The alert is not the answer: OFAC’s six steps from screening hit to decision.

A screening alert is where the analysis starts, not where it ends. OFAC’s FAQ 5 sets out six steps from the hit to a documented decision.

Foundations · 25 Sep 2026

Your screening tool fires. A name on an inbound payment, a new supplier, a job applicant, a freight forwarder's counterparty — something matched something. The system has done its job and stopped. Now a person has to assess whether this is a coincidence of spelling, a transaction that must be blocked or rejected, or activity that may proceed. An alert alone does not answer that question.

That decision is the whole subject of this piece. OFAC has written down how it thinks the decision should be made, in FAQ 5 — six steps, from the moment the alert appears to the moment the file is closed. FAQ 5 was released on January 30, 2015, and updated on September 9, 2026, so a procedure written against the older text is worth re-reading against the current one.

Two things about its status, because they shape how much weight it carries. FAQ 5 is agency guidance, not law (U.S. federal). It tells you what OFAC recommends. The recordkeeping and reporting rules it points to at the end are a different animal: those are binding regulations (mandatory, U.S. federal), and they create separate obligations.

Step 1: whose list did you actually hit?

OFAC's first question is not about the name. It is about the list.

Screening tools often run a transaction against several lists at once: OFAC's, other government agencies', a vendor's proprietary list, and whatever internal watchlist the company has accumulated. The alert that lands on your desk may say very little about which one fired.

That matters because OFAC's guidance, OFAC's prohibitions and OFAC's reporting deadlines apply only to OFAC matters. The examples OFAC itself gives of non-OFAC lists are the Commerce Department's BIS Entity List, the FBI's Most Wanted List and the State Department's Debarred Parties List. Each has its own agency, its own consequences and its own procedure — and OFAC says plainly that it does not provide guidance on potential matches unrelated to OFAC sanctions. If the hit belongs to another agency, that agency is who you talk to.

For a company with export exposure this separation is not academic. An Entity List hit is an export-controls issue requiring a separate analysis; the same transaction may also raise OFAC issues. For related export-jurisdiction questions, see the companion piece on de minimis and the Foreign Direct Product rules.

Step 2: a listed name, or something bigger?

If the hit is an OFAC hit, the second question separates two very different problems.

One is a possible match to a name on an OFAC list. That is Step 3 onward, and it is the familiar case.

The other is an OFAC nexus that has nothing to do with a listed name: a transaction touching a sanctioned jurisdiction such as Iran, a sanctioned government such as the Government of Cuba, or an entity that is blocked by operation of law without appearing on any list — the 50 Percent Rule case, which the companion piece on the 50 Percent Rule covers, and which the sham transactions piece extends to interests that were moved on paper only.

OFAC recommends considering escalation before acting, because the regulations may prohibit the transaction outright or require blocking. A name-match playbook alone cannot resolve that question: there may be no list entry to compare against, and a name-similarity score does not answer the legal issue.

The escalation is not automatically bad news. OFAC notes that transactions may be exempt or authorized — its own example is personal remittances under certain programs, subject to restrictions. Whether an authorization reaches your facts is a question about the specific program's regulations.

Step 3: how good is the match, really?

Here OFAC is unusually concrete, and the guidance rewards close reading.

Start from the complete list entry, not the fragment your tool surfaced. OFAC's entries carry information such as full names, former names, known aliases, nationalities, passport, tax and national identification numbers, place and date of birth, business registration numbers and known addresses; enhanced data can also include the designation date and names and aliases in non-Latin character sets. Not every entry contains every identifier. The entry is available through your own screening software, through OFAC's Sanctions List Service or through the Sanctions List Search Tool.

Then compare everything you have against everything OFAC has published. OFAC's framing is that many potential matches are false positives — its own illustration is an alert generated because a person or company has a name or alias similar to a listed vessel. The questions it suggests are the ones a careful analyst asks anyway: does only the first or last name match? Is the date of birth different? The identification number? The nationality? Is the listed address a different address?

Three details in the current text are worth lifting out, because each one is a place where a procedure can overreach in one direction or the other:

An address match alone may be insufficient. Multiple businesses may be registered or located at the same address, so an exact address hit alone may not be sufficient to indicate a potential match. It is not a reason to disregard the address or other corroborating information.
Weak aliases exist and may be filtered. A "weak AKA" is a relatively broad or generic alias that may generate a large volume of false hits. The criteria OFAC used to flag candidates for review are short strings, names containing digits, nicknames ("Ahmed the Tall"), geographic references ("Ahmed the Sudanese"), and a very common prefix in a two-part name (FAQ 122). OFAC designates these deliberately, and FAQ 5 says your screening tool may exclude them as part of a risk-based decision. May, not must — and the decision should be written down as a decision. OFAC has also said it does not generally expect weak aliases to be screened, but expects that they may be used to help determine whether a hit arising from other information is accurate (FAQ 124). Filtering alerts is not the same as discarding that evidence.
A famous name cuts the other way. OFAC's example is a close or exact match to a well-known sanctioned figure where open-source reporting and photographs plainly do not match the passport or driver's license in front of you.

Resolving the alert may mean going back to the parties for documents — a birth certificate, a driver's license, a corporate registration. That is a commercial conversation as much as a compliance one, and it is easier to have when the request is routine rather than an accusation.

OFAC's conclusion to this step: if after reviewing the available information you can reasonably determine the match is not valid, you may proceed. That resolves the name-match issue, not any separate jurisdictional, ownership or other restriction affecting the transaction.

Step 4: a likely match is not yet a blocking

Where the match holds up — an exact match, or a close one with several corroborating identifiers and nothing that disqualifies it — OFAC asks you to follow your own procedures for likely matches and to make a risk-based decision about whether the match is valid, consistent with your policies, your risk profile and any applicable regulator guidance.

Once the match is established, ask whether the transaction is exempt or authorized. A general or specific license may cover it, in which case the activity may proceed consistent with its terms and your own policies and risk tolerance. Risk tolerance cannot override a legal prohibition. This assessment is not a grace period for moving property that must be blocked. If no authorization or exemption applies, determine the required action.

Step 5: block, reject, or proceed

These are three different outcomes. The applicable rules determine whether blocking or rejection is required and whether proceeding is permitted.

Block when applicable OFAC rules require blocking property or an interest in property, subject to the relevant jurisdictional reach and any authorization or exemption. FAQ 5 gives examples involving SDNs and other blocked persons, blocked governments, Iranian financial institutions, Cuba and certain Cuban nationals, and entities blocked under the 50 Percent Rule. Its chart also places certain activities involving certain non-SDN lists in both the blocking and rejection columns: the specific restrictions matter. Blocking is not "hold it and see." For blocked funds, FAQ 5 describes a qualifying, segregated, interest-bearing account at a federally insured financial institution in the United States, from which only OFAC-authorized debits may be made. Confirm the relevant program's account requirements.

Reject where the transaction is prohibited but there is no blockable interest — a sanctioned jurisdiction, or a sanctioned sector or activity, with no blocked person in the picture. The transaction does not go forward, and it is not frozen.

Proceed where there is no true OFAC nexus or match, or the activity is exempt or authorized.

Each program is different, so the applicable regulations confirm the action; the categories above are OFAC's general guidance, not a substitute for the program text.

Step 6: the part that creates the paper trail

This step documents the decision and addresses binding reporting and recordkeeping rules. The earlier blocking and transaction prohibitions also come from binding law; the FAQ explains how to work through them.

Reporting. For persons covered by the relevant reporting rule, a blocking must be reported to OFAC within 10 business days from the date the property becomes blocked (31 C.F.R. § 501.603(b)(1)(i); mandatory, U.S. federal). A rejected transaction must be reported within 10 business days of the rejection (§ 501.604(c); mandatory, U.S. federal). Initial blocking reports and rejection reports generally go through the OFAC Reporting System (ORS). Filing in any other manner requires evidence of unique and extraordinary circumstances that prevent ORS use, and such a request is subject to a presumption of denial and granted only in writing (§ 501.603(d)(1), § 501.604(d)).

Three points that catch non-financial companies in particular:

This is not a banks-only rule. Both sections apply to any U.S. person, "including a financial institution," that meets the relevant reporting conditions; for the Cuba rules, they also cover persons subject to U.S. jurisdiction as specified in part 515. A U.S. manufacturer that rejects a purchase order because processing it would violate OFAC rules, without a blockable interest, must report under § 501.604 just as a bank rejecting a prohibited wire must. An ordinary commercial refusal is not automatically reportable.
Blocking reporting does not end at the initial report. Property still blocked as of June 30 is reported annually by September 30, and unblockings or transfers carry their own 10-business-day report, subject to four enumerated exceptions (§ 501.603(b)(2), (b)(3)). These include qualifying licensed releases and OFAC delistings; a license can still require a separate report. Required unblocking or transfer reports may be submitted through ORS or by email as specified in § 501.603(d)(2).
"SDN" is not a legal authority. The report must state the legal authority for the blocking or rejection, which may be a reference to the sanctions program, the relevant part of the regulations, an executive order or a statute; OFAC states expressly that the term "SDN" is generic and cannot be used for this purpose (§ 501.603(b)(1)(ii)(H), § 501.604(b)(6)).

Records. OFAC recommends keeping complete records of the steps taken to investigate the potential match and the information relied on. The regulation separately requires a full and accurate record of transactions subject to OFAC's regulations, including licensed transactions, to be available for examination for at least ten years after the transaction date, except as otherwise provided (§ 501.601; mandatory, U.S. federal). For blocked property the clock runs for as long as the property is blocked plus at least ten years after it is unblocked. A retention schedule still set to five years does not meet this ten-year requirement for covered records. The amendment was published September 13, 2024, and took effect March 12, 2025. This is the OFAC rule, not a universal retention period for every business record; other applicable duties or holds may require a separate assessment.

And OFAC can ask for the file. Under § 501.602 (mandatory, U.S. federal), OFAC may require complete information under oath about covered acts, transactions or property interests, before, during or after a transaction. The definition of "document" there expressly reaches notes, text and instant messages, emails, spreadsheets and metadata. The analyst's contemporaneous note explaining why a hit was cleared is the kind of document that definition reaches.

The sentence to build the procedure around

At the end of FAQ 5, OFAC says what it will not do: it does not confirm potential matches or false positives, and instead encourages organizations to make risk-based determinations consistent with the guidance. There is a compliance hotline for questions about the guidance. There is no phone number that will tell you whether this particular Mr. Ahmadi is that Mr. Ahmadi.

Your organization remains responsible for its determination. A contemporaneous record helps show what was checked and why the conclusion followed; documentation does not itself make an incorrect decision lawful.

What to do with this

Four starting points. Where the facts are uncertain or the exposure is significant, they do not replace advice on the specific transaction.

Write the list-source question into the first line of the procedure. If the analyst cannot say which list fired, the rest of the analysis is running on an assumption.

Separate the name-match path from the jurisdiction path. They need different escalation routes, and the second one has no list entry to argue with.

Make the weak-alias filter an express, recorded decision. It is a legitimate risk-based choice. It is a much worse position if nobody can say who made it or when.

Check the retention setting. For records covered by § 501.601, preserve the applicable ten-year minimum and, for blocked property, the blocking period plus at least ten years after unblocking, unless otherwise provided. Confirm that the setting actually reaches the required records.

Scope note. Zimmermann Law is a New York firm advising on U.S. sanctions and compliance. Nothing here is advice on German, Austrian, Swiss or EU law, and EU or national screening and reporting obligations are not addressed and require separate analysis. Mandatory blocking and rejection reports under §§ 501.603 and 501.604 serve a different purpose from reporting one's own apparent violation. Whether a disclosure qualifies as voluntary is governed separately by 31 C.F.R. part 501, appendix A, § I.I (codified OFAC enforcement guidelines, U.S. federal). The firm does not act on voluntary self-disclosure, OFAC litigation or delisting, or individual executive representation. Those go to counsel who do.

A screening procedure is only as good as the decision it documents. We write the steps your team follows between the alert and the file. Contact Zimmermann Law to talk it through.

Sources: OFAC FAQ 5, "When screening for sanctions, how do I determine if I have a valid match to a name on one of OFAC's lists?" — agency guidance, not law; U.S. federal; released January 30, 2015; updated September 9, 2026; read in full September 25, 2026. OFAC FAQ 122, "What are weak aliases (AKAs)?" — agency guidance, not law; U.S. federal; released January 18, 2011; read in full September 25, 2026. OFAC FAQ 124, "Am I required to screen for weak aliases (AKAs)?" — agency guidance, not law; U.S. federal; released January 18, 2011; read in full September 25, 2026. 31 C.F.R. § 501.601, § 501.602, § 501.603 and § 501.604 — mandatory, U.S. federal; operative text read in full on eCFR, September 25, 2026 (title 31 displayed as up to date through September 22–24, 2026). Part 501 was last amended July 27, 2026. eCFR is authoritative but unofficial. OFAC, Reporting, Procedures and Penalties, 89 FR 74832 (September 13, 2024) — interim final rule; Dates and revised § 501.601; retention amendment effective March 12, 2025. 31 C.F.R. part 501, appendix A, § I.I — voluntary self-disclosure definition and exclusions; codified OFAC enforcement guidelines, U.S. federal; read September 25, 2026.

This post is for general information and is not legal advice.

Attorney Advertising. Zimmermann Law PLLC · New York · +1 (917) 426-4625 · contact@zimmermann-law.com