OFAC screening for payment gateways

Payment gateways must screen both the merchant and the customer on every transaction against the SDN List.

TL;DR

TL;DR: A payment gateway must screen the merchant at onboarding and both merchant and customer on every transaction, then block any match, because it facilitates the payment.

Two parties, one gateway

A gateway connects a merchant and a customer and moves value between them. Both are counterparties the gateway must screen:

• Merchant: check the business name and payout account.
• Customer: check the name and funding source.

Continuous screening

An onboarding check is not enough. The SDN List updates regularly, so screen every transaction to catch a party designated after signup. OFAC applies strict liability, so intent is not required for a violation. A merchant cleared last year can be designated this week.

Controls

Run checks under 100 ms to keep checkout fast. Log every screen, and block on match. Apply the 50 Percent Rule to majority owned entities. A gateway that carries a sanctioned payment can face civil penalties starting at $356,000 per violation.

Onboarding plus per-transaction

The gateway's job is split in two: a thorough check at merchant onboarding, and a fast check on every subsequent transaction. The onboarding check is deep because it sets the baseline; the per-transaction check is fast because it runs in the checkout path. Skip either and the gap appears at the worst time, after value has already moved. The two checks complement each other, and together they give the gateway a complete record of every party it ever moved money for.