Sanctions Compliance Procedure Template (OFAC, EBA/GL/2024/14, OFSI)

Sanctions Compliance Procedure: [Institution name]

Operating procedure for screening customers, related parties and payments against applicable sanctions lists, managing those lists, calibrating fuzzy matching, handling alerts, escalating potential matches, blocking or freezing assets, rejecting transactions and reporting to the authorities. It follows the five components of the OFAC "A Framework for OFAC Compliance Commitments" (May 2019), the EBA Guidelines EBA/GL/2024/14 and EBA/GL/2024/15 on internal policies, procedures and controls for Union and national restrictive measures (apply from 2025-12-30), the EU sanctions regulations cited by number, and HM Treasury OFSI "UK financial sanctions general guidance" (updated 2026-05-12). Replace every [bracketed] value and every row marked Example. Obtain the regulation or guidance for the normative text, and check the consolidated version before use. This is a document format, not legal, compliance or financial advice.

Document control

Approvals

Revision history

Contents

• 1. Purpose, scope and legal basis
• 2. Governance, roles and responsibilities
• 3. Link to the exposure assessment
• 4. Lists and list management
• 5. Screening scope and timing
• 6. Matching configuration and calibration
• 7. Alert handling and escalation
• 8. Ownership and control checks
• 9. True matches: blocking, freezing, rejecting and reporting
• 10. Licences, exemptions and delisting
• 11. Breaches, root causes and disclosure
• 12. Testing, quality assurance and tuning
• 13. Training
• 14. Record keeping
• 15. Management information
• 16. Traceability matrix
• 17. Glossary and references
• Standard and licence note

1. Purpose, scope and legal basis

This procedure tells staff how [Institution name] makes sure it never makes funds or economic resources available to a designated person, freezes what it already holds for them, and respects sectoral restrictions such as investment, financing, export and service bans. It covers onboarding, ongoing customer screening, payment screening, trade finance, securities and any other channel identified in the exposure assessment. It applies to every employee, contractor and outsourced service provider that performs a screening or alert review step on behalf of the institution.

Sanctions obligations are strict: a breach can occur without intent, and an alert closed wrongly is a breach the moment the payment leaves. For that reason the procedure prefers a delayed payment over an unchecked one, and it requires a documented decision for every alert.

1.1 Regimes in scope (as of 2026-10, check local law)

1.2 Legal and supervisory basis

2. Governance, roles and responsibilities

The management body approves this procedure and receives the sanctions management information described in section 15. It appoints a senior staff member in charge of restrictive measures compliance who has direct access to the management body, enough staff and systems, and the authority to stop any transaction or relationship. At Fernhollow Bank this is the Chief Compliance Officer, supported by a Head of Sanctions; the New York branch has its own designated sanctions compliance officer who reports to the same Head of Sanctions and locally to the branch manager.

Business lines own the first-line controls: they collect complete customer and payment data, they never split, reformat or strip data to avoid an alert, and they hold any transaction that the screening system stops until compliance releases it. Payments Operations runs the filters and the queues. The Sanctions team in Compliance reviews level 2 alerts, decides true matches and files reports. Internal Audit tests the whole process independently.

R = responsible, A = accountable, C = consulted, I = informed.

3. Link to the exposure assessment

The restrictive measures exposure assessment (compliance/sanctions-exposure-assessment) identifies where the institution could fail to implement a measure and where customers could use it to circumvent one. This procedure must answer every exposure rated High or Medium in that assessment. When the assessment changes, the Head of Sanctions reviews sections 5, 6 and 12 within [30] days and records any change in the revision history.

4. Lists and list management

The institution screens against the official lists named in section 1.1, received through [vendor name] and checked against the official publication. The list owner in Payments Operations confirms each update, and the Sanctions team performs a reconciliation sample. EU designations take effect on publication in the Official Journal, often the same day the Council adopts them, so the target time for an update must be measured in hours, not days.

Each new designation triggers a rescreen of the whole customer base and of pending payments and standing orders. A good-guy list entry is allowed only when the analyst has documented why the customer is not the listed person (for example a different date of birth and nationality). The entry names the list entry it suppresses, and it is reviewed every time that list entry or the customer's data changes. Never suppress a whole list entry for all customers.

5. Screening scope and timing

5.1 Customers and related parties

Screen every customer before the relationship starts and before any service is provided. Screen beneficial owners through ownership and through control, directors, authorised signatories and anyone acting on the customer's behalf. Rescreen the full customer base whenever a list changes, and screen an individual customer again when its name, address, nationality, ownership or business activity changes.

The minimum data screened for a natural person is full name (in the original script and transliterated) and date of birth; for a legal person, the registered name, trade names and former names. Add nationality, address and identification numbers so that analysts can discount false positives quickly.

5.2 Payments

Screen every outgoing, incoming and intermediated payment before funds are made available to the payee. Screen all parties and agents, including intermediary and correspondent banks by name and BIC, the payment purpose and remittance free text, and addresses. For trade related payments, also screen goods descriptions, ports, vessels and countries of origin and destination where the data is available.

ISO 20022 messages improve screening quality because each party has its own element and structured addresses separate town and country from the street. Map every element you screen and keep the mapping under change control; details of the canonical model and the CBPR+ address rules are in the ISO 20022 Payments Design (industry/iso20022-payments-design). Swift deferred the end of fully unstructured postal addresses in CBPR+ (first set for 2026-11-14) on 2026-08-27; check the current Swift CBPR+ usage guidelines for the new date before planning the switch.

In euro instant credit transfers, Article 5d of Regulation (EU) No 260/2012 lets a payment service provider rely on screening its own customers at least daily (and immediately after a new designation) instead of screening each instant payment. Fernhollow Bank applies customer-based screening for SEPA Instant and keeps transaction screening for all other instant schemes. Confirm the dates that apply in your Member State.

5.3 Trade finance, securities and other products

Screen all parties named in letters of credit, collections and guarantees, including shipping companies, vessels by IMO number, ports and goods. For securities, screen issuers against sectoral lists, and screen custody holdings whenever a list changes. For loans, screen guarantors and collateral providers. Record products that are out of scope and the reason.

6. Matching configuration and calibration

6.1 Matching techniques

The screening engine combines exact matching for identifiers (BIC, IMO number, passport number), fuzzy name matching for names and addresses, and keyword matching for free text. Fuzzy matching should handle spelling variation, transliteration, phonetic similarity, missing or extra name parts, swapped word order, initials, honorifics and joined or split words. Country and city names need alias tables (for example local-language spellings) because a program name hidden in an alternative spelling is a well-documented root cause in OFAC enforcement actions.

6.2 Threshold settings (examples)

Scores below are percentages on the engine's own scale. They are illustrative starting points, not recommended values; each must be set from your testing in section 12.

6.3 Calibration method

Calibrate before a new engine goes live, after any material change to lists, data or algorithm, and at least annually. Build a test file from real list entries with controlled variations (typos, dropped names, transliteration, reordered tokens, abbreviations, added noise), run it at several thresholds and record the detection rate and the false positive volume on a copy of production data. Set the threshold no higher than the highest value that still detects every test variant judged material. If the alert volume at that threshold exceeds review capacity, add reviewers or improve data quality and secondary identifiers (date of birth, nationality, registration number); do not raise the threshold above the detection limit to save effort. Record the decision, the test results and the approval in the calibration log.

6.4 Change control

Every change to a threshold, rule, good-guy list logic or field mapping needs a ticket, a test result, and approval by the Head of Sanctions. Emergency changes are allowed only to make screening stricter. Keep the before and after configuration so that an examiner can reconstruct the settings in force on any date.

7. Alert handling and escalation

Level 1 reviewers compare the alert against the listed entry using the secondary identifiers available: date of birth, nationality, address, registration number and the counterparty's business. They close an alert only when the evidence clearly shows a different person, and they record which identifiers differ. Anything else goes to level 2. Level 2 reviewers may request information from the customer or the remitting bank, but they must not tell the customer which list or which person caused the hold. A payment stays held while information is requested; it is never released on a promise to send documents later.

When a match remains unresolved after due diligence, the payment is not executed and the case goes to the Head of Sanctions, who may consult the national competent authority. Higher-exposure situations (for example any alert involving a sanctioned jurisdiction) need two people to agree before release.

Reason codes are limited to a controlled list: different date of birth, different nationality, different entity type, different registration, good-guy list, list entry delisted, and true match. "Customer known to us" is not a reason code.

8. Ownership and control checks

An entity that is not listed can still be subject to an asset freeze because a designated person owns or controls it. Use beneficial ownership data, corporate registers and commercial ownership data to identify such entities, and document the analysis in the customer file. The detailed tests and a worked example sit in the exposure assessment (compliance/sanctions-exposure-assessment, section 9).

9. True matches: blocking, freezing, rejecting and reporting

When a true match is confirmed, act at once. Under EU and UK asset freezes, the institution freezes the funds and does not make funds available to the designated person. Under OFAC programmes, property of a blocked person that comes within US jurisdiction is blocked and placed in a blocked, interest-bearing account where required, while transactions that are prohibited but involve no blocked property interest are rejected. Never return funds to the originator unless the applicable law or a licence allows it.

A sanctions match is not by itself a suspicion of money laundering, but circumvention attempts, false documents or structuring around the filter often are. The Head of Sanctions informs the MLRO of every true match and every circumvention concern, and the MLRO decides on a suspicious activity or transaction report (compliance/sar-str-narrative). Tipping-off rules apply to that report even when the sanctions report itself is not confidential.

10. Licences, exemptions and delisting

Frozen or blocked funds may only be released or used under a licence, authorisation or general exemption issued by the competent authority, or after a delisting. The Sanctions team verifies every licence with the issuing authority, records its scope, conditions and expiry, and sets a reminder before expiry. A specific licence covers only the acts it names. When a person is delisted, confirm the delisting in the official publication, update the lists, remove good-guy entries that referenced the entry, and release funds only after legal review of any remaining designation under another regime.

11. Breaches, root causes and disclosure

A potential breach is any case where funds or services may have reached a designated person, a freeze was applied late, or a sectoral restriction was not respected. The Head of Sanctions opens a breach record the same day, informs the senior staff member and Legal, and decides with Legal whether to notify the authority. In the EU, violations of restrictive measures are criminal offences under national laws transposing Directive (EU) 2024/1226. For US matters, OFAC weighs a voluntary self-disclosure and an effective compliance programme as mitigating factors under its Economic Sanctions Enforcement Guidelines. In the UK, OFSI expects prompt voluntary disclosure.

Use the root cause categories that OFAC drew from past enforcement actions as a checklist: no formal programme; misreading which regulations apply; facilitating by non-US persons or affiliates; re-exporting US-origin goods; using the US financial system for sanctioned business; screening software or filter faults; inadequate due diligence on customers and ownership; decentralised and inconsistent compliance; non-standard payment or commercial practices; and individual liability. Name the cause in each breach record so trends show up in management information.

12. Testing, quality assurance and tuning

Testing has four layers. First, list testing confirms that each list loaded completely and on time. Second, matching testing runs the controlled-variation file from section 6.3 against each list and field. Third, data testing confirms that every source system sends complete fields to the engine (no truncated names, no dropped intermediary agents) using reconciliations between source and engine counts. Fourth, quality assurance re-reviews a sample of closed alerts each month to check decisions and evidence.

Internal Audit or an independent party tests the whole programme at least annually as part of the AML independent test (compliance/aml-independent-test-report). For the New York branch, filtering programme documentation and test evidence support the annual Part 504 compliance finding due by 15 April.

13. Training

All staff complete annual sanctions awareness training covering what sanctions are, why stripping or altering payment data is prohibited, and how to escalate. Analysts receive role training on the engine, the matching logic, research techniques and the reporting process, and refresher sessions after every major new regime or package. Relationship managers in high-exposure segments receive training on circumvention red flags such as sudden changes of trade routes, newly incorporated intermediaries and goods that do not fit the customer's business. Keep attendance, test scores and content versions.

14. Record keeping

Retain for every alert: the alert, the list entry and list version, the configuration in force, the analyst's research and decision, and any approval. Retain licences, reports and correspondence with authorities. Retention periods (as of 2026-10, check local law):

Apply the longest period that applies to a record, and make sure deletion schedules do not remove sanctions evidence early.

15. Management information

The Head of Sanctions reports monthly to the compliance committee and quarterly to the management body.

16. Traceability matrix

17. Glossary and references

References:

• OFAC, A Framework for OFAC Compliance Commitments (May 2019), ofac.treasury.gov.
• 31 CFR Part 501, Reporting, Procedures and Penalties Regulations, including Appendix A Economic Sanctions Enforcement Guidelines, ecfr.gov.
• OFAC, Revised Guidance on Entities Owned by Persons Whose Property and Interests in Property Are Blocked (2014-08-13).
• EBA, Guidelines EBA/GL/2024/14 and EBA/GL/2024/15, final report 2024-11-14, apply from 2025-12-30, eba.europa.eu.
• Council of the EU, Update of the EU Best Practices for the effective implementation of restrictive measures (doc. 11623/24, July 2024).
• Directive (EU) 2024/1226; Regulation (EU) 2023/1113; Regulation (EU) No 260/2012 as amended by Regulation (EU) 2024/886; EU regime regulations cited in section 1.2, eur-lex.europa.eu.
• HM Treasury OFSI, UK financial sanctions general guidance (updated 2026-05-12), gov.uk; UK Sanctions List, gov.uk.
• New York 3 NYCRR Part 504, Banking Division Transaction Monitoring and Filtering Program Requirements and Certifications.
• FATF Recommendations 6 and 7 (names only).

Standard and licence note

Based on the OFAC Framework for OFAC Compliance Commitments (May 2019) and 31 CFR Part 501 (US government works, public domain), the EBA Guidelines EBA/GL/2024/14 and EBA/GL/2024/15 (reproduction authorised with acknowledgement of the EBA as source), EU regulations and directives published on EUR-Lex (reuse under Commission Decision 2011/833/EU), and HM Treasury OFSI guidance and the UK Sanctions List page (contains public sector information licensed under the Open Government Licence v3.0). New York 3 NYCRR Part 504 and FATF Recommendations are cited by number only. The text, structure, examples and thresholds are original; no guideline or regulatory text is reproduced. Fernhollow Bank and all figures are fictional. Check the current official version of each source, the EU Sanctions Map and the national competent authority's guidance before use. Template licence: MIT.