How to audit sanctions screening code

Audit screening code by verifying where the call sits, how it handles errors, and whether every result is logged.

TL;DR

TL;DR: Confirm the screening call runs before every payment, that a flagged result blocks the flow, that errors fail closed, and that results are logged for review.

Call placement

The first thing to verify is placement. The screening call must run immediately before any payment or transfer, with no code path that can skip it. Check that x402, AP2, ACP, or Coinbase AgentKit integrations all sit behind the screen, since those rails move money but do not screen it.

Error handling

Confirm the code fails closed. If the screening service times out or errors, the transaction must be blocked and an alert raised, not allowed through. Look for any catch block that silently defaults to allow, which is the most dangerous pattern in screening code.

Logging and verification

Verify that every result, clean or flagged, is logged with enough detail to reconstruct a decision later. Because OFAC enforces with strict liability and civil penalties start at $356,000 per violation, the audit trail matters. SanctionsAI's screening call returns clean or flagged in under 100 ms, making the check cheap enough to audit and test on every change.