Sanctions screening analyst job description, hour by hour

A sanctions screening analyst job description usually says "review and disposition sanctions screening alerts". In practice the analyst clears every name-screening hit a bank or credit union raises against OFAC's lists, on customers, applicants and payments: opens the customer, opens the list entry, compares the identifiers, closes the false ones with a written reason and escalates the rest to the BSA/OFAC Officer. It is hard because most of the minutes go to looking things up in three or four systems, while a single wrong closure can let a listed person move money. Botminds' Sanctions Alert Review is an agentic solution built around that seat: agents set the customer and the list entry side by side with every value cited, and the analyst keeps the decision.

The day described here is a fictional sample: Jordan Ellery, an analyst at Norrell Federal Credit Union, on Thursday, October 22, 2026, as it runs through the solution. The research figures come from regulators and their enforcement records, linked where they appear.

What does a sanctions screening analyst do?

A sanctions screening analyst decides, hit by hit, whether the person or company the bank is dealing with is the person or company on a sanctions list. The screening software only says that two names look alike. The analyst establishes whether the identities are the same, using everything else the bank knows and everything else the list entry says: date and place of birth, nationality, address, identification numbers, entity type.

Three things follow from that definition. The analyst does not investigate behaviour, which is what an AML analyst does with transaction-monitoring alerts; the question is identity against a list, not whether activity is suspicious. The analyst does not usually decide what happens to the money, either: a likely match goes up, to the officer the bank has designated for OFAC compliance. And the analyst's written reason is part of the work product, because the bank keeps it and an examiner may read it. The FFIEC examination manual expects policies that say "how it will determine whether an initial OFAC hit is a valid match or a false hit" (FFIEC BSA/AML manual, OFAC section). The analyst is the person who applies that policy hundreds of times a day.

The day is three queues on one clock

An analyst's day is not one queue but three, each with its own deadline, and they peak at different hours. List re-screen hits arrive in a block after OFAC publishes an update and the bank re-screens its customers against it. Payment hits arrive through the business day and hold a customer's money while they wait. Onboarding hits hold an application.

In the sample data, an OFAC update published at 4:47 PM on Wednesday, October 21 carried 22 changed entries: 14 additions, 6 amendments and 2 removals. By 5:41 PM the solution had re-screened 538,200 member and party records against the changed entries and raised 268 hits. Jordan's Thursday therefore opened with 268 re-screen hits already waiting, before the first of the day's 83 payment hits and 61 onboarding hits arrived. By mid-morning, 297 of the 412 were closed and 115 were open.

The order of work is set by the clocks, not by arrival. A held wire with a 30-minute service level jumps a re-screen hit with two business days left, which is why analysts describe the job as constant re-sorting. A screen that shows every open hit with its own clock, as below, takes that sorting out of the analyst's head.

The queue an analyst works from in Sanctions Alert Review: every open hit with its verdict and clock

Where an analyst's three minutes on a hit go

Most of an analyst's minutes go to finding information, not to judging it. Our estimate for the sample credit union is about three minutes per hit by hand, or roughly 160 hits in an eight-hour day, and only about a quarter of that is the comparison itself. The rest is opening systems, finding the list entry and the version that raised the hit, checking for earlier closures and typing the reason.

The second lane is not an argument for fewer analysts on its own. The hours it frees are the hours a bank needs for the hits that deserve them: the 3 of 5 match, the entry with a second date of birth, the company whose owner was designated yesterday. In the sample, those hits stay with a person by rule: the Comparison agent never proposes a close on a name alone, escalates whenever three or more identifiers match, and never closes anything itself.

The comparison that takes the analyst's judgement: one identifier per row, each value cited

What skills does a sanctions screening analyst need?

The core skill is disciplined comparison: reading a list entry completely and knowing which identifiers can disqualify a match and which cannot. A shared surname disqualifies nothing; a date of birth 27 years apart usually does; a missing identifier on the entry proves nothing either way. The rest of the skill set supports that judgement under time pressure.

Interviewers test these skills with scenarios rather than definitions. Common questions in sanctions screening interviews are variants of: a name matches exactly but the date of birth is missing from your file, what do you do; the entry lists two dates of birth and your customer matches one; a wire's beneficiary bank is not listed but its owner is; the customer asks why the wire is late. A good answer names the identifier, the source checked and the person it goes to next. For the full method behind those answers, see what to do with an OFAC hit, in OFAC's own six steps.

Who does a sanctions analyst escalate to, and can they block a payment?

A sanctions analyst escalates to the officer the bank has made responsible for OFAC compliance, and in most programs the analyst cannot block a payment alone. The FFIEC manual expects every bank's program to name the person or people who answer for OFAC compliance (FFIEC); what that officer signs, and attests to, is set out in OFAC compliance officer. Blocking is that officer's decision, often with a second signature, because a block freezes property and starts a report to OFAC within 10 business days.

Escalation rules are written down, and the cases show what happens when analysts do not follow them. In TD Bank's 2021 settlement, the bank's own procedures "require alerts to be escalated if a match occurs in first and last name and any additional information field", and analysts dismissed alerts that met that test, more than once, over four years (OFAC, TD Bank, N.A., December 23, 2021). At American Express, an operations analyst closed a "high confidence" alert on a name, date of birth and national ID match despite "an internal procedural requirement for a second-level review for all high-confidence alerts" (OFAC, American Express National Bank, July 15, 2022).

The Wolfsberg Group, whose guidance is a standard reference for screening programs, defines a four-eye review as one where "a decision/transaction must be approved by at least two people (Maker and Checker)" (Wolfsberg, 2019). In the sample, the analyst is the maker on every closure and the QA reviewer is the checker on a sample; on a block, the officer is the maker and the deputy the checker.

Where the job breaks: backlogs, skipped second reviews, closures nobody can explain

The analyst's job breaks at volume. When designations come in waves, the queue grows faster than people can clear it, and the cases show what happens next. OFSI's 2026 penalty against Citibank's London branch described the months after Russia's 2022 invasion of Ukraine this way:

…a backlog quickly emerged in the alert handling queues at the third level review stage due to large volumes of potential sanctions matches which required manual checking to resolve, resulting in some alerts remaining unadjudicated for several weeks.

OFSI, penalty notice to Citibank N.A. London Branch, 2026

OFSI imposed a penalty of £4,732,830.58 on the branch, which had processed 242 payments worth about £5.9 million for companies owned or controlled by one designated individual (OFSI, CBNA London). The same pattern appears in the United States: OFAC's October 2026 settlement with Bank of America records a blocked business account the bank did not identify until "14 months after the individual was designated": an alert had been dismissed in error, and a re-screening exercise then generated more alerts than the bank was prepared for (OFAC, Bank of America, N.A., October 13, 2026).

The lesson for a job description is that throughput is a control, not a productivity metric. A team that can clear 160 hits each per day is safe until the day a list update raises 2,000. Freeing the look-up minutes is what gives a team spare capacity for that day. The other failure, a closure nobody can reproduce, is a writing problem: a reason that says "not a match" cannot be checked, which is why testing alert review, not just the filter, starts with the reasons analysts write.

Sanctions analyst salary, and what the title hides

There is no official salary figure for sanctions analysts, because the Bureau of Labor Statistics does not count them separately. They sit inside SOC 13-1041, Compliance Officers: 417,070 people in May 2025, with a mean annual wage of $88,400 and a median of $80,730. In credit intermediation, the industry group that holds banks and credit unions, 19,850 compliance officers earned a mean of $94,090 (BLS OEWS, 13-1041).

Those figures cover every kind of compliance officer, from entry-level reviewers to program heads, so they overstate a first-year analyst and understate a sanctions officer at a large bank. What they do give a hiring manager is the cost of a minute: at $94,090 a year and roughly 2,080 paid hours, the wage alone is about 75 cents a minute before benefits and overhead. A hit cleared in three minutes costs a few dollars in salary; the guide on what clearing a false positive costs works the full arithmetic.

The title also hides a career ladder. The same seat leads to QA reviewer, then to the officer who decides potential matches, then to tuning and testing the screening itself. Each step uses the analyst's core skill, reading a list entry against a customer, on a harder question.

A job description that matches the work

A sanctions screening analyst job description that matches the work names the queues, the clocks, the identifiers and the escalation rule, and says which decisions belong to whom. It also says what the analyst is measured on. Speed matters, but the measures that protect the bank are a QA agreement rate, the time a potential match takes to reach the officer, and the share of closures with a reason a second person can reproduce.

In the sample month, 41 potential matches reached the OFAC Officer, all within the hour, with a median of 22 minutes, and at least 10% of every analyst's closures were re-reviewed blind, 25% in an analyst's first 90 days. Those are the sample credit union's settings and results on fictional data, not a benchmark. They show the shape a job description can take once look-ups are no longer the job: the analyst is measured on judgement, and the judgement is checked. To see the seat in the product, start from Sanctions Alert Review.

Questions people ask

How many alerts does a sanctions analyst clear a day?

It depends on the alert and the tools. Our estimate for a credit union analyst working by hand is about three minutes a hit, or roughly 160 hits in an eight-hour day, with a held payment or a close match taking much longer. There is no regulatory standard; OFSI's Citibank notice shows that volume beyond capacity leaves alerts unadjudicated for weeks.

What is the difference between a sanctions analyst and an AML analyst?

A sanctions analyst decides whether a customer, counterparty or bank is the person or entity on a sanctions list, a question of identity. An AML analyst reviews transaction-monitoring alerts to decide whether activity is suspicious and may support a suspicious activity report, a question of behaviour. The work overlaps when a sanctions hit is referred to the BSA team.

Can a sanctions analyst block a payment?

Usually not alone. Most programs give the block decision to the officer responsible for OFAC compliance, often with a second approver, because blocking freezes property and starts a report to OFAC due within 10 business days under 31 CFR 501.603. The analyst holds and escalates.

What do sanctions screening interview questions test?

Mostly scenarios: an exact name with no date of birth on file, an entry with two dates of birth, a payment whose bank is owned by a listed person, a customer asking why a wire is late. Interviewers listen for the identifier compared, the source checked, the person escalated to, and a refusal to tell the customer anything about the screening.

Is sanctions screening analyst a good entry-level job?

It is a common entry point into financial crime compliance because the core skill, comparing identifiers against a list entry, can be taught and checked. BLS counts the role within compliance officers, whose mean wage in credit intermediation was $94,090 in May 2025, though entry-level pay sits well below that average.