Sanctions List Screening: OFAC, UN, EU, UK & MAS Compared
Every regulated financial institution must screen customers and transactions against sanctions lists — but which lists, to what depth, and against what timing? OFAC, UN, EU, UK HMT, MAS and AUSTRAC each impose distinct obligations with different scope, update cadence and reporting requirements. This guide compares the six major sanctions lists and shows how to build a multi-list screening programme that satisfies every applicable regime.
Sanctions screening is the most frequently inspected control in any AML programme. Regulators treat it as the first line of defence — if a designated party can transact through the firm, every other control has failed. Minor gaps produce disproportionate enforcement risk: in 2023, OFAC settled with 17 financial institutions for an aggregate $1.5 billion, with the Binance settlement alone reaching $968 million. The cost of weak sanctions screening is measured in nine figures.
Different lists carry different risk weights. A miss on the OFAC SDN list creates direct US Treasury exposure regardless of where the firm is located — OFAC's reach follows USD clearing, US persons in the workflow, and US-origin technology. A miss on the EU consolidated list creates exposure for EU customers and EUR-denominated transactions. A miss on UN sanctions creates exposure essentially everywhere a UN member state regulates financial activity. Understanding which lists apply, and screening against each with appropriate rigour, is the foundation of a defensible programme.
The Six Major Sanctions Lists
The lists below cover the substantial majority of obligation exposure for regulated firms operating across the major financial centres. Firms with more specialised geographic exposure should add the relevant additional regimes (OFSI's Russia-specific lists, Switzerland's SECO, Canada's SEMA designations, and so on).
OFAC SDN List (United States)
Maintained by the US Office of Foreign Assets Control. The Specially Designated Nationals and Blocked Persons list is the most consequential single sanctions list in global finance, covering several thousand individuals, entities, vessels and aircraft across more than 40 distinct sanctions programmes (Russia/Ukraine, Iran, North Korea, Venezuela, narcotics trafficking, cyber, terrorism, and others). OFAC's 50% rule extends sanctions automatically to any entity owned 50% or more in aggregate by one or more SDN-listed persons — meaning a screening hit on a UBO can trigger sanctions exposure on the underlying entity even when the entity itself is not listed. OFAC publishes updates as designations occur; firms should ingest changes within hours of publication.
UN Consolidated Sanctions List
Maintained by the United Nations Security Council, covering all designations made under Chapter VII resolutions. Scope is narrower than OFAC — focused on terrorism financing (ISIL and Al-Qaida regime), proliferation finance (DPRK and Iran), and a small number of country-specific regimes. UN designations are binding on every UN member state and form the foundation of most national sanctions lists. Update cadence is lower than national lists — typically weeks between revisions — but the obligation reach is universal.
EU Consolidated List
Maintained by the European External Action Service under EU Council Regulations. Implements UN designations plus EU-autonomous designations across thematic regimes (Russia, Belarus, cyber-attacks, human rights violations, chemical weapons proliferation, terrorism). The list is published in machine-readable XML and updated on a roughly weekly cadence as Council Regulations are amended. EU sanctions bind EU persons globally and any person acting within EU territory.
UK HMT (OFSI) Consolidated List
Maintained by the Office of Financial Sanctions Implementation within HM Treasury. Post-Brexit the UK list is independent of the EU list, though they continue to overlap on most designations. OFSI publishes the list as machine-readable CSV and XML. UK sanctions bind UK persons globally and any person within UK territory. Notable differences from the EU list include selected Russia-specific designations, the UK's broader use of the Global Anti-Corruption Sanctions Regulations, and timing differences as each regime moves at its own pace.
MAS Targeted Financial Sanctions (Singapore)
Maintained by the Monetary Authority of Singapore under the Terrorism (Suppression of Financing) Act and various MAS Regulations. MAS implements UN designations plus Singapore-specific designations affecting terrorism financing and proliferation finance. Compared with OFAC or EU lists, the volume of designations is smaller and the policy approach is more focused — Singapore prioritises full UN implementation over autonomous thematic regimes. Coverage obligation extends to all MAS-regulated financial institutions.
AUSTRAC and Australia DFAT Consolidated List
Maintained by the Department of Foreign Affairs and Trade with implementation oversight from AUSTRAC and the Australian Sanctions Office. Covers UN-mandated designations plus Australian autonomous designations under the Autonomous Sanctions Act 2011. The list is published in CSV format and updated as designations occur. Australian sanctions bind Australian persons globally and any person within Australian territory, with the regime currently undergoing significant expansion under AUSTRAC Tranche 2 reform.
Key Differences: Scope, Authority and Update Cadence
The lists overlap substantially — the majority of designated individuals appear on multiple lists — but they differ in ways that materially affect screening programme design.
Scope and policy reach. OFAC has the broadest autonomous regime, designating across more than 40 thematic programmes and with the unique 50% rule extending sanctions to non-listed entities through ownership. EU and UK regimes use targeted thematic frameworks (Russia, cyber, human rights, terrorism, chemical weapons) with autonomous designations layered on top of UN implementation. UN, MAS and AUSTRAC are more narrowly focused on terrorism financing and proliferation finance, with smaller autonomous designation programmes.
Extraterritorial reach. OFAC's reach extends to USD-denominated transactions globally, US persons employed anywhere, and US-origin technology in the transaction stack. EU and UK sanctions bind their nationals globally and anyone operating within their territory. UN sanctions are binding on every member state through domestic implementation. MAS and AUSTRAC sanctions apply to firms regulated by those authorities and to nationals globally. Multi-jurisdictional firms typically face overlapping obligation exposure — being subject to OFAC, EU, UK, MAS and UN simultaneously is common in the major financial centres.
Update cadence. OFAC and OFSI publish updates as designations occur — often same-day. The EU list updates on a roughly weekly cadence following Council Regulation amendments. UN list updates are typically slower (weeks). MAS and AUSTRAC update as Singapore and Australia respectively implement new designations. Production screening programmes must ingest updates within hours of publication, not at the next periodic refresh — between publication and ingestion, the firm is technically screening against a stale list.
Format and machine-readability. OFAC, OFSI, the EU and AUSTRAC all publish machine-readable feeds (XML and/or CSV) with structured fields for names, dates of birth, addresses, vessel identifiers and other matching attributes. The UN list publishes XML with parallel coverage of the various sanctions committees. Quality of structured data varies — name transliterations, aliases and date-of-birth precision differ across lists, requiring careful matching configuration to avoid both false positives and missed matches.
Building a Multi-List Screening Programme
A defensible multi-list programme is built around the firm's obligation exposure, not around vendor convenience. The starting point is mapping which lists apply to which parts of the business — that determines the screening scope.
Map Obligation Exposure
For each business line, identify the applicable sanctions regimes: which jurisdictions the firm operates in, which currencies it clears in, which counterparties it transacts with, which technologies it uses. A Singapore-regulated firm clearing USD payments through correspondent banks faces MAS, UN and OFAC exposure simultaneously. An EU fund administrator with UK investors faces EU, UN and OFSI. Document the mapping; it is the first thing a supervisor will ask to see.
Define Screening Scope
Decide what gets screened against which list. Customers, beneficial owners and directors should be screened against every applicable list. Counterparties on transactions should be screened — for cross-border payments this means screening the originator, beneficiary, and any intermediary parties named in the payment message. Internal employees and vendors generally also fall in scope. Specialist categories (vessels for trade finance, aircraft for asset finance, ports for shipping exposure) need explicit decisions.
Configure Matching Thresholds Per List
Different lists warrant different match thresholds. OFAC matches typically warrant lower thresholds (more sensitivity, more false positives, more analyst review) because the consequence of missing an OFAC hit is more severe than for a less prescriptive regime. List-level threshold configuration also handles the data quality variation — UN lists with detailed dates of birth allow stricter matching than lists where DOB is often absent.
Establish Alert Handling SLAs
Match alerts should be reviewed and dispositioned within defined service-level windows — typically same-day for high-priority lists (OFAC, UN terrorism), with longer windows for lower-priority lists at the firm's discretion. Onboarding flow alerts should block the relationship until cleared; transaction alerts should pause the transaction. Document the SLA and the escalation path; both will be inspected.
Build Deduplication and Conflict Resolution
The same individual often appears on multiple lists. A clean programme deduplicates at the entity level — a single match against Ivan Petrov surfaces once with the list memberships attached, not five times as separate alerts. Where data conflicts between lists (different spellings, different DOBs, different addresses), the programme should record both versions and use the broader match attributes for screening.
Document the Methodology
Regulators inspect documentation more closely than they inspect technology. The programme document should describe which lists are screened, against which customer populations, at what frequency, with what matching configuration, with what alert disposition standards, and with what oversight. Quarterly reviews of the methodology — and explicit sign-off when changes are made — are expected practice.
Common Mistakes in Multi-List Coverage
Six failure modes appear repeatedly in regulatory enforcement actions and inspection findings.
- Screening customers but not counterparties. Payment message screening is the most consistently inspected gap. A customer might pass screening at onboarding, but if the firm does not screen the parties they pay or receive from, the gap is material.
- Using a single match threshold across all lists. Treating OFAC, UN, EU and OFSI with identical match configuration ignores the materially different consequences of misses on each.
- Treating UK and EU as equivalent post-Brexit. The lists overlap heavily but diverge in meaningful cases. A firm with both UK and EU obligation exposure must screen both lists independently — not one as a proxy for the other.
- Missing intra-day updates. Daily batch screening introduces a window during which the firm is screening against stale data. For high-priority lists, real-time or near-real-time ingestion is the expected standard.
- Not screening for ownership or control. OFAC's 50% rule and equivalent provisions in other regimes require screening of the underlying ownership of customer entities, not just the entity name itself. Programmes that only screen the customer name miss the entire UBO-based sanctions exposure.
- No retrospective screening when lists update. A new designation today may match an existing customer onboarded last year. The screening programme must rescreen the existing customer base when lists update — covered in detail in our watchlist rescreening guide.
Automating Multi-List Screening
Manual multi-list screening at any meaningful scale is unsustainable. A modern sanctions screening platform automates list ingestion (real-time updates from every major regime), entity matching (fuzzy name matching with transliteration support, DOB matching, and structured attribute comparison), alert routing (list-specific SLA enforcement and analyst routing), and audit trail (every alert disposition recorded with reasoning and the data used).
The objective of automation is not to remove analyst judgement — it is to focus analyst time on the cases that warrant judgement. A platform that auto-clears clear-cut matches and surfaces only the ambiguous cases produces dramatically better outcomes than one requiring shallow analyst review of every alert. For the broader compliance context, see our overview of AML / CFT obligations and our companion guide to PEP screening best practices.
Multi-List Screening, Built for Production
One Constellation screens against OFAC, UN, EU, UK HMT, MAS, AUSTRAC and 80+ other lists in real time — with list-specific matching, deduplication, and audit trails regulators accept.
