap. On the day of designation, OFSI updated its Consolidated List and sent an e-Alert to subscribers. The next morning, at about 08:30, the bank's screening system raised a potential match and "placed it into a queue for prioritisation". At 09:43 the designated person withdrew £200 in cash (OFSI, Vanquis Bank Limited, September 8, 2025).
The bank's service level for that review was one day. It missed it because staff had been moved to a remediation exercise, and "the alert was not reviewed by VBL's first line referral team until eight days after the designation." OFSI had even warned the bank the day before that a suspected customer would be designated. Its lesson for industry was operational, not technical: firms "should carefully consider whether they have adequate operational resilience in their sanctions screening processes".
The design answer is to give list re-screen hits their own clock and their own lane, visible against payments and onboarding, so a block of a few hundred hits cannot sit unseen behind the day's wires. In the sample, every hit carries its service level, analysts are warned at 80% of it and the officer at 100%, and any potential match goes to the officer within the hour. How that changes the analyst's day is covered in the sanctions screening analyst's day, hour by hour.
Every open hit in Sanctions Alert Review with its source and its own clock
Controls for OFAC list updates, from publication to restriction
- Subscribe to OFAC's notices
OFAC offers e-mail notifications of list changes and of Recent Actions; someone should own them on every business day.
- Reconcile the list version daily
Compare the version your screening uses with OFAC's latest publication, and alarm on a gap, so a stale vendor file is caught the same day.
- Re-screen against amendments, not only additions
A new date of birth or alias on an old entry can make an earlier false positive a match.
- Re-screen the whole customer base against the changed entries
Daily new-customer screening is not the same thing, as MidFirst learned from its own contract.
- Screen payments against the updated list at once
MidFirst's case shows most value can move within hours of a designation.
- Give re-screen hits their own clock and owner
Report how many are open and how old they are, every morning.
- Plan for the spike
A large designation round or a platform change can multiply hits overnight; know who reviews them and in what order.
- Keep the version each hit was raised against
So every decision can be read against the list as it stood, and expired when the entry changes.
How to get OFAC update alerts and delta files
OFAC publishes its lists, its changes and its notices in several forms, and a bank should take the machine-readable ones. The Sanctions List Service offers the SDN and non-SDN consolidated lists for download, a tool to build a custom dataset by list or program, archived published delta files by year, an archive of changes to the SDN list, and sign-up for OFAC e-mail notifications. The Recent Actions page offers its own e-mail updates.
OFAC's free Sanctions List Search is for people, not for systems. Its FAQ 287 rules out systems that query the tool over and over on a schedule, and points automated users to the XML, CSV and other files instead (OFAC FAQs on Sanctions List Search; the files and how they feed a bank's systems are covered in OFAC sanctions search API). A screening program built on the files, with the version of each kept, can answer the question an examiner asks after every designation: which list were you screening against, and since when? To see an update run through the product, start from Sanctions Alert Review.
Questions people ask
Does OFAC publish delta files?
Yes. The Sanctions List Service includes archived published delta files by year and an archive of changes to the SDN list, alongside full downloads of the SDN and non-SDN consolidated lists. Delta files let a bank re-screen against exactly what changed, including amendments.
How often should existing customers be screened against OFAC?
As often as the list changes, scaled to risk. The FFIEC manual expects a check of existing customers when the list changes and allows lower-risk banks periodic comparisons, giving weekly, monthly or quarterly as examples. The FCA described Starling Bank's 14-day cycle as out of step with similar institutions, and Starling moved to daily screening.
Are removals from the SDN list part of an update?
Yes. A removal changes what a bank may do with a customer or property, and OFAC lists removals among its Sanctions List Updates, such as a Venezuela-related removal on October 14, 2026. Property that becomes unblocked has its own report: 31 CFR 501.603 requires one within 10 business days of the date it is unblocked or transferred.
How do UK and EU sanctions list updates compare?
The UK's OFSI publishes its own Consolidated List and sends e-Alerts to subscribers when it designates someone, as its Vanquis notice records. A bank screening against several regimes needs the same version control for each list, because each changes on its own schedule.
What if a designated customer moves money before we re-screen?
Every transaction after designation is a potential violation, so block the property as soon as it is found and report it to OFAC within 10 business days. OFAC weighs post-designation activity and the adequacy of the program in its response, and in MidFirst's case it issued a Finding of Violation rather than a penalty.