UK fines this year came from spelling variants, ownership changes and slow list updates, not missed exact matches. Three industry voices explain how to keep sanctions screening current without burying analysts in alerts.

Sanctions lists now change at a pace few compliance teams planned for. OFAC says its list has “no predetermined timetable”, and names are added or removed as needed. The UK also changed its source list this year. Meanwhile, every new name adds alerts. As a result, sanctions screening has become a balancing act between missing a real match and drowning analysts in false ones.

So we asked industry leaders one question: how has your team kept sanctions screening accurate as lists change faster, and how do you keep false positives from swamping your analysts? We wanted tactical guidance over checklists. Three respondents answered. Below, we set their replies against regulator findings and this year’s fines.

Where sanctions screening breaks

Exact matches are rarely the problem. In May, the FCA published a review of 150 firms. It found they “performed well on exact matches but poorly on spelling variants”, according to a WilmerHale summary. Weak spots included one-word names, digits, titles and non-Latin characters. The regulator also showed little patience for alert backlogs.

The sanctions screening fines tell the same story. OFSI fined Bank of Scotland £160,000 after its sanctions screening missed a Russian-to-English spelling variant on a passport. As a result, 24 payments worth £77,383 went through, VinciWorks reported. Apple’s Irish arm and Deutsche Bank’s London branch were fined £390,000 and £165,000 because vendor ownership data missed a change of control, according to Bratby Law. Most recently, Citibank’s London branch was fined £4.73 million over 970 payments. The causes included a records field that suppressed alerts and banks on an unscreened internal list. Sabre was also fined £1 million for keeping a designated Russian airline connected to its booking system for seven months.

Screen what changed

Our first respondent works in finance and focused on keeping alert volumes honest.

“We only highlight new or updated records, so the alert volume shows real change. That also makes it easy to explain why an alert was raised.

For false positives, use secondary keys. If there’s no date of birth, country or registration number matching alongside the name, treat it as noise and send it to a lower-level queue with its own criteria.

Analysts close each alert by picking a reason from a set list, so they aren’t swamped writing explanations, and the patterns show you which rules to improve. Keep a list of cleared matches with the date each was reviewed. If they’re never looked at again, they become a blind spot.

I don’t have false positive rates to share, and I’d be sceptical of anyone who gives you one.”

Ankit Sarawagi, Curator, CFO Matrix

His advice fits industry guidance on sanctions screening. The Wolfsberg Group, an association of global banks, says identifiers such as date of birth and nationality help separate true matches from false ones. It also expects firms to document their rules, thresholds and suppression lists. His warning on cleared matches matters too. A customer cleared last year may have changed owners since.

Test before you tune

Our second respondent gave the most step-by-step answer on sanctions screening, while noting she does not run a screening desk.

“When a list updates, screen it as a diff. Run only the changed entries against your full customer and counterparty base the same day, triggered from the list provider’s update file, so new and amended names hit everyone straight away instead of waiting for the nightly batch. Review removed entries before closing any open alert tied to them.

For false positives, give every closed alert a reason code, such as name-only match, common name, date of birth mismatch or country mismatch. Count which code closes the most alerts and change that rule first, leaving the rest alone. A fuzzy name match shouldn’t escalate without a second identifier, and name-only hits go to a lower queue. Then run the old and new settings side by side, and go live only if nothing real is lost. I don’t run a screening desk myself, so I have no false positive rate to share.”

Lilach Bullock, AI Implementation Consultant and Fractional CMO, Lilach Bullock

Her last step is the one regulators care about most in sanctions screening. Raising a fuzzy matching threshold cuts alerts, but it can also hide the spelling variants that caught Bank of Scotland. Therefore, any tuning change needs a parallel run against known variants before it goes live. However, a lower queue still needs a deadline. The FCA expects backlogs to be cleared, not parked.

How common false positives are

Our third respondent leads a corporate training company and pointed to event-driven sanctions screening.

“OFAC’s lists have no fixed update schedule, so sanctions screening has to respond to changes as they happen. That means tying automated list updates to event-driven rescreening of existing customers, beneficial owners and counterparties. Cleared matches shouldn’t be suppressed for good either. A change in ownership, customer details or a designation should trigger a fresh review. The scale of the problem is real. An LSEG survey found that 32% of respondents see false positive rates of 20% to 30%. The goal is better alerts reaching investigators, so they spend less time on repeated name similarities.”

Arvind Rongala, CEO, Edstellar

His figures on sanctions screening check out. OFAC’s own FAQ confirms there is no fixed timetable. The LSEG survey of more than 400 risk and compliance leaders found 32% saw false positive rates of 20% to 30% in a typical month. Note that LSEG sells screening data. His ownership point also links back to the 2026 fines, where vendor ownership data was the weak link. For more on ownership rules, see our report on beneficial ownership regulation.

Faster payments, faster lists

Speed now matters in law, not just in practice. On 28 January, the UK closed the OFSI Consolidated List and made the FCDO’s UK Sanctions List its single source. New entries carry a Unique ID, so sanctions screening systems and data vendors had to switch feeds. In the EU, the Instant Payments Regulation requires payment firms to screen their whole customer base against EU lists at least once a day. As a result, a weekly batch no longer meets the bar.

Machine learning can help with sanctions screening alert triage, as our roundup on AI fraud models explored. Still, the FCA is clear that relying on a vendor is not the same as assurance. Fintechs that sit on partner banks face the same scrutiny, as our piece on embedded finance compliance showed.

What to watch next

Several signals will test sanctions screening in 2027. OFSI’s new settlement scheme, introduced in February, is speeding up penalties, so more notices are likely. The FCA also expects more breach reports from insurers and digital asset firms. Meanwhile, Iran, North Korea and Libya are appearing more often in UK breach reports alongside Russia. Firms should also confirm that their data vendors have fully moved to the UK Sanctions List feed, because old OFSI Group IDs no longer appear on new designations.

Above all, our respondents agree on the order of work. Screen what changed the same day, demand a second identifier before escalating, and test every tuning change before it goes live. Sanctions screening fails on the edge cases, so that is where teams should look first.

FintechBits covers payments, banking and fintech developments for readers in the US and UK. This article is for information only and is not financial or legal advice. Views expressed are those of the FintechBits editorial team.