Improving Sanctions Screening Accuracy with Identity Matching

Sanctions screening software can operate exactly as configured and still miss the identity that matters.

That is one of the clearest lessons from recent enforcement activity by the UK’s Office of Financial Sanctions Implementation, or OFSI. [1]

In one case, an automated screening system failed to detect a spelling variation of a designated individual’s name. OFSI has since encouraged firms to assess whether their screening can handle spelling and transliteration variants. Its enforcement findings have also highlighted the importance of screening configuration, explicit escalation procedures, current training, and timely reporting.

The broader lesson is not simply that financial institutions need automated screening. It is that sanctions name matching and related screening controls must continue to recognize risk when names, data, and operating conditions are less than perfect.

For sanctions compliance, financial crime, and screening leaders, recent enforcement should prompt a closer look at three areas.

1. Test identity variations, not just exact names, in sanctions screening

The same person or organization may appear differently across sanctions lists, customer records, identity documents, payment messages, and third-party data.

A name may be transliterated from another script. A spelling may change. Name components may appear in a different order. A company may be referenced with or without a legal or corporate suffix.

These are not unusual exceptions. They are part of the normal complexity of identifying people and organizations across languages, systems, and jurisdictions.

OFSI’s lesson for firms is direct: assess whether existing screening systems and processes can handle spelling and transliteration variants and consider whether the available resources are appropriate for the organization’s risk.

That means the practical test should not be limited to whether a system recognizes a sanctions list entry exactly as published. Firms should also ask whether fuzzy name matching can identify the same person or organization when the available record contains a realistic difference.

A meaningful testing program might include:

• Alternate spellings
• Phonetic variations
• Transliteration differences
• Names written in different scripts
• Reordered or abbreviated name components
• Organization names with and without corporate suffixes

The central question is simple: When the name changes but the identity does not, does the potential match still surface?

2. Measure missed sanctions matches, not just screening alerts

Financial institutions face understandable pressure to manage alert volumes. Large alert queues consume analyst capacity, slow investigations, and create operational strain.

But a lower alert count, by itself, does not demonstrate better screening.

A change to a threshold, matching rule, or sanctions screening software configuration may remove irrelevant results, but that same change may also remove a meaningful identity variation that the system can no longer recognize.

This is why screening performance must be evaluated in both directions:

• Is the system detecting meaningful name and identity variations?
• Is it distinguishing those potential matches from unrelated records?

The objective should not be to generate the greatest or smallest possible number of alerts. It should be to improve the distinction between potential matches and obvious non-matches.

That requires firms to assess missed matches alongside unnecessary alerts. Each time a threshold or matching rule is adjusted, teams should understand both what becomes easier to review and what may disappear.

Testing should also reflect the names and data the institution encounters in practice. Identity matching that performs well against simple, standardized test data may behave differently when confronted with multilingual names, incomplete records, inconsistent formatting, and organizational naming conventions.

3. Treat sanctions detection as the beginning of compliance controls

Even accurate matching does not produce an effective sanctions control on its own.

An alert must still be reviewed, understood, escalated, and resolved. When automation does not surface a concern, employees must know what to do if they recognize a potential sanctions risk through another part of the process.

OFSI’s published guidance emphasizes the need for robust and explicit escalation procedures. It advises that staff should know when to escalate a concern, who to contact, and how to do so. OFSI also stresses that sanctions training and related materials should be reviewed and updated as the sanctions landscape develops.

Screening leaders should therefore look beyond system performance and examine the full path from detection to action:

• Who owns an unresolved alert?
• How are review delays identified?
• Are escalation responsibilities explicit?
• Do frontline employees know where to raise a potential concern?
• Are training and procedures keeping pace with regulatory and geopolitical developments?
• Can the process continue to operate effectively when workloads increase?

The strength of the control depends not only on whether an alert is generated, but also on whether the organization can act on it appropriately.

A timely reason to reassess sanctions screening controls

Recent enforcement does not suggest that one technology decision can prevent every sanctions breach.

Sanctions screening accuracy depends on the interaction of matching technology, available data, screening configuration, testing, staff training, escalation procedures, and human judgment.

But name matching is a critical place to examine.

Babel Street Match helps organizations compare and resolve identities across languages, scripts, formats, and naming conventions. It can identify variations that include typographical errors, phonetic spellings, transliteration differences, initials, nicknames, and other inconsistencies. Match also provides configurable scoring and thresholds, allowing organizations to determine how names and other identity attributes influence match confidence.

This matters because improving screening is not simply a choice between detecting more matches and creating more work. The real opportunity is to better distinguish meaningful identity relationships from unrelated names, helping teams focus their attention where it is most warranted.

Technology is still only one part of the control. The results depend on the data entering the system, the way the system is configured and tested, and the people and processes responsible for acting on its output.

The question for screening leaders is therefore not simply: “Do we screen?”

It is: “When the same identity appears differently, will our controls still recognize the risk, and will our team be able to act before a missed match becomes an enforcement issue?”