Screening means comparing the names and identifiers in a customer file or a payment against a sanctions list. Most enforcement releases about it are not about someone beating the match. They are about the match not happening, or happening and being answered wrongly. This page sorts the ways that has gone wrong in cases documented on this site into seven places. It is a sorting by where the check failed, which is a different question from the one the evasion techniques answer, namely how someone avoids being matched at all.
Seven places a check fails
1. The list is out of date. The check is only as current as the file it reads. Bank of America’s watchlist file went without an update from 24 May to 28 June 2023 because of a vendor’s error, and on 7 February 2025 failed to load the previous day’s designations because of its own systems, so 26 transactions for a designated ship manager were processed. SkyGeek screened an order on the day a customer was designated, but its software had not yet loaded that day’s update. The Bank of America case says that each organisation remains responsible for its own compliance whatever its vendor does.
2. The name does not match. String matching is a tuning problem, and the cases show failures at both ends. Citibank London did not treat the Russian corporate prefix “PAO” as the same entity as a designated “Sovcomflot”. JPMorgan’s vendor tool missed names with hyphens, initials or extra middle names for years (JPMorgan 2018). General Electric’s software screened only an abbreviation of a payer’s name, so cheques bearing the full legal name never alerted. Bank of Scotland’s system did not reconcile the character differences between a designated customer’s passport and the UK list. Pegasus Worldwide Logistics screened a shipper’s new name after the supplier’s designation and found nothing, while the phone number and email on the shipping documents were unchanged. OFAC said that screening them, even with a basic internet search, would have produced a match. Payoneer did not screen bank identifier codes at all.
3. The list does not hold the answer. A list names designated parties. It does not say who owns a company. Deutsche Bank’s London branch paid a Russian streaming company whose ownership had changed, and the screening lists it used carried no ownership data. Citibank London had told staff in 2022 not to request restrictions without evidence of 50 per cent designated ownership, a threshold the UK does not use. Interactive Brokers traded in a company while it was still working out that a designated group owned it. Microsoft’s release says its screening missed entities majority-owned by designated persons. See the 50 percent rule.
4. The alert fires and is answered wrongly. State Street manually dismissed alerts on the same payments its acquired subsidiary was redating. At PayPal, agents dismissed five alerts on one designated account without asking for more information. Interactive Brokers dispositioned one alert as a false positive and left another unactioned for more than a month (IB). Bank of America’s alert-suppression rule released a payment because an earlier alert on the same criteria had been closed as a false positive, and it ranked exact name-and-birthday matches as low or medium priority. Payoneer auto-released flagged payments in backlog periods. This group is a failure of what happens after the software has done its job. An ordinary case of it is in the UK note: Vanquis Bank’s screening alerted the morning after a designation, and the first review took eight days.
5. The check ran once. Approval at onboarding is not a decision about next year. SkyGeek’s procedure was not to re-screen parties already approved, so a refund to a customer designated in the meantime went out. Microsoft’s release says pre-existing customers were not promptly re-screened after list changes. The pattern is quick to detect from outside: ask when a customer approved today was last screened.
6. The system is outside the check. Interactive Brokers’ margin-liquidation engine never checked securities against sanctions lists. Acquired businesses kept their own systems (C.H. Robinson, Toll). Extreme Networks bought a Russian customer list that included a blocked end user, and its central review accepted the named end user. JPMorgan had no process, before 2012, to screen the members of an airline net-settlement group it cleared payments for. Colorcon’s authorisers checked amounts and payees and assumed its bank checked the bank (Colorcon).
7. The control decayed and nobody retested it. TradeStation’s two geo-blocking layers broke for unrelated reasons, and its test tool was discontinued. OFAC’s compliance framework calls testing and auditing “important tools to ensure the program is working as designed”. The technique page treats this one in detail. Payoneer shows the subtler form: it had testing, and the testing did not find the weak matching.
What the pattern suggests
Counting the places is not a statistic. The cases here are the ones this site has written up, and the sample is not random. But the placement is consistent: very few of the seven are about sophisticated concealment. Most can be seen by a person who asks a plain question of the firm.
| Ask | Failure place it tests |
|---|---|
| When was the list last loaded, and who is told when it is not? | 1 |
| What does the system do with a spelling variant, a prefix or an abbreviation? | 2 |
| Where does ownership data come from, and what does the firm do at 49 per cent? | 3 |
| Who may dismiss or suppress an alert, and who audits that? | 4 |
| When was each approved customer last screened? | 5 |
| Which systems move money or goods and do not pass through screening? | 6 |
| When was each control last tested, by someone other than its owner? | 7 |
These are the same questions OFAC’s compliance framework raises under testing and audit, and they have no technology in them.
What screening cannot do
A clean screening result means that nothing on the list matched what was typed. It does not mean the counterparty is not a designated person’s front, or that goods are not bound for a designated end user. The Pegasus release calls screening against names “a baseline tool”, and the Extreme release says that inconsistent end-user explanations are red flags that call for more. Everything on the techniques pages is a way of making the typed name come out clean. Screening failures and evasion techniques meet where a control that could have caught a technique was not working.