Common OFAC compliance mistakes

The frequent errors teams make with sanctions screening, and how to avoid each one.

TL;DR

TL;DR: Common mistakes include screening only at onboarding, failing open on outages, and using stale lists. Each has a simple fix.

Screening only at onboarding

A one-time check when a customer signs up does nothing for a counterparty added to the SDN List later, or for a new wallet used mid-relationship. OFAC liability attaches at the moment of the transaction, so screening must run before every payment. sanctionsai.dev returns ALLOW or BLOCK in under 100 ms, making per-payment checks practical.

Failing open on outages

When screening is down, some systems let payments through to avoid downtime. That is the most dangerous default, because it converts an outage into a violation with penalties starting at $356,000 per violation. Design the gate to stop payments when screening is unavailable.

Using stale lists

Checking against a list that was current months ago misses new designations. Prefer live, synced data. The sanctionsai.dev feed is synced hourly from 16 jurisdictions, covering 19,218 SDN names and 947 OFAC-listed crypto wallets, so results reflect the list as it stands now rather than as it once was.