OFAC Says a Bank's Sanctions Watchlist Was Not Updated for Over a Month

The Office of Foreign Assets Control, or OFAC, is part of the US Department of the Treasury. On October 13, 2026, it published an enforcement release about a national bank. The bank agreed to pay $11,662,930 to settle its potential civil liability for apparent violations of multiple sanctions programs.

The release says the apparent violations ran from September 2021 to April 2025. It puts them down to four issues. Payments went to or through blocked banks. Alerts for customers who exactly matched blocked persons were not appropriately prioritized. The watchlist used for screening was not updated in time. And two business accounts were mishandled through human error. Parts of the release follow, not the whole.

Payments to Blocked Banks

In May 2021 the bank began using an automated process to route certain cross-border payments through other banks, the release says. Its systems drew on a directory of banks supplied by a third-party vendor. The payments were then screened for sanctions.

In March 2022, after sanctions tied to Russia's invasion of Ukraine, the bank became aware that the directory included banks OFAC had blocked. It was screening those payments. It was still processing some of them. The release gives three reasons, in general. Some payments went through shortly after a bank was blocked, before the bank updated its screening filter. Some were cleared as false positives by analysts, through human error. And some had alerted, but were released automatically by an "alert suppression rule."

That rule suppressed alerts in certain circumstances, the release explains. One example is an alert based on exactly the same criteria as an earlier alert that an analyst had marked as a false positive. In January 2023 the bank put in a longer-term technical fix that took the blocked banks out of the directory its payment engine used. The release's count of these payments runs from February 2022 to March 2025. And the bank did not identify their full scope until OFAC asked about its lookbacks, in a subpoena of January 2025.

Exact Matches at Low or Medium Priority

A second problem sat in the alert ranking. The release calls it a "design flaw" in the bank's alert prioritization logic. Alerts for customers whose name and date of birth both matched exactly those of a blocked person were classed as low or medium priority, not high.

So their review was delayed, the release says, allowing three designated individuals to use their bank or credit card accounts for transactions between September 2021 and February 2024. The flaw remained in place for an extended period of time, the release says. In February 2024, six months after the issue was first identified, the bank fully implemented changes to its screening filter to correct it.

A Watchlist That Fell Behind

The third problem was the list itself. Between May 24 and June 28, 2023, the watchlist file the bank used for screening was not updated to reflect changes to OFAC's List of Specially Designated Nationals and Blocked Persons. The release puts this down to human error by a third-party vendor. As a result, the bank processed transactions totaling $100,828 involving designated entities.

The bank did not identify the vendor's error until July 2023. That was about a month after one of the payments it processed involving a recently designated entity was blocked downstream by another US bank.

A screen running on a stale list still runs, and still clears payments. Here another bank stopped one of them about a month before this bank found the error.

On February 7, 2025, the watchlist file failed to take in a vendor update reflecting the previous day's designations. This time the cause was a series of technical problems with the bank's own systems. The bank processed transactions totaling $146,543 that day on behalf of a designated ship management company. It fully activated the updates on February 12, 2025, almost a week later, then performed a lookback and disclosed the transactions to OFAC itself.

Aggravating Factors and Compliance Considerations

Among its aggravating factors, OFAC found that the bank acted recklessly. That included failing to update its sanctions watchlist for over a month, and failing to prioritize the exact-match alerts appropriately for an extended period of time.

The release also sets out compliance considerations. Decisions on screening alert parameters and rules should be risk-based, adequately supervised, and "subject to audit and testing," it says, to prevent errors from compounding. The case also highlights, it says, the importance of making sure that technical solutions such as sanctions screening software are both effective and up to date. Each organization remains responsible for its own compliance, whether or not it relies on third-party providers. And technical changes, such as moving to new screening tools or updating existing ones, should be made in a controlled manner, to avoid delays, gaps or backlogs that cannot be effectively managed.

The question for any firm is how it would know, on a given day, that its screen is checking against today's list.