Sanctions Screening 101: OFAC, UN, and EU Lists, and How CBI Programs Actually Check Them

Sanctions screening sounds like one database query. It is not.

A citizenship-by-investment file can be checked against a United States list, a United Nations list, a European Union list, national lists, law-enforcement information, adverse-media sources, and commercial risk databases. Some names overlap. The legal measures, identifiers, ownership rules, and reasons for listing do not.

That distinction matters because a “hit” is not one thing. It may be an exact match to a listed person, a fuzzy name candidate, an entity owned by blocked persons, a wallet address published in a sanctions record, a counterparty several transactions away, or another human being with the same name.

The lazy view is that a clean passport scan should settle the question. The opposite lazy view is that any wallet exposure or approximate name match should end the file. A credible review does neither. It screens broadly, resolves identity carefully, applies the relevant legal measure, and records why the candidate was cleared or escalated.

For a Bitcoiner, the important preparation is to understand which facts the chain proves, which facts a list proves, and where a compliance analyst still has to connect them.

Three Systems, Not One Master List

The United States Treasury’s Office of Foreign Assets Control administers multiple sanctions programs. Its Sanctions List Search tool searches the Specially Designated Nationals and Blocked Persons List and a consolidated set of non-SDN lists. Those lists do not all impose the same consequence. An SDN blocking measure is not interchangeable with a sectoral or menu-based restriction.

The United Nations Security Council Consolidated List combines individuals and entities designated under multiple Security Council sanctions regimes. The UN explains that inclusion in one consolidated file does not mean every entry is listed under the same regime or under the same criteria. Member states implement the measures attached to the relevant regime through their own legal systems.

The European Union maintains its own restrictive measures. The European Commission’s sanctions overview explains that some EU regimes implement UN measures and others are autonomous EU measures. Its consolidated financial-sanctions list reflects officially adopted texts published in the Official Journal of the EU and is updated when necessary.

These sources overlap because allied authorities may target the same person or entity. They also diverge. A person can appear on one list and not another. A name can carry an asset freeze under one regime and a different restriction under another. The legal effect depends on the law binding the actor making the decision.

A CBI authority is not transformed into OFAC, the UN, or an EU regulator by checking those sources. It uses sanctions information as one input into eligibility, security, reputational, and financial-crime review under its own program law. The authority’s question may be broader than whether a particular transaction would be lawful for a United States or EU person.

A sanctions result is not resolved by the color of the alert. Resolve the person, the list, the legal measure, the ownership, and the transaction.

How A Name Becomes A Candidate

Sanctions records contain more than a primary name. They can include aliases, alternative spellings, original-script names, dates and places of birth, nationalities, passport numbers, national identifiers, addresses, occupations, associated entities, and listing dates.

Screening systems compare the applicant’s data with those fields. Exact matching alone would miss transliterations, reordered names, spelling variations, typographical errors, and incomplete records. Broad matching finds more genuine risks, but it also creates false positives.

OFAC makes the mechanism unusually transparent. Its search FAQ says fuzzy logic applies to the name field and uses character, string, and phonetic matching. Other fields use character matching. A score therefore ranks similarity; it does not decide that the applicant is the listed person.

The UN list itself distinguishes stronger and weaker aliases. It labels some aliases as good quality and others as low quality, with the latter probably insufficient alone for positive identification. That is the correct mental model for every screening candidate: a name opens the inquiry, while secondary identifiers resolve it.

For an individual, compare full legal names, prior names, scripts and transliterations, birth date, birthplace, nationality, passport and national-ID numbers, address history, occupation, employers, and known associations. For a company, compare registration number, jurisdiction, addresses, former names, directors, owners, and business activity.

Do not manipulate spelling to avoid a result. Provide every name form used in passports, identity cards, corporate records, professional history, and material public records. An omitted alias that later surfaces creates a disclosure problem even when the underlying match is false.

Listed Entity Does Not End At The Name

Sanctions exposure can extend beyond an entity expressly printed on a list. Ownership is a separate screen.

Under OFAC’s 50 Percent Rule, an entity is considered blocked when one or more blocked persons own, directly or indirectly and in the aggregate, 50 percent or more of it. OFAC urges appropriate due diligence on ownership stakes. Control without the required ownership is not automatically the same result under that specific rule, although OFAC may separately designate the controlled entity and other legal regimes may apply different tests.

This is why an applicant’s company chart cannot stop at the immediate shareholder. A reviewer may need the natural persons behind holding companies, trusts, family vehicles, funds, or nominees. The question is not only whether the applicant’s own name appears. It is whether a listed person owns the entity, whether a restricted counterparty participated in a transaction, and whether the payment path touched property subject to a measure.

Do not reduce that review to a universal percentage rule. The OFAC rule is an OFAC rule. EU measures and national implementation can use their own ownership and control analysis. A program’s eligibility standard can also be more conservative than the minimum needed to establish a legal prohibition.

Map each entity to the natural people who ultimately own or control it. Preserve registers, constitutional documents, shareholder agreements, trust records, and dated changes. If a former owner or director is relevant, show the exact separation date and the records establishing it.

How CBI Programs Check In Practice

No public source reveals every query, vendor rule, confidence threshold, or intelligence channel used by every citizenship program. Claims of a universal secret checklist should be treated skeptically.

The best public description is structural. The joint FATF and OECD report on misuse of CBI and residency programs recommends multi-tier vetting in which the licensed agent, program agency, and relevant third parties conduct customer due diligence independently rather than relying blindly on the prior layer. It identifies identity verification, adverse-media searches, professional background checks, source-of-wealth review, source-of-funds review, and interviews as useful controls.

Sanctions screening fits inside that architecture. The agent collects complete identity and ownership data. A specialist provider or database may generate candidates. The program authority or another competent body evaluates the file under national law. A bank or settlement provider runs its own legally required checks on the account and payment. A clean result at one layer does not bind the next.

The source list should reflect the program’s legal and operational exposure. OFAC, UN, and EU sources are prominent because of their reach and data quality. National lists, immigration alerts, law-enforcement channels, and other partner-country information may also apply. Commercial databases can aggregate and refresh information; they do not become the legal source merely because their interface produced the alert.

Timing matters. Lists change during long reviews. The UN publishes list updates, the EU changes its consolidated data when legal acts are adopted, and OFAC tells users to check regularly because sanctions programs change frequently. A responsible process can screen at intake, before submission, during review, and before settlement or approval. The exact cadence belongs to the authority and participating institutions.

Bitcoin Adds An Address Layer

Sanctions records can include digital-currency addresses. OFAC FAQ 594 says its search tool can query a digital-currency address through the ID-number field. Unlike its fuzzy name search, that field returns exact matches.

An exact match to a published address is important. It still needs the correct legal analysis. Confirm the asset, address format, list entry, program, designation date, and transaction chronology. An address reused across chains or tokens can create technical confusion if the analyst does not identify the network.

Most blockchain alerts are not exact list matches. Analytics providers may identify exposure through transaction paths, clusters, services, or attribution data. A transaction one or more steps from a listed address is not the same factual proposition as the applicant controlling that address. Distance alone does not establish ownership, knowledge, intent, or a legal violation.

It can still generate a legitimate question. The reviewer may ask which exchange, broker, mining pool, merchant, customer, or over-the-counter counterparty created the exposure; whether the transaction occurred before or after designation; whether the applicant controlled both sides; and whether funds were rejected, blocked, frozen, or reported.

OFAC’s virtual-currency compliance guidance recommends screening customer information at onboarding, screening transactions for physical and digital wallet addresses and other links, using fuzzy logic for name variations, and conducting ongoing or risk-based re-screening as information and lists change. That guidance addresses virtual-currency industry compliance. It does not declare every indirect on-chain connection prohibited.

Build the Bitcoin file from transaction IDs, wallet addresses, proof of control where safe and appropriate, exchange or broker records, invoices, counterparty information, and a plain-language transaction map. Mark exact facts separately from analytics attribution and inference. Our Bitcoin source-of-funds guide covers that reconstruction in depth.

Resolve A False Positive With Identifiers

A false positive is not cleared by writing “not me.” It is cleared by showing why the listed record and applicant cannot describe the same person.

Begin with the strongest contradictions. A different full date of birth, passport number, nationality history, birthplace, or documented location can outweigh a similar name. Occupation, company, family relationship, photograph, and address history may add support.

Create a short comparison table with four columns: identifier, applicant, listed record, conclusion. Cite the current official list entry and attach certified identity records where required. If the official entry lacks enough data to exclude the match, say that. Do not invent certainty.

A transliteration match needs special care. Record the applicant’s name in original script, every official Latin rendering, prior passports, patronymics, and the transliteration standard used where known. A one-letter difference is weak evidence when both names are plausible renderings of the same script.

If the person or company is a true match but the applicant believes a listing is wrong, outdated, or eligible for removal, that is a sanctions-law matter. Official delisting and reconsideration procedures exist under relevant regimes. A CBI application is not the forum for privately disregarding the record. Obtain specialist counsel and disclose the issue as the program requires.

When The Counterparty, Not The Applicant, Matches

An applicant can be unlisted while a former employer, company, customer, exchange, broker, or wallet counterparty raises a result. The file then turns on relationship, ownership, timing, transaction, and applicable law.

State the role precisely. Identify dates, authority, ownership percentage, payment flows, and the applicant’s knowledge at the relevant time. Separate employment from control, minority investment from management, and a one-time customer payment from an ongoing relationship.

Designation dates matter, but they are not a universal safe harbor. A transaction before a public listing may still be relevant to source of wealth, criminal-risk, or program-integrity review. A later transaction may require sanctions analysis even if it was automated or passed through an exchange. Do not reach a legal conclusion from the timestamp alone.

Preserve the evidence that existed at the time: contracts, invoices, account records, compliance correspondence, withdrawal data, wallet transactions, corporate records, and any rejection or freeze notice. Ask qualified counsel whether a report, license, blocking obligation, or other action applies. Never move assets to defeat a review or obscure the counterparty.

Pre-screen Before The File Moves

Collect the identity matrix first: names, scripts, aliases, birth data, citizenships, residences, passports, national identifiers, companies, directorships, beneficial ownership, and material counterparties. Run the current official sources, not a saved list from the start of the year.

For each candidate, record the list, entry identifier, regime, match score if relevant, matching fields, conflicting fields, review date, source URL, analyst conclusion, and approval. Re-run material candidates before submission and settlement. Preserve the version reviewed because lists and identifiers change.

Screen the transaction path separately from the person. Identify exact published wallet matches, vendor-attributed clusters, indirect exposure, and unknown services as different categories. A single red label should never collapse those facts.

Do not contact a listed person, move property, or attempt a test transaction to investigate an alert without specialist advice. Do not assume that a non-United States applicant can ignore OFAC, that a non-EU program can ignore EU measures, or that a clean result on all three removes national or program-specific risk.

The companion article on commercial risk databases beyond World-Check explains how commercial data differs from official sanctions sources. Neither category replaces the other.

A paid Sovereignty Strategy Session gives you one hour with Adam Juchniewicz, CEO, to identify sanctions, ownership, counterparty, and wallet-screening questions before a government file exists. It is $475 through BitSettle or $500 through Stripe, and the amount paid credits toward professional fees if you retain 21 CBI within 90 days. Book through advisory; there is no obligation to proceed.

Screen the name. Resolve the match. Document the Decision.

This article is general information, not legal, sanctions, tax, investment, immigration, or compliance advice. Sanctions lists, legal measures, ownership tests, screening thresholds, program procedures, and reporting duties vary and change. Confirm current official sources and obtain qualified sanctions counsel before acting on a match or transaction.