KYC/AML Implementation Checklist for Small Fintech Teams
A practical KYC/AML implementation checklist for engineers asked to stand up sanctions screening with no compliance department, no budget and no vendor contract.
How to use
Straight answers first
How do I implement KYC/AML screening with no compliance team?
You do not build screening logic yourself. Use free official data (OFAC Sanctions List Search or OpenSanctions) or a cheap per-call API for the list-checking step, and spend your engineering time on the two things regulators actually examine: a written decision trail for every screen, and a documented risk assessment. Screening is one control inside a KYC/AML program — not the whole program.
What is the cheapest way to screen names against sanctions lists?
Free: OFAC's Sanctions List Search (sanctionssearch.ofac.treas.gov) for one-off lookups, and OpenSanctions (open-sanctions.org), which consolidates OFAC, EU, UN and UK lists into one searchable open database with an API. At low volume, these may be all the screening data you need. If you want an API with an audit log and no subscription, pay-per-call options exist — see the comparison below.
Is sanctions screening the same as KYC?
No. Screening is the list-checking slice: compare a name, company or wallet against sanctioned-party lists. KYC/AML is the wider program: identity verification, PEP checks, ownership verification, transaction monitoring, reporting, and the audit trail. Screening is the cheap slice; the program around it is the expensive part — which is exactly why "buy the screening, document the program" is the right split for a small team.
Phase 1 — Scope before you build
- Written one-page risk assessment: what products, which customer geographies, what payment rails (the sanctions risk assessment checklist does this step by step)
- Determine your regulatory nexus: US nexus → OFAC obligations; EU/UK/UN customers → add those lists
- Confirm whether your client or partner is already a regulated entity with a screening vendor — if they are, ask before building anything
- Decide buy vs build for each layer separately (data, matching, audit trail) — not for "KYC/AML" as one blob
- Get the resourcing gap on record in writing: what you were asked to own, what support you did not get
Phase 2 — Screening data (the cheap slice)
- OFAC SDN list as the baseline: 19,218 names, 947 digital-currency wallet addresses, 16 embargoed jurisdictions
- Free official lookups: OFAC Sanctions List Search (sanctionssearch.ofac.treas.gov)
- Free consolidated data: OpenSanctions (OFAC + EU + UN + UK in one dataset, with an API)
- Screening API with audit log if you need programmatic checks — subscription or pay-per-call (see the table below)
- Pin the list version used for every screen — you must be able to say which list version produced which answer
Phase 3 — What you actually engineer
- Screen at onboarding: legal name, aliases, company name, wallet addresses
- Screen beneficial owners, not just the company — the 50% rule blocks entities majority-owned by blocked persons even when the entity itself is unlisted (the OFAC 50% rule explained)
- Screen at transaction time for ongoing exposure, not only at signup
- Fail closed: if the screen errors or times out, the payment does not proceed
- Handle fuzzy matching: transliterations and aliases are where homemade screens miss real hits
- Named escalation path for a positive match — even if that path is "the founder calls a lawyer"
Phase 4 — The audit trail (your real deliverable)
- Every screen logged with: timestamp, subject screened, list version, result, and the decision made
- Retention: five years after the transaction date (31 C.F.R. 501.601)
- Exportable as CSV/JSON — an inquiry is answered with exports, not archaeology (see the regulator-readiness checklist)
- Pair each payment record with the screen result that authorized it
- Quarterly drill: pick one month, export the trail, verify every decision is reconstructable
Screening data options compared
| Option | Cost | Best for |
|---|---|---|
| OFAC Sanctions List Search (official) | Free | One-off manual lookups |
| OpenSanctions | Free / open data | Consolidated OFAC+EU+UN+UK screening at low volume |
| Mid-tier subscription platforms (ComplyAdvantage, SumSub, Alloy, Persona) | Monthly subscription | Onboarding flows with identity verification built in |
| Enterprise data (LexisNexis, World-Check) | Annual contract | Regulated institutions with a real program to plug into |
| SanctionsAI pay-per-call API (this site) | $0.05 per check, no subscription | A handful of documented programmatic checks, no contract — x402 quickstart |
FAQ
Which sanctions lists does a small fintech need to screen against?
It depends on your nexus. US persons must comply with OFAC, whose SDN list currently carries 19,218 names, 947 digital-currency wallet addresses and 16 embargoed jurisdictions. If you serve EU, UK or UN-jurisdiction customers, add those lists. OpenSanctions consolidates all four in one dataset.
Do beneficial owners need to be screened too?
Yes. Under OFAC's 50 percent rule, an entity owned 50 percent or more in the aggregate by blocked persons is itself blocked, even if the entity appears on no list. Screen every beneficial owner, not just the company name.
How long must screening records be kept?
OFAC regulations require records of transactions to be retained for five years after the transaction date (31 C.F.R. 501.601). Store every screening result with timestamp, subject, list version and outcome so an inquiry is answered with exports, not archaeology.
Why this exists
Small fintech teams are routinely asked to "implement KYC/AML" as an engineering ticket, with no compliance hire and no vendor budget. The honest answer is that the screening slice is cheap or free, and the program slice is mostly documentation you can produce yourself. This checklist separates the two so neither gets skipped.