Sanctions screening is a mandatory compliance control that verifies every customer, merchant, and transaction counterparty against government-issued watchlists before allowing financial activity to proceed. For payment businesses — from ecommerce platforms to payment facilitators — it sits at the foundation of a compliant onboarding and transaction processing stack. Failure to implement it correctly exposes operators to some of the most severe financial penalties in the regulatory landscape.
How Sanctions Screening Works
Sanctions screening is a multi-step process that begins the moment a new customer or merchant enters your system and continues with every financial interaction thereafter. Modern screening engines run these checks in milliseconds, making real-time decisioning possible without degrading checkout conversion.
Data Collection
List Selection
Fuzzy Name Matching
Match Review and Scoring
Decision and Action
Continuous Rescreening
Why Sanctions Screening Matters
The financial and legal stakes of sanctions non-compliance are among the highest in the payment industry. Regulators have made clear through enforcement actions that neither volume of transactions nor technological complexity is an acceptable excuse for screening failures.
OFAC enforcement actions in the US totalled over $1.3 billion in penalties between 2019 and 2023, with individual cases involving payment processors reaching into the hundreds of millions of dollars. Notably, OFAC applies a strict liability standard — a business can be held liable for a sanctions violation even if it had no knowledge that a sanctioned party was involved. This means that "we didn't know" is not a defense, making automated real-time screening a legal prerequisite rather than a risk management option.
Globally, the picture is equally demanding. The EU's sanctions enforcement regime was significantly tightened after 2022, with member states required to introduce criminal penalties for serious violations. In the UK, the Office of Financial Sanctions Implementation (OFSI) can impose monetary penalties of up to £1 million or 50% of the breach value, whichever is higher. For cross-border payment platforms serving customers across multiple jurisdictions, the compliance surface area compounds rapidly.
Beyond direct penalties, a single high-profile sanctions breach can trigger correspondent banking termination — effectively cutting a payment business off from the rails it needs to move money. The reputational damage from that outcome is often more damaging than the fine itself.
Strict Liability Standard
Sanctions Screening vs. Transaction Monitoring
Sanctions screening and transaction monitoring are both core compliance controls but serve distinct purposes. Understanding the difference is critical when designing a compliance stack.
| Dimension | Sanctions Screening | Transaction Monitoring |
|---|---|---|
| Purpose | Identify prohibited parties and block access | Detect suspicious behavioral patterns |
| Trigger | At onboarding and each transaction | Ongoing, based on activity thresholds |
| Output | Hard block or freeze | Suspicious Activity Report (SAR) for investigation |
| Legal basis | Sanctions regulations (OFAC, EU, UN, UK) | AML regulations (BSA, AMLD, POCA) |
| Latency requirement | Real-time (milliseconds) | Near-real-time to batch acceptable |
| False positive tolerance | Very low — must not miss genuine hits | Moderate — investigation can clear flags |
| Applies to | Identity of counterparties | Patterns of transactions |
Both controls are required for a compliant program. Sanctions screening without transaction monitoring leaves behavioral financial crime undetected. Transaction monitoring without sanctions screening leaves prohibited parties in your system.
Types of Sanctions Screening
Several distinct screening variants exist within the broader sanctions compliance framework. Payment businesses typically need multiple types running simultaneously.
Name Screening is the most common form: checking customer and merchant names against watchlists at onboarding. It is the baseline requirement across virtually all jurisdictions.
Real-Time Payment Screening extends name checks to each individual transaction, verifying sender, receiver, and intermediary details before funds move. This is mandatory for wire transfers under FATF Recommendation 16 (the Travel Rule).
Politically Exposed Person (PEP) Screening is technically distinct from sanctions screening but often run through the same infrastructure. PEPs are not prohibited parties, but they require enhanced due diligence due to elevated corruption risk.
Adverse Media Screening supplements formal lists by checking news and public records for negative coverage linked to financial crime, which may appear before a formal sanctions designation is issued.
Beneficial Ownership Screening checks not just the named customer but the ultimate beneficial owners behind corporate entities — a critical control since sanctioned individuals frequently use shell companies to access financial services.
Best Practices
For Merchants
If you operate an ecommerce platform or marketplace that accepts payments from global customers, sanctions screening obligations may apply to you directly — especially if you are a payment facilitator or process your own payouts. Work with your payment provider to confirm which screening obligations they cover and which remain your responsibility. Collect complete identity data at checkout — truncated names or missing addresses degrade screening accuracy and create compliance gaps. Document your screening policy and retain records of every screening decision, including cleared false positives, for a minimum of five years.
For Developers
Integrate screening via API at the moment of user account creation, not at the moment of the first transaction — pre-onboarding screening is cleaner to implement and avoids the need to claw back funds already credited. Build idempotent screening calls with retry logic, since list provider APIs can experience latency during bulk update events. Implement a webhook or event-driven architecture for rescreening triggers so your system responds automatically when your vendor pushes list updates rather than relying on scheduled batch jobs that may lag by hours. Log every screening request and response with a timestamp, the list version checked, and the match score — this audit trail is what regulators will ask for first.
API Integration Tip
Common Mistakes
Screening only at onboarding. New additions to sanctions lists mean a customer who was clean at signup can become a prohibited party next week. Without continuous rescreening, you have no way to detect this until a transaction triggers a manual review — if it ever does.
Relying on exact-match name logic. Names on sanctions lists are transliterated from Arabic, Cyrillic, Chinese, and other scripts, and appear in multiple variant spellings. An exact-match engine will miss "Mohammed" if the list entry reads "Muhammad." Fuzzy matching is a compliance requirement, not a nice-to-have.
Conflating sanctions screening with anti-money laundering compliance. AML programs detect suspicious behavior; sanctions programs block prohibited identities. They have separate legal bases, separate reporting chains, and separate operational workflows. Building a single combined "compliance check" without distinguishing them creates audit exposure.
Ignoring beneficial ownership. Screening only the named account holder while ignoring the ultimate beneficial owners of a corporate entity is a well-documented evasion method. Regulators explicitly expect UBO screening, and enforcement actions have targeted platforms that missed sanctioned individuals behind shell structures.
Failing to document false positive dispositions. Every time your team clears a false positive match, that decision must be recorded with the analyst's name, the rationale, and the supporting evidence. Undocumented clearances look identical to missed hits in an audit — regulators cannot distinguish between "we checked and cleared it" and "we never noticed."
Sanctions Screening and Tagada
Tagada is a payment orchestration platform that routes transactions across multiple payment providers. Because orchestration sits in the transaction flow between merchants and processors, the question of which party owns the sanctions screening obligation is operationally significant.
Tagada and Compliance-Ready Routing
When you route payments through Tagada, work with your compliance and legal team to map which entity in the payment chain holds the screening obligation for each transaction type. For card payments, the acquiring bank typically performs screening. For payouts and disbursements, the obligation may sit with the platform initiating the transfer. Tagada's routing configuration should reflect these boundaries explicitly so there are no gaps in screening coverage across your payment stack.