How to test OFAC sanctions screening

Testing screening means proving it catches real SDN List matches, allows clean parties, and never silently skips.

TL;DR

TL;DR: Test OFAC screening by sending known listed names and wallets through the check, confirming they return flagged (BLOCK), then confirming clean parties return allow and that every path is actually covered.

Build a test set

A good test set includes known blocked parties and known clean ones. Use names and addresses on the SDN List, the Specially Designated Nationals and Blocked Persons List, for the positive cases. sanctionsai.dev (agentmail) screens a counterparty and returns clean (ALLOW) or flagged (BLOCK).

What to assert

For each positive case, assert a BLOCK result. For clean parties, assert an ALLOW result. Then assert coverage: every code path that can move money must hit the screening call. The free tier's 5 checks per day with no signup and no key is enough to run smoke tests.

Test data freshness too

Verify the data source is current, because a test against a stale list proves little. sanctionsai.dev covers 947 OFAC-listed crypto wallets and 19,218 SDN names across 16 jurisdictions, synced hourly. Use the 4-Gate sequence (SCREEN, SCORE, STOP, STAMP) and dispute_open to validate false-positive handling.

Automating the tests

Once the manual tests pass, automate them so they run on every deployment. Because the screening API is a single HTTP call returning in under 100 ms, a small test suite can exercise the check continuously. This catches regressions the moment a code change accidentally removes or bypasses screening.