A sanctions screening threshold is the similarity score, usually on a scale of 0 to 100, above which a screening system treats a name as close enough to a list entry to raise a hit for a person to review. There is no correct number: OFAC says it "cannot make such a recommendation" and leaves the threshold to each organization's risk assessment. Set it low and analysts drown in names that merely look alike; set it high and spelling variants of real targets pass unflagged, as enforcement cases on both sides of the Atlantic show. The deeper point is that a score measures how alike two strings of letters are, not whether two people are the same. Botminds' Sanctions Alert Review starts where the score stops: agents compare every other identifier on the entry, and a proposed threshold change is tested on seeded names before two officers approve it.
Examples from the solution use a fictional sample, Norrell Federal Credit Union. The research figures come from OFAC, a Federal Reserve working paper and a peer-reviewed study, linked where they appear.
The sanctions screening threshold, in four numbers
100
the default score in OFAC's Sanctions List Search, meaning an exact match
50%
the edit-distance similarity OFAC's search requires before it scores a name at all
None
recommended by OFAC: it leaves the threshold to each organization
+22pts
accuracy gain in one peer-reviewed test from raising the threshold from 85 to 90, on mock data
What a sanctions screening threshold is
A sanctions screening threshold is a cut-off on a similarity score: names that score at or above it against a list entry become hits, names below it pass silently. Every fuzzy screening system has one, whether it is called a threshold, a match score, a minimum name score or a sensitivity setting. It is the single setting with the most influence on how many hits a team reviews and on which true matches it never sees.
Regulators frame it as a risk decision, not a technical default. The FFIEC examination manual says "Decisions to use interdiction software and the degree of sensitivity of that software should be based on a bank's assessment of its risk and the volume of its transactions", and that in a higher-risk, high-volume area "the bank's interdiction software should be able to identify close name derivations for review" (FFIEC BSA/AML manual, OFAC section). The threshold is how a bank turns that sentence into a number.
How does OFAC's Sanctions List Search score names?
OFAC's free search tool scores names in two stages: a coarse filter, then two algorithms, and it reports the higher of two scores. OFAC describes it in FAQ 249: the tool "will first look for potential matches based on the first letter of input search terms and by checking for matches at least 50% or more similar based on edit distance". It then applies "two matching logic algorithms" in two ways, and "The two algorithms are Jaro-Winkler, a string difference algorithm, and Soundex, a phonetic algorithm" (OFAC FAQs on Sanctions List Search).
How OFAC's Sanctions List Search turns a name into a score
| Stage | What OFAC says it does | What it means for a threshold |
|---|---|---|
| 1. Pre-filter | Looks for candidates by the first letter of the search terms and at least 50% similarity by edit distance | A name whose first letter differs, or that is less than half alike, is never scored at all |
| 2. Whole-name score | Compares the entire name entered with full names on the lists using Jaro-Winkler | Rewards names that agree at the start; sensitive to word order |
| 3. Name-part score | Splits the name into parts and compares each part with Jaro-Winkler and Soundex, giving a composite | Catches reordered names and sound-alike spellings |
| 4. Result | Returns the higher of the two scores | One strong technique is enough to rank a name highly |
| 5. Threshold | A slider that defaults to 100, an exact match; a value of 50 returns names deemed 50% similar | The user, not OFAC, decides where to set it |
Two details matter for anyone setting a threshold on their own system. Only the name influences OFAC's score; FAQ 251 says so in five words, "Only the name field influences the score." And the first-letter pre-filter means a transliteration that changes the first letter, such as Gim for Kim, may never reach the scoring stage. Commercial systems differ in the detail, but most share the same shape: a candidate filter, one or more string measures, and a cut-off.
What does an 85 percent match score mean?
An 85 percent match score means the two names are 85% alike by the measure the system uses, nothing more. It does not mean an 85% chance that the customer is the listed person. The same score can come from a customer whose name differs by a transposed pair of letters and who shares a date of birth with the entry, or from a customer with a common name, a different birth year and a different nationality. Only the other identifiers separate them.
The sample credit union's first hit of the morning shows the gap. Member Maria Elena Castillo scored 96 on the name against SDN entry CASTILLO, Maria Elena: almost an exact match. Her date of birth was 27 years apart from the entry's, her nationality and place of birth differed, and the entry carried no address or ID number. The score was high and the identity was wrong.
Score 96 on the name, two identifiers in conflict: Sanctions Alert Review shows why that is no match
OFAC's tool is explicit about this. FAQ 247 says the score "indicates the similarity between the name entered and resulting matches", and points users to FAQ 5 "for more information on what a true sanctions list match is". In OFAC's own design, the score decides what a person looks at; the person decides what it means. How that judgement is made is covered in what to do with an OFAC hit.
Score 100 and four more identifiers in agreement: what a match looks like in Sanctions Alert Review
Jaro-Winkler vs Levenshtein, and why neither knows who someone is
Levenshtein and Jaro-Winkler both measure how alike two strings are, but they reward different kinds of likeness. The Federal Reserve working paper by Allen and Hatfield defines them precisely: Levenshtein, "also known as edit distance, is based on the number of operations, including insertions, deletions, and substitutions, that it takes to transform one string into another", while Jaro-Winkler "is derived from the number of matching characters between two strings, the number of transpositions, and the length of the strings, with greater weight assigned to commonalities at the beginning of the strings" (Allen and Hatfield, FEDS 2025-092).
Four string measures, four ideas of 'similar'
| Measure | What it counts | Good at | Weak at |
|---|---|---|---|
| Levenshtein (edit distance) | Insertions, deletions and substitutions needed to turn one string into the other | Typos, a dropped or added letter | Reordered names; long names where one extra word costs many edits |
| Jaro-Winkler | Matching characters and transpositions, weighted toward agreement at the start | Short names, swapped adjacent letters, shared prefixes | Differences at the start, such as transliterated first letters |
| Soundex | A code built from the first letter and the consonant sounds that follow | Sound-alike spellings of the same name | Anything where the first letter changes; non-English phonetics |
| Token sort | Edit distance after splitting into words and sorting them | Given and family names in a different order | Missing or extra middle names |
Neither measure knows anything about people. Kim and Yang note that "The primary algorithm for text-similarity checks in sanction screening is the Levenshtein distance algorithm", and that the edit distance between "Kim" and "Gim" is 1, a single substitution (Kim and Yang, 2024). That one edit is a large share of a three-letter name and a tiny share of a five-word company name, which is why the same threshold behaves differently on short and long names. The choice of algorithm matters less than knowing which mistakes it makes, and testing for them.
What threshold should you set for sanctions name matching?
Set the lowest threshold your team can review well, prove with seeded tests that it catches the spelling variants your risk assessment cares about, and write down why. OFAC will not give a number: FAQ 250 says "OFAC cannot make such a recommendation because each search has its own unique set of facts surrounding it", and users "must make their own match threshold determinations based upon their own internal risk assessments and established compliance practices."
The research shows why there is no safe default. Kim and Yang, in a peer-reviewed study in Frontiers in Artificial Intelligence, put the trade-off plainly: "a low threshold, such as 70% similarity, can lead to numerous false positives, while a high threshold, like 99%, may reduce false positives but raise the risk of false negatives." Their test program started at a threshold of 80, was moved to 85 to cut false positives, and was then tested at 90.
Raising the threshold from 85 to 90 raised accuracy on mock data, more for the plain program than the NLP one
The study is small and the data synthetic, so its numbers are not a benchmark for a bank. Its lesson is general: accuracy moved by more than 20 points with a five-point change in the threshold, and the authors concluded that "Testing the targeted dataset and determining the optimal threshold is essential to minimize false negatives while keeping false positives low." The threshold that suits one customer base and one list mix will not suit another.
Newer methods change the shape of the trade-off rather than removing it. The Federal Reserve working paper tested language models against fuzzy matching at thresholds of 80, 85, 90 and 95 on organization names and found that "while the fuzzy methods demonstrate the classic tradeoff between precision and recall as we raise the matching threshold, the language models' performance is stable." Its authors suggest that with such models "practitioners could likely select a very high matching threshold, without materially affecting detection rates", a finding on test data generated from OFAC entries, not yet on bank data. What that means for buying is covered in AI for sanctions screening, traced on one hit.
Too strict: the exact-match filter and the missed spelling
A threshold set too high fails silently: nobody sees the hits that were never raised. OFAC's 2020 settlement with Deutsche Bank Trust Company Americas records 61 payments processed for a designated bank, Krayinvestbank, in December 2015. The payments carried the designated bank's BIC and "an almost identical match to the bank's name and address", but DBTCA's "screening tool was calibrated so that only an exact match to a designated entity would trigger further manual review", and it had not loaded the BIC (OFAC, Deutsche Bank Trust Company Americas, September 9, 2020).
The UK case is about spelling. OFSI's £160,000 penalty on Bank of Scotland, a Lloyds Banking Group subsidiary, imposed on November 10, 2025, describes a designated person who opened an account with a UK passport whose spelling differed from the Consolidated List by "a changed character and an additional character in the forename, a missing middle name and a changed character in the surname." OFSI added that "The character changes are common equivalents in Russian to English translations", and that "the screening system did not reconcile the character changes between the spelling variations" (OFSI, Bank of Scotland, 2025). No alert fired at account opening.
Both cases are arguments for testing the threshold against the variants that matter, not for lowering it everywhere. The FFIEC manual adds a practical rule from OFAC: "if a bank identifies a name derivation of an OFAC target, then OFAC suggests that the bank add the name to its filtering process." A known variant belongs on the list, not left to the threshold to find.
How to tune sanctions screening without missing true matches
Tune from the evidence of your own closures, test every proposed change on seeded names before it goes live, and have someone other than the tuner approve it. The closures say which settings produce the false hits; the seeded names say what the change would miss. A threshold change made without both is a guess with a version number.
In the sample, the solution's tuning agent read every closure reason and found that single-token names, one-word names that match many customers, produced a large share of false hits. It proposed raising the screening service's threshold for single-token names from 85 to 88, tested it on seeded names, and wrote the expected effect: about 70 fewer hits a day, while 180 of 180 list-derived variants still hit. The change waits for the BSA/OFAC Officer and the Deputy BSA Officer, and the administrator applies it only after both approve. Every one of those numbers is from fictional sample data, and the agent never changes a setting itself.
What a threshold change should carry before approval, as Sanctions Alert Review's tuning agent prepares it
- The evidence for the change
Which closure reasons and which name patterns produce the false hits, counted over a stated period.
- A seeded test set
Known list names and realistic variants: transliterations, dropped middle names, swapped order, character substitutions, aliases.
- Results on both sides
How many seeded variants still hit at the new threshold, and how many fewer false hits are expected.
- The scope
Which names, lists or channels the change applies to; a single-token rule is not a global one.
- Two approvers
Someone other than the person who proposed it, and a record of who approved and when.
- A re-test date
Thresholds drift as lists and customer bases change; schedule the next check.
Weak aliases and single-token names
Weak aliases and single-token names are where thresholds produce the most noise. OFAC's FAQ 122 defines a weak alias as "a relatively broad or generic alias that may generate a large volume of false hits when such names are run through a computer-based screening system", and lists the criteria it used to flag them: short character length, digits in the alias, nickname-style words such as "Ahmed the Tall", geographic references such as "Ahmed the Sudanese", and very common prefixes such as "Mr. Smith" (OFAC FAQ 122).
OFAC keeps weak aliases on the list because they can help confirm a match raised by other identifiers, and it leaves screening them to a risk-based decision. Single-token names raise the same problem from the customer side: a one-word name matches many entries closely, and a small spelling difference is a large share of it. Treating them with their own threshold, tested on seeded names, is the narrow alternative to raising the threshold for everyone. To see the tuning proposal and its test in the product, start from Sanctions Alert Review.
Questions people ask
Does OFAC recommend a match threshold?
No. OFAC's FAQ 250 says it cannot make such a recommendation because each search has its own circumstances, and that users must set their own threshold from their internal risk assessments and compliance practices. Its own search tool defaults to 100, an exact match.
What is fuzzy logic in sanctions screening?
Fuzzy logic is name matching that finds near matches rather than exact ones, using string and phonetic measures such as edit distance, Jaro-Winkler and Soundex. OFAC's Sanctions List Search uses it on the name field only, while fields such as ID numbers use exact character matching.
Is a higher threshold safer?
Not by itself. A higher threshold means fewer hits but more missed variants; DBTCA's filter, calibrated to exact matches only, missed 61 payments to a designated bank whose name was an almost identical match. Safer means tested: a threshold proven against seeded variants of the names your risk assessment cares about.
Why do short names cause so many sanctions hits?
Because a single letter is a large share of a short name, so many unrelated names clear a similarity threshold. OFAC's weak-alias criteria start with character length for the same reason, and some programs set a separate, tested threshold for single-token names.
How often should sanctions screening thresholds be reviewed?
No rule sets a period. Review them when evidence changes: a shift in false-hit patterns, a new list or customer segment, a vendor algorithm change, or a missed variant found in testing. OFAC's FAQ 892 advises users of its own tool to repeat testing after it changed its algorithm in 2021.