A useful sanctions screening software comparison does not start from feature lists; it starts from one hard hit and asks what each approach returns, what it leaves in the record, and where it fails. OFAC endorses no product and says the packages "vary considerably in cost and capabilities", and the Wolfsberg Group says no approach to screening technology is clearly better or worse. The four approaches most banks and credit unions choose between are manual search on OFAC's free tool, a fuzzy-matching filter, a machine-learning scorer layered on the filter, and agents that compare the full list entry with the customer and cite every value. They are not substitutes: the last three sit at different points after the list, and most programs combine two. Botminds' Sanctions Alert Review is the fourth kind: it works on the hits an existing screening service raises, and leaves every decision to a person.
The hit compared on this page is from a fictional sample, Norrell Federal Credit Union. The guidance and research are quoted from OFAC, the FFIEC, the Wolfsberg Group, a Federal Reserve working paper and a peer-reviewed study.
Three points to start a sanctions screening software comparison
None
screening products endorsed by OFAC; it suggests asking peer banks what they use
Free
OFAC's own Sanctions List Search, built for people, not for automated systems
80%
fewer false positives from small language models than the best fuzzy baseline, on test data
What a sanctions screening software comparison should measure
A sanctions screening software comparison should measure four things on the bank's own hits: whether the true matches are caught, how many minutes a false hit costs to clear, whether the decision can be reproduced from the record, and whether the system still works the day after a list update or a platform change. Detection is what the vendor demonstrates; the other three are what the bank lives with.
The Wolfsberg Group's 2019 guidance warns against expecting a single answer: "There is no clearly defined approach to technology or configuration that is better or worse, and each will have its own strengths and limitations. Understanding those strengths and limitations is critical." It also reminds buyers that the product is rarely one product: "What is often thought of as a simple name-matching process can be a complex set of processes in which data is transferred from several, often disparate, technology systems and sanctions lists" (Wolfsberg Guidance on Sanctions Screening, 2019). A comparison has to cover the joins, not just the matcher.
Does OFAC recommend any sanctions screening software?
No. Asked "Do I have to buy expensive software?", OFAC answers that "This is primarily a question for your regulator", that "There are numerous interdiction software packages that are commercially available. They vary considerably in cost and capabilities", and that its sanctions lists can be scanned manually or searched with its "free, online search engine" (OFAC FAQ 27). Its advice on choosing is practical rather than prescriptive: "One suggestion for finding the right software for your bank is to research what your peer banks are using and determine if the software package is working for them" (OFAC FAQ 31).
FAQ 31 also draws the distinction a buyer most often blurs: some packages stop wire transfers that touch a sanctioned country or a listed name, while others check new customers or rescreen every account holder, two jobs that name screening and transaction screening separate in detail. Payment interdiction, customer screening and alert review are three jobs. A comparison that scores one product on all three usually scores it on the one it was built for.
One hard hit, four approaches
The test hit is the hardest kind: a match that was a false positive last month and is not today. A sample credit union member, Samir Haddad, born March 3, 1984 in Beirut, was cleared on September 3 against SDN entry 48807 because version 2 of the entry listed no date of birth. On October 21 OFAC amended the entry to version 3, adding the birth year 1984, the place of birth Beirut and an alias. The name, the birth year and the place of birth now all agree. Here is what each approach does with the hit raised that evening.
The same amended-entry hit through four approaches
| Approach | What it returns on this hit | What the record shows afterwards | Where it fails |
|---|---|---|---|
| Manual search on OFAC's Sanctions List Search | A name score against the entry as it reads today, version 3, if the analyst thinks to search again | Whatever the analyst types; the tool keeps no history, so version 2 cannot be seen there | Depends on someone noticing the amendment; does not scale; not for automated use |
| Fuzzy-matching filter | A hit with a name score; possibly suppressed if a rule matches September's closure on the same criteria | The alert, the score and a free-text closure note | Suppression across a changed entry; no view of which identifiers agree |
| Machine-learning scorer on the filter | A priority or risk score for the alert, from features of the name and the customer | The score and the model version; reasons only as good as its explanations | A score is not a comparison; an exact name and date-of-birth match ranked low has been penalized |
| Agents that compare identifiers and cite | Entry version 2 against 3 detected; 3 of 5 identifiers match; the old reason struck; escalated as a potential match | Each value with its source and the entry version, the steps taken, who decided | Works after a filter, not instead of one; needs the core and list feeds connected |
The screening filter raised the hit on the name; the approaches differ in what happens next. The manual tool shows only the current entry, because OFAC's search shows each entry only in its latest form (FAQ 467), so the analyst cannot see that the entry has changed unless the bank kept the old version. The filter's risk is a rule that treats the hit as a repeat. The scorer's risk is a ranking that buries it. The agents' advantage is not intelligence but bookkeeping: they kept version 2, noticed version 3, and put the difference in front of a person. How the earlier closure should have been treated is the subject of false-positive procedures when the entry has changed.
Where the hard hit ends up: on the OFAC Officer's desk, with its comparison and its clock
Can small banks screen for OFAC manually?
Yes, if their OFAC risk and volumes are low. The FFIEC examination manual lets a bank with low OFAC risk and few transactions screen by hand (the case a credit union with one compliance officer usually faces), and OFAC's FAQ 27 notes that its lists "can be manually scanned" and searched with its free tool (FFIEC BSA/AML manual, OFAC section). The same manual explains what manual screening gives up: "The SDN list attempts to provide name derivations; however, the list may not include all derivations. More sophisticated interdiction software may be able to catch variations of an SDN's name not included on the SDN list."
Manual screening also has a limit on scale that OFAC sets itself. Its FAQ 287 describes Sanctions List Search as a tool for a person looking up a name, not for automated systems; machine users should take the downloadable files (OFAC FAQs on Sanctions List Search). And it changes: when OFAC added an algorithm in 2021, FAQ 892 advised that "best practice dictates each user performs baseline checks to see how updates/changes to the tool may affect search results." A manual program needs its own test of the tool it relies on.
Fuzzy matching vs machine learning vs LLMs: what the research found
The public research says three things. Fuzzy matching trades false positives against misses as the threshold moves. Adding natural-language processing to a fuzzy matcher can find more true matches but also more false ones. And language models, in a Federal Reserve test, cut false positives sharply while finding more matches, at a large cost in speed.
What the studies found, approach by approach
What the evidence shows: Four widely used methods (Levenshtein, Jaro-Winkler, token sort, token set) show the classic precision-recall trade-off as the threshold rises (FEDS 2025-092).
What it means for a buyer: The threshold, not the brand, decides most of what a filter catches. Ask how it is set and tested.
What the evidence shows: "NLP significantly improves sensitivity by detecting more true positives, it also increases false positives, resulting in a trade-off between improved detection and reduced overall accuracy" (Kim and Yang, 2024).
What it means for a buyer: More detection can mean more work. Ask for results on both sides, at your threshold.
What the evidence shows: "The SLMs performed similarly well, reducing false positives by 80 percent and increasing screening matches by the same amount as the LLMs" (FEDS 2025-092).
What it means for a buyer: Smaller models may suit real-time volumes; test them on your names, not organization names alone.
What the evidence shows: 92% fewer false positives and 11% more matches than the best fuzzy baseline; over four orders of magnitude slower (FEDS 2025-092).
What it means for a buyer: Use them on the hits a filter raises, or in a cascade, not on every transaction.
The limits of the evidence matter as much as the findings. The Federal Reserve paper tested organization names only, generated with a language model from OFAC's list, in a series the Board describes as preliminary materials circulated for discussion. The Frontiers study used a 500-entry mock dataset. Neither tested a bank's real customer data, and neither measured the minutes an analyst spends on a hit, which is where most of the cost sits. A buyer should treat both as reasons to run a pilot, not as results to expect.
What the record shows: the comparison buyers skip
The record a system leaves is the part of a comparison that examiners test and buyers rarely do. After a hit is closed, can someone who was not there see which list version it was checked against, which identifiers were compared and with what values, who decided and whether anyone checked? If not, every later question, from an examiner, from QA, or from OFAC after an amendment, becomes a re-investigation.
The record in Sanctions Alert Review: every action by people and agents, and an examiner's export
Questions to ask a sanctions screening vendor
Ask questions whose answers can be checked on your own data. A vendor's detection rate on its own test set says little; how its system behaves on your amended entries, your transliterated names and your busiest list update says a great deal.
Questions for a sanctions screening vendor, and what a good answer contains
- Which lists, and how fast after OFAC publishes?
The time from publication to screening, and how you will know if an update failed to load.
- What exactly is re-screened, and how often?
All customers or only new and changed ones; MidFirst misread exactly this in its vendor contract.
- What does the system keep of the list entry?
The version each hit was raised and decided against, or only today's entry.
- How are repeat alerts handled?
Any suppression or good-guy rule, what it checks, and whether a changed entry breaks the link.
- Which identifiers beyond the name are compared, and how is each shown?
Date of birth, nationality, address, IDs, BICs, vessel numbers, with sources.
- What can the software decide on its own?
The answer you want is nothing that closes, blocks, rejects, releases or files.
- How is a threshold or rule change tested?
Seeded names, expected results written before approval, and who approves.
- Can we replay last quarter's closed alerts?
A pilot on your own decided hits, including every true match, before go-live.
The contract question deserves emphasis. MidFirst's vendor screened new and changed customers daily but the whole customer base only monthly, and OFAC found that the bank had misread the scope of its own contract, believing the daily run covered everyone (OFAC, MidFirst Bank, 2022). The comparison a buyer makes before signing should be written into what the vendor is contracted to do.
Where Sanctions Alert Review fits, and where it does not
Sanctions Alert Review fits after a screening service, on the hits it raises from onboarding, payments and list re-screens. It connects to that service, to OFAC's Sanctions List Service for the lists and their versions, to the core banking system for the member's details, to digital account opening and the payments hub for held applications and wires, and to case management and OFAC reporting. Seven agents compare, guard list versions and draft; an analyst closes, a reviewer re-checks blind, and two officers sign every block or rejection.
It does not replace the filter, the payment interdiction or the list feed, and it does not choose a threshold; its tuning agent proposes changes for two officers to approve. It is not a list provider, and it does not decide matches. It adds the most where a team's minutes go to look-ups, where reasons are hard to reproduce, and where list amendments make old closures unsafe. It adds little for an institution with a handful of hits a month that already documents every review in full; for that bank, the FFIEC's manual-filtering path and OFAC's free tool may be enough.
How to switch without a gap
Switch by running the new approach alongside the old one on alerts already decided, then on live alerts with both outputs compared, before any live decision depends on it. The danger in a switch is not the new tool's accuracy but the transition itself: OFAC's 2026 Bank of America release warned that "Technical changes, such as transitions to new screening tools or updates to existing ones, should be implemented in a controlled manner to avoid creating delays, gaps, or backlogs that cannot be effectively managed."
A controlled switch has three stages: a replay of a quarter's closed alerts, including every true match; a parallel run on live alerts with differences reviewed daily; and a cut-over with the old system's alerts kept for reference. The pass and fail tests for the first stage are set out in a pilot on alerts you have already closed, and the question of how far to trust the agents in AI for sanctions screening, traced on one hit. To run that replay on your own hits, start from Sanctions Alert Review.
Questions people ask
What is the best sanctions screening software?
There is no regulatory answer. OFAC endorses no product, says packages vary considerably in cost and capabilities, and suggests asking peer banks what works for them. The best choice is the one that performs on your own hits, including amended entries and transliterated names, and leaves a record an examiner can follow.
Do I have to buy expensive OFAC software?
Not necessarily. OFAC's FAQ 27 calls it primarily a question for your regulator, and the FFIEC manual allows banks with lower OFAC risk and low transaction volumes to filter manually. Higher-risk areas such as international wires usually need software that catches name variations.
What is the difference between screening software and alert review software?
Screening software compares names against the lists and raises hits. Alert review software works on those hits: gathering the customer and the full entry, comparing identifiers, recording the decision and routing escalations. OFAC's FAQ 31 already distinguishes wire interdiction packages from customer-name checking; review is a third job.
Can sanctions screening software use AI?
Yes. No OFAC rule restricts the technology, and a Federal Reserve working paper found language models cut false positives sharply on test data. Under the U.S. agencies' 2026 model risk guidance, SR 26-2, conventional machine-learning scorers are in scope while generative and agentic AI are left to each bank's own governance.
How long does it take to compare sanctions screening tools properly?
Long enough to replay a full quarter of your own closed alerts through each candidate, including every true match and every amended-entry case. A comparison on a vendor's demonstration set is quicker, but it tests the vendor's data rather than yours.