OFAC Screening Controls for Securities Firms

A prospective account has cleared CIP, the customer’s legal entity documents are complete, and the business team is ready to move forward. Then a name match appears during OFAC screening. Whether that result is a true hit, a false positive, or an ownership issue determines what the firm must do next. The difference cannot be resolved by treating sanctions screening as a routine database search.

For broker-dealers, investment advisers, and other regulated investment businesses, OFAC controls belong in the firm’s broader financial-crime framework. A workable program identifies potential sanctions exposure before assets move, assigns decisions to qualified personnel, preserves the basis for those decisions, and escalates actual matches without delay. It also recognizes that sanctions risk does not stop at account opening.

What OFAC Screening Is Designed to Catch

The Office of Foreign Assets Control administers and enforces U.S. economic and trade sanctions. Its programs can restrict dealings with named individuals and entities, countries and regions, vessels, aircraft, and persons connected to designated activities. The Specially Designated Nationals and Blocked Persons List, commonly called the SDN List, is the list most firms recognize. It is not the entire screening universe.

Depending on the firm’s products, counterparties, and transactions, relevant restrictions may also arise from other OFAC sanctions lists, country-based programs, sectoral sanctions, or prohibitions affecting specific types of activity. A firm that screens only against one list may create a misleading sense of control.

OFAC screening generally compares customer, beneficial owner, counterparty, payee, sender, recipient, or other relevant party information against applicable sanctions data. The purpose is not merely to generate a match report. It is to determine whether the firm is prohibited from proceeding, required to block property, required to reject a transaction, or permitted to proceed after documenting why the alert is not a match.

That distinction matters. Blocking means placing property in a blocked account and reporting it as required. Rejection means refusing to process a prohibited transaction when no property must be blocked. These are different outcomes with different operational and reporting consequences. A business unit should not make that call on its own.

Why Securities Firms Need a Risk-Based OFAC Screening Program

FINRA Rule 3310 requires member firms to establish and implement AML programs reasonably designed to achieve compliance with the Bank Secrecy Act and its implementing regulations. OFAC compliance is related to, but not identical with, BSA/AML compliance. In practice, firms should address both within coordinated written supervisory procedures, escalation channels, training, and testing.

The appropriate screening design depends on the firm’s business model. An introducing broker with a limited retail customer base faces different risks than a placement agent accepting subscriptions from private fund investors, an underwriter working with issuers and selling group members, or a proprietary trading firm dealing through institutional counterparties. An SEC-registered adviser may have limited custody and transaction activity, but still needs controls appropriate to its clients, investment structures, service providers, and authority over funds.

A credible risk assessment considers more than customer geography. It should account for legal entity ownership, foreign beneficial owners, payment instructions, correspondent and clearing relationships, third-party service providers, private placements, wire activity, and whether the firm touches assets or has authority to direct transactions. Higher-risk relationships may justify more frequent review, stronger identity data requirements, or manual review by compliance personnel.

The firm should also decide, in writing, who is screened and when. At a minimum, the analysis commonly includes customers and beneficial owners at onboarding, but may extend to control persons, authorized traders, issuers, private fund investors, counterparties, vendors, wire parties, and recipients of distributions. Screening should recur when OFAC updates its lists, when customer records materially change, and before relevant transactions are processed. The exact cadence should follow the firm’s risk assessment and operational capabilities, not a generic vendor setting.

Ownership Cannot Be Treated as a Name-Matching Exercise

A frequent weakness is screening the legal entity’s name without adequately reviewing its ownership. Under OFAC’s 50 Percent Rule, entities owned directly or indirectly, individually or in the aggregate, 50 percent or more by one or more blocked persons may themselves be treated as blocked, even if the entity does not appear by name on the SDN List.

That requires a process for obtaining and updating ownership information, especially for private companies, pooled investment vehicles, complex holding structures, and foreign entities. It also requires judgment. A potential ownership concern may call for additional documentation, legal analysis, or consultation with sanctions counsel. Firms should avoid treating the absence of an exact list match as proof that no sanctions issue exists.

The Operating Controls That Make Screening Defensible

Technology can identify possible matches quickly, but it cannot establish a defensible decision by itself. A screening platform should support the firm’s process, not replace it. The core controls are straightforward, though they require consistent execution.

First, data quality must be sufficient to distinguish a real match from a false positive. Names alone are often inadequate. Date of birth, place of birth, nationality, address, passport or tax identification information, aliases, legal entity identifiers, ownership records, and transaction details may all be relevant. If the firm collects weak information at onboarding, it will struggle to clear alerts later.

Second, every alert needs documented disposition. The file should show the date and source of the screening, the list or program involved, information considered, reviewer identity, research performed, escalation steps, and the final decision. For a cleared false positive, the record should explain the differentiating information. For a possible true match, the record should show that the firm stopped activity while qualified personnel assessed the issue.

Third, the escalation procedure must be usable under pressure. Written supervisory procedures should identify who receives alerts, who may clear them, who has authority to halt activity, and when senior management, the AML compliance officer, outside counsel, clearing personnel, or OFAC should be involved. Firms should also establish after-hours coverage where transaction volume or business model warrants it.

Fourth, changes must be controlled. List feeds, matching thresholds, fuzzy logic settings, excluded terms, and manually suppressed alerts can materially affect results. Compliance should understand the vendor configuration and maintain approval records for significant changes. A low threshold can overwhelm reviewers with false positives. A high threshold can miss aliases, spelling variations, or incomplete data. The right balance depends on the firm’s exposure and staffing, but it should be tested rather than assumed.

Screening at Onboarding Is Not Enough

Sanctions risk changes after an account is opened. OFAC can add, remove, or update designations. Existing customers can change owners, add authorized persons, move to a higher-risk jurisdiction, or begin sending funds to unfamiliar third parties. A static onboarding check will not capture those developments.

For many firms, the practical model combines daily or near-real-time list-update rescreening with event-driven checks. Events may include changes to account ownership, updated payment instructions, new control persons, material address changes, onboarding of an affiliated entity, or a wire involving a new beneficiary. The firm’s procedures should identify the events that trigger a repeat screen and make clear which systems or teams provide the underlying data.

Transaction screening also requires careful scope definition. A broker-dealer that does not directly transmit wires may rely on a clearing firm for portions of payment screening, but that does not eliminate its responsibility to understand the arrangement. The introducing firm should know what the clearing firm screens, what information it receives when an alert arises, which party can stop activity, and where the final documentation resides. Reliance without documented oversight leaves gaps that are often exposed during an examination.

Testing, Training, and Examination Readiness

Independent testing should assess whether the OFAC control framework operates as described, not simply whether a vendor report exists. Testing can sample onboarding files, beneficial ownership reviews, alert dispositions, transaction holds, list-update timing, exception approvals, and coordination with clearing or custodial partners. It should also assess whether the written procedures match the actual workflow.

For FINRA member firms, independent AML testing under Rule 3310 is generally required annually, subject to limited eligibility for every-two-year testing. OFAC-related controls should be considered within that review where they are part of the firm’s AML and supervisory structure. Findings should lead to documented remediation, assigned owners, and reasonable completion dates.

Training should be role-specific. Operations staff need to know how to hold an account or transaction and whom to call. Registered personnel need to recognize when a customer relationship or payment instruction raises concern. Supervisors need to understand that an urgent business request does not override a sanctions hold. Senior management needs reporting that identifies unresolved alerts, aging exceptions, material vendor issues, and remediation status.

A regulator or examiner will usually look beyond the policy language. The practical questions are direct: Who is screened? Against what data? How quickly are updates applied? Who clears alerts? What happens when a potential hit occurs? Can the firm produce records showing the process worked? Firms that can answer those questions with organized evidence are in a stronger position than firms relying on general assurances from a vendor or affiliate.

Effective OFAC screening is disciplined operational work: accurate data, defined authority, timely escalation, and records that show why each decision was made. Keeping those elements aligned gives leadership a clearer view of sanctions exposure while allowing the firm to conduct ordinary business with appropriate control.

Related service: AML independent testing