Export Control Screening Software for Banks: Three Approaches

Export control screening software for banks takes one of three approaches. List screening checks the names in a transaction against restricted-party lists such as BIS's Entity List and Denied Persons List. HS-code flagging checks each goods line's tariff code against published high-priority lists. Goods-line reading compares what the documents say about the goods, the consignee, the route and the end use, and hands the doubtful lines to a person. BIS's 2024 guidance to financial institutions asks for parts of all three: real-time screening against a short set of BIS lists, due diligence on customers, and a review of transactions for red flags. Botminds' Trade Sanctions & Dual-Use Screening is built on the third approach and works alongside the bank's existing screening engine for the first.

What export control screening software do banks use?

Most banks extend the sanctions screening engine they already run, adding BIS's lists to OFAC's. The usual source is the U.S. government's Consolidated Screening List, which combines the export screening lists of the Departments of Commerce, State and the Treasury and is offered free, with an API, refreshed each morning (International Trade Administration, Consolidated Screening List; OFAC sanctions search API integration quotes the service's own description). Fewer banks add goods-level checks, and fewer still read the trade documents for consistency.

That pattern makes sense historically: export controls were the exporter's problem and names were the bank's. It is less defensible since BIS wrote to financial institutions directly in 2024, and since FinCEN and BIS told banks to look at HS codes on invoices and at who the documents say the consignee is.

What does BIS ask financial institutions to screen?

Less in real time than many vendors imply, and more after processing than many banks do. BIS states that "in recognition of difficulties in implementation", it "does not expect FIs to engage in real-time screening of parties to a transaction to prevent violations of GP 10", with one exception: for cross-border payments and other transactions "likely to be associated with exports from the United States", it recommends real-time screening of names and addresses against three list groups (BIS, 2024).

Two details matter for software. First, the real-time lists are narrower than "the Entity List": BIS names entities with particular footnotes and license review policies, so a vendor that screens the whole list in real time is screening more than asked, which is allowed but generates hits. Second, BIS asks banks not to self-blind: they need not request extra names to screen, but they "may not willfully self-blind or deliberately avoid becoming aware of facts or circumstances". A letter of credit puts many names in front of a bank; all of them count.

Is list screening enough for export controls?

No, because export controls attach to items, destinations and end uses, not only to names. General Prohibition 10 forbids financing a transaction with knowledge that an export-control violation has occurred or will occur, and knowledge reaches as far as an awareness of a high probability. A clean name screen says nothing about whether an eighteen-thousand-rpm spindle is going to a plant in Gebze or to an end user in a third country named on one document only.

The industry's own standard says the same about a related problem. Where sanctions target an activity, an industry or a region rather than named parties, "it makes any effective screening of a transaction by FIs exceptionally difficult, regardless of whether automated or manual processes are used" (Wolfsberg, ICC and BAFT, Trade Finance Principles, Control Mechanisms 4.1). Export controls on goods are the same kind of target. General Prohibition 10 and the knowledge standard explain why a bank's exposure is about what it knew, not only whom it screened.

Approach 1: list screening, essential and narrow

List screening is the one approach BIS asks for in real time, and the one every bank already has. Its strength is certainty on the lists it covers: a match against the Denied Persons List is a reason to stop. Its weaknesses are familiar. It sees only names, it cannot see goods, and it generates false hits at volume. The Wolfsberg principles call "the volume of false hits which can occur in their systems as a result of automated screening" "a very substantial practical issue" (Control Mechanisms 3.2), and every extra list adds to it.

For export controls specifically, list screening also misses the obvious evasion pattern. FinCEN and BIS describe procurement through front companies and intermediaries in third countries, some incorporated only after February 2022, which may be on no list on the day they trade (FIN-2023-Alert004). Software sold as "export control screening" that is only list screening should be bought as what it is.

Approach 2: HS-code flagging against the high-priority list

HS-code flagging compares each goods line's six-digit code with the Common High Priority Items List and similar published code lists. It is cheap, it covers every line and it matches the way regulators wrote their guidance: the May 2023 FinCEN–BIS alert asked banks to conduct due diligence "when encountering one of the nine listed HS codes", which "can be found on trade documents including commercial invoices, packing slips, airway bills, sea bills".

Its limit is that an HS code is not a classification. BIS says the 50 high-priority codes cover EAR99 goods as well as controlled ones (BIS, CHPL). Flagging every ball bearing, connector and circuit board on the list produces a queue the desk cannot clear with any evidence, because the flag carries none. Used alone, it moves the bottleneck from finding goods lines to judging them. The 50-code list, read for banks sets out what the tiers contain.

BIS recognizes that FIs will likely not have sufficient information to individually assess every transaction for potential EAR violations before proceeding.

BIS, guidance to financial institutions, October 9, 2024

Approach 3: reading the goods line, with a person deciding

The third approach reads the trade documents for the things lists and codes cannot see: whether the consignee is the same on every document, whether the route runs through a known transshipment point, whether the goods fit the buyer's business, and what a technical description implies about control status. FinCEN and BIS flagged exactly these patterns, including letters of credit consigned to the issuing bank with no document naming the actual end user (FIN-2023-NTC2).

Its strengths are coverage of the red flags BIS cares about and evidence on every decision. Its limits are honest ones: it needs documents, so it adds little to open account payments; it creates specialist work on the lines it holds; and no regulator has published a benchmark for its accuracy. It does not replace the list screening engine, and a vendor that says it does should be asked which lists, in real time, against which version.

The criteria that separate export control screening software

Four criteria do most of the separating. Coverage of the BIS real-time lists, with every known party sent, including the banks and parties named in a letter of credit, not only the applicant and beneficiary.Evidence per decision: whether each cleared hit shows the identifiers compared and the list version used, rather than a free-text note. Goods-level signals: whether the software sees the HS code, the description and the end user at all. A post-transaction review: BIS expects risk-based procedures to "detect and investigate red flags post-transaction", and a tool that only screens at the moment of payment cannot help with that.

A fifth criterion is easy to miss: how the software behaves when a list changes. BIS stresses that due diligence "is not a one-and-done process" and that lists change continuously. Re-screening open transactions against a new list version, and saying so on screen when an update is published but not yet applied, is the difference between a control and a snapshot.

Trade Sanctions & Dual-Use Screening: every element of one transaction, screened and cited

Questions to put to any export control screening vendor

Put each question on a transaction of yours. The answers sort vendors into the three approaches faster than any brochure.

Where Botminds' Trade Sanctions & Dual-Use Screening fits

It sits in the third approach and works with the first. Seven agents break each trade transaction into every screenable element (parties, banks in the chain, the vessel, its owners, ports, countries and goods lines), send them to the bank's screening system against named list versions, read the goods lines and compare the documents. On the fictional sample credit that is 18 elements against seven list sources, six hits, four arriving with a drafted rationale and two needing a person. No agent clears, blocks, rejects or files anything.

It is tested the way screening should be. On the sample desk's quarterly effectiveness test of 4,000 sampled elements, all 61 known matches were found and four near-matches were missed, all of them vessels, which is why the vessel matching threshold was moved from 0.82 to 0.80 through a change the systems administrator proposed and the Sanctions Compliance Officer approved. Where it does not fit is equally plain: it does not replace the screening engine, it does not decide licences, and on open account payments with no documents it can add little to a name screen. How to test the goods-line side and the Trade Sanctions & Dual-Use Screening page cover the rest.

Hits ordered by the clock they are on, with the drafted rationale shown

Questions people ask

What is the Consolidated Screening List?

It is a free U.S. government list, published by the International Trade Administration, that combines export screening lists from Commerce, State and the Treasury, including BIS's Denied Persons, Unverified, Entity and Military End User lists. It comes with a search engine, downloadable files and an API, updated daily.

Do banks need real-time export control screening?

For transactions likely tied to U.S. exports, BIS recommends real-time screening against three groups of its lists: the Denied Persons List, certain military-intelligence end users and certain Entity List parties. Beyond those, BIS does not generally expect real-time screening and relies on due diligence and transaction review instead.

What is a post-transaction review for export controls?

It is a risk-based look back at processed transactions for red flags such as a refusal to give end-user details or a co-located listed party. BIS says a red flag found this way can give a bank knowledge for future transactions with the same parties, and recommends refraining from them if it cannot be resolved.

Is the Entity List the same as the SDN list?

No. The Entity List is kept by BIS under the export regulations and imposes license requirements for items to the listed parties; the SDN list is kept by OFAC and blocks the listed persons' property. Banks screen against both, and the Consolidated Screening List carries both.

Can our sanctions screening engine do export control screening?

For the list part, usually yes, once the BIS lists are loaded and every party is sent. It cannot see goods, consignee mismatches or routes, which is where goods-line reading adds to it rather than replaces it.