Screening a moving target

Sanctions screening used to feel like checking a list. In 2026, the list barely holds still long enough to check. Across roughly the first half of the year, OFAC took some 869 actions — 614 designations and 255 removals — spread across 47 separate action days, on no fixed schedule and effective the moment they publish. A name added at 10:00 a.m. is binding at 10:00 a.m. A transaction cleared at 10:05 against a database that refreshes overnight is already a violation.

And the list itself understates the exposure. The SDN list now carries more than 17,000 names — but because of OFAC’s 50 percent rule, entities owned in majority by designated parties are blocked as a matter of law without ever appearing on it. The name you screened may be clean while the company behind it is not.

The list now churns in both directions

The instinct is to picture sanctions as an accumulation — more names, added faster. But 2026 introduced something most screening programs are far less prepared for: a deliberate wave of delistings. Under a “sanctions modernization” initiative, OFAC has been actively removing entries — 76 in a single May action, dozens more in a second phase, alongside corrections to identifying information — clearing legacy, stale, and batch-era designations and stating plainly that the quality of the list now matters as much as its growth.

Here is the trap. Almost every screening system is tuned to catch additions: the new name that should block a payment. Very few are tuned for removals. But a party OFAC has delisted that your system still flags is its own kind of failure — it manufactures false positives, forces manual reviews, and strands a cleared, legitimate customer because your data is now behind the list in the other direction.

It was never just about matching a name

Three properties of the current environment turn sanctions screening into a data problem rather than a list-lookup:

1. Velocity. Updates are continuous, unscheduled, and effective on publication. A weekly download an analyst runs by hand — or even an overnight batch — is no longer a defensible way to know what the list says right now.
2. Ownership. The 50 percent rule means the real exposure is often not the named party but an entity it controls. Catching that requires resolving ownership structures, not matching a string against a list.
3. Fragmentation. OFAC, OFSI, the EU, the UN, and others do not align, and their lists do not fully overlap. Each additional regime raises alert volume without proportionally raising true hits — and roughly 90 percent of AML alerts are already false positives.

Put those together and the failure mode is clear: bolt more lists onto a matching engine that updates slowly and can’t see ownership, and you get more noise, later, in both directions.

From periodic download to live feed

Keeping pace is less about a bigger list than a better operating model. Five moves define it:

1. Treat the list as a feed, not a file. Screening data has to update continuously and near-instantly, so what you screen against reflects the list as it stands this minute — not last night, and not last week.
2. Screen removals as rigorously as additions. Build the program to clear a delisted party as quickly as it blocks a new one, and monitor churn in both directions so cleared customers don’t sit flagged.
3. Resolve ownership, not just names. Screen for the 50 percent rule — the blocked entity that never appears on the list — by reaching the ownership behind the name in front of you.
4. Cut the noise so the signal survives. Fuzzy matching, transliteration, and contextual risk-scoring are what keep a multi-regime program from burying analysts in false positives and missing the hit that matters.
5. Keep the evidence. Under an effectiveness standard, be able to show what your data reflected and when — including that you acted on a change the day it happened, in either direction.

Real-time risk needs real-time data

The through-line is simple: you cannot screen a moving target with a static picture. Every challenge above resolves to the same requirement — sanctions and ownership data that is current to the minute, resolved to real entities, and reflecting both additions and removals as they happen.