Sanctions screening can look healthy on a dashboard while a relevant name, payment or location never reaches the filter. A useful test therefore follows the whole control: the applicable measure enters the system, the right data is screened, a potential match generates an alert, and staff take the required action before prohibited activity can proceed.

The test should reflect the firm’s products, customers, counterparties, jurisdictions and applicable regimes. The European Banking Authority (EBA) guidelines on restrictive measures set specific expectations for EU payment service providers (PSPs) and crypto-asset service providers (CASPs). The US Treasury’s OFAC compliance framework describes risk-based internal controls and independent, objective testing for organisations with US sanctions exposure. Their scopes differ; neither should be treated as a universal list of legal duties.

Scope. This method is for compliance and control-testing teams. Name and list screening is one part of sanctions compliance. Ownership and control, sectoral restrictions, goods and services, geography, and evasion may require additional controls. Map those to the applicable regime rather than assuming a clean name-screening result resolves them.

Start with the coverage map

Before running sample names through a filter, document what the firm screens and when. Include customer onboarding and changes, the existing customer base, payment or transfer instructions, relevant counterparties and any other activity the firm’s risk assessment identifies. Record the applicable sanctions regimes and lists, the data sources feeding each screening step, the vendor and internal systems involved, and the point at which an alert stops an operation.

This map exposes a common blind spot: a well-tuned filter cannot detect data it never receives. Compare the intended coverage with actual system interfaces, field mappings and samples of production records. For EU PSPs and CASPs, the EBA specifically calls for testing whether all customers and transfers are screened when required and whether the fields supplied to the system are adequate and relevant. See EBA/GL/2024/15, paragraphs 55–56, in the EBA’s final guidelines.

Before selecting cases, reconcile the population to a reliable source, such as the source transaction count and interface records. Record exclusions and explain their effect on the conclusion. A sample from an incomplete feed cannot demonstrate complete screening coverage.

Test the list, not just the matching engine

Select a recent addition, amendment and removal from each relevant official source. Trace when the change became effective, when the firm or its provider obtained it, when the screening dataset changed, and when affected customers or transactions were screened again. Check that identifiers and aliases in the source record reached the screening system correctly. A successful download log is not proof that the right records were loaded into the live filter.

Run a controlled test for failed downloads, delayed vendor feeds and rejected files. The result should show who receives the failure alert, what activity is held or reviewed while the list is stale, and how the firm confirms recovery. OFAC’s Sanctions List Service provides current US list data; the applicable EU and national sources should be identified in the firm’s own coverage map.

Challenge the match settings

Use a documented test set with expected results. Include exact matches, plausible spelling changes, aliases, transliterations, swapped name order and names with common words. Include unrelated people or entities that resemble a listed party, so the test also measures needless alerts. Where relevant, test identifiers such as business identifier codes and the location information the firm actually collects. Protect customer data by using synthetic records or an appropriately controlled test environment.

Record which cases alerted, which did not, and why. A single match percentage is insufficient: a change that reduces false positives may also suppress true matches. For EU PSPs and CASPs, the EBA calls for calibration that avoids both excessive false positives and missed designated parties, including fuzzy matching where names differ in spelling, pattern or sound. It also expects the rationale for calibration to be documented. See EBA/GL/2024/15, paragraphs 24–25, in the EBA guidelines.

Follow the alert to its final action

An alert is useful only if it reaches a trained reviewer in time and the operation stays under control while the match is assessed. Trace a sample from screening through queue assignment, investigation, escalation, decision, release or hold, and any required freezing or reporting. Test weekends, backlogs, outages and handoffs between teams or providers. Review whether staff can see the source-list entry and enough customer or transaction information to make an informed decision.

Check exception rules and allowlists separately. A past false positive should not silently suppress a new designation or a changed customer record. The EBA says EU PSPs and CASPs that use an internal list to avoid repeated false alerts should document the reason and review it after a new or amended measure or a customer information change. See EBA/GL/2024/15, paragraph 13, in the EBA guidelines.

An OFAC settlement concerning Payoneer shows why this end-to-end view matters. OFAC identified weak matching, failure to screen business identifier codes present in list entries, and flagged payments that were automatically released during backlogs without review. The case is a historical example of control failure, not a template for every firm’s obligations.

A fictional test record

Test SC-01 uses a synthetic payment to a fictional designated party in an authorised test environment. The expected result is an alert and a hold before execution. The matching engine alerts when the name is entered directly, but the interface test omits the beneficiary field and produces no alert or hold. Retain the source message, mapped fields, list version, configuration and timestamps. Record a coverage failure, assign the interface owner, apply an interim restriction and retest the complete route after correction. No real payment is sent. The direct-entry pass does not offset the failed interface test.

Decide whether the control passed

Before testing, set acceptance criteria for critical cases: which matches must alert, when a payment must be held, who may clear it, and what evidence must remain. Report missed expected matches and any transaction that escaped a required hold as control failures, rather than averaging them into an overall score. For each finding, record the affected population, likely cause, interim control, owner, deadline and retest result.

Keep the test pack, list versions, sample inputs, expected and actual outputs, configuration, reviewer decisions and sign-off together. This lets another reviewer reproduce the result and shows whether a fix worked. OFAC’s framework calls for testing that is independent of the audited activity and for prompt compensating controls when a confirmed negative result is found. The EBA says EU PSPs and CASPs should report significant screening weaknesses to the management body and take corrective measures without delay. See the OFAC framework and EBA/GL/2024/15, paragraph 57, in the EBA guidelines.

Testing is complete when the firm can explain, with evidence, how an applicable sanctions change becomes an operational decision—and can show what happens when any step fails.

After a material configuration, list-feed or interface change, repeat the relevant earlier cases and any new failure cases. Record why the regression tests cover the changed exposure. The cited EBA document contains two sets of guidelines; this article’s numbered screening references are to EBA/GL/2024/15, applicable from 30 December 2025.

Updated 8 November 2026: removed an editorial excerpt from the body, clarified scope and EBA references, and added population and worked-test guidance.