Sanctions Screening as Entity Resolution: OFAC 50% Rule

Why screening is a matching problem

Sanctions screening is usually described as a list lookup. In practice it is three separate problems, often merged into one alert score. The first is name matching: deciding which list entries a string such as "Arkadij Welmorow" might refer to. The second is identity: deciding whether the party in front of you is the same real-world person or organisation as the listed one. The third is ownership aggregation: deciding whether an entity that appears on no list is nonetheless blocked because listed persons own enough of it.

Each problem is a form of entity resolution, the task of determining which records refer to the same real-world entity, also called record linkage or de-duplication ^[1]. The third problem depends on the second: an ownership sum is only as correct as the identity decisions behind each addend. This article covers United States sanctions administered by the Treasury's Office of Foreign Assets Control (OFAC) and European Union restrictive measures. It is educational, not legal advice.

List matching: transliteration, aliases, false positives

A sanctions list entry is a structured record, not a name. OFAC entries can include former names, aliases, nationalities, identification numbers, date and place of birth, registration numbers and addresses, and its enhanced formats add names in non-Latin scripts ^[2]. The EU Council's best-practice paper asks that listings of natural persons include the name in the original language where available, transliteration as in travel documents or according to International Civil Aviation Organisation (ICAO) standards, and aliases, so as to avoid "mistaken identity" caused by homonyms ^[3]. See our EU sanctions list and OFAC SDN list reference pages.

Name matching then has to tolerate variation without collapsing distinct people. OFAC documents how its own free Sanctions List Search tool does this: it pre-filters candidates on first letter and an edit-distance similarity of at least 50 percent, then scores with Jaro-Winkler (a string-similarity measure that rewards shared prefixes) and Soundex (a phonetic code), comparing both the full string and individual name parts, and reports the higher score; a further algorithm was added in a 2021 upgrade ^[4]. OFAC declines to recommend a threshold, because each search has its own facts ^[4].

The table below shows why no threshold can do the identity work. The listed person is fictional: "Arkadiy Velmorov" (Cyrillic Аркадий Велморов), a fictional designated individual. Scores are full-string Jaro-Winkler similarity on lowercased text with the standard prefix weight of 0.1, computed for this article.

A different person outscores a genuine transliteration, and reordering tokens drops the genuine variant below any plausible cut-off. This is why OFAC's tool also compares name parts, and why a string score can only generate a candidate, never a decision. OFAC notes that many potential matches are false positives (alerts on names that do not refer to the listed party), and that some listed aliases are classified as "weak aliases" that a tool may exclude as a risk-based decision ^[2].

Identity: is the customer the listed party?

Identity resolution compares the full attribute set, not the name. OFAC's recommended procedure is to review the complete list entry, compare every available detail against what you hold and gather more where needed; few similarities suggest an invalid match, while multiple matching attributes, such as name and date of birth, call for escalation. An address match alone may not suffice, since several businesses may share one. OFAC does not confirm potential matches or false positives itself (OFAC FAQ 5, updated 9 September 2026).

The EU paper takes a parallel position from the other side. Economic operators should, as a rule, refrain from business with any person whose available identifiers fully match a listing unless it is clear the person is not the designated one, and limited identifiers cannot justify dealing with a designated person ^[3]. It also recognises that funds of an unintended person may be frozen because identifiers match ^[3].

In entity-resolution terms this is a pairwise classification over several fields, followed by clustering. The open-source Splink package, built on the Fellegi-Sunter model, scores record pairs across fields and clusters links into estimated identities; its documentation states it performs best with multiple, weakly correlated columns and is not designed for a single column such as company name alone ^[5]. Name-only screening is the weakest form of the problem; the remedy is more attributes, not a cleverer string metric. Binette and Steorts review the clustering, supervised and canonicalisation methods that turn pairwise links into resolved entities ^[1].

OFAC 50 Percent Rule: aggregate ownership, control is not enough

OFAC's 50 Percent Rule comes from its 13 August 2014 guidance: any entity owned, directly or indirectly, 50 percent or more in the aggregate by one or more blocked persons is itself considered a blocked person, whether or not it appears on the Specially Designated Nationals and Blocked Persons List (SDN List) ^[6]. A blocked person is a person whose property and interests in property must be frozen by U.S. persons. Four points of the related FAQs matter for data design ^[7]:

• Aggregation across persons and programs. If two blocked persons each own 25 percent, the entity is blocked; holdings of persons blocked under different OFAC programs are added together (FAQ 399).
• Indirect ownership runs through 50-percent-owned entities. "Indirectly" means ownership through an entity that is itself 50 percent or more owned by blocked persons. In OFAC's examples, the blocked intermediary's whole stake is attributed, not a multiplied fraction; a stake held through an entity that blocked persons own less than 50 percent of is not attributed at all (FAQ 401, Examples 1 to 5).
• Control is not ownership. An entity controlled but not 50-percent-owned by blocked persons is not automatically blocked, although OFAC may designate it and urges caution (FAQ 398). Transactions involving a blocked individual acting for such an entity, such as a contract the individual signs, are still generally prohibited (FAQ 400).
• Divestment. Falling below 50 percent through a divestment outside U.S. jurisdiction ends automatic blocking for future dealings, but property already blocked stays blocked, and due diligence should confirm the divestment was not a sham (FAQ 402).

What changed in 2025-2026. The FAQ topic page still shows FAQs 398 to 402 with their 2014 and 2020 release dates, and the threshold is unchanged. On 31 March 2026 OFAC published a sanctions advisory, Guidance on Sham Transactions and Sanctions Evasion, which states that it supplements the 50 Percent Rule with factors for judging whether a purported divestment in fact occurred ^[8]. Because OFAC reads "interest" functionally, transfers that conceal rather than extinguish a blocked interest do not end it; red flags include non-commercial terms, transfers to relatives or associates, complex structures in higher-risk jurisdictions, the blocked person's continued involvement and transfers close to designation, with no factor determinative ^[9]. For a data team the consequence is concrete: the ownership graph needs history, because a stake that moved shortly before a designation is now itself a review signal.

EU approach to ownership and control (reference only)

The EU Council's EU Best Practices for the effective implementation of restrictive measures (document 11623/24, 3 July 2024) describes itself as non-exhaustive, non-binding recommendations ^[3]. On ownership, the criterion is possession of 50 percent or more of the proprietary rights of an entity or a majority interest in it, and aggregated ownership should also be taken into account; its own example is one designated person with 30 percent and another with 25 percent, in principle making the entity owned by designated persons ^[3]. That paragraph does not contain multi-tier arithmetic comparable to OFAC FAQ 401.

The main divergence from the U.S. position is control. The EU paper lists control criteria, including the right or power to appoint or remove a majority of the management or supervisory body, control of a majority of voting rights by agreement, a right to exercise dominant influence, de facto dominant influence, and a right to use all or part of the entity's assets ^[3]. If any criterion is met, the entity is considered controlled unless the contrary is established case by case ^[3]. Indications include being the largest shareholder, buy-back options, transfers close to designation, front persons and needlessly complex structures ^[3]. Making funds available to an owned or controlled entity is in principle treated as making them indirectly available to the listed person, unless a risk-based assessment shows otherwise ^[3]. Control facts (board appointment rights, voting agreements) are therefore data the EU analysis needs and the OFAC rule does not.

Resolving ownership chains: a worked example

All names in this example are fictional. Halden Therapeutics AG (a fictional pharmaceutical company) asks its bank to pay a cold-chain logistics provider, Tessaro Logistics GmbH (fictional). Two fictional parties are on the SDN List under different programs: the individual Arkadiy Velmorov and the company Lumina Grain Trading FZE. For the control case, assume Velmorov is also listed under an EU regime.

The Tessaro result depends on OFAC's attribution method. Two plausible but wrong methods give different answers:

• Multiplying through the chain gives Velmorov 0.30 × 0.60 × 0.30 = 5.4% and Lumina 0.25 × 0.60 × 0.30 = 4.5% via Corvane and Marisol, Lumina 0.40 × 0.20 = 8% via Ardent, plus Velmorov's direct 20%: 5.4 + 4.5 + 8 + 20 = 37.9%. That reads as "not blocked", contrary to the approach shown in FAQ 401, where a blocked intermediary's full stake counts.
• Counting every blocked-linked holder adds Ardent's 20% to reach 70%. The answer, "blocked", happens to be right, but for the wrong reason: FAQ 401 Example 4 excludes stakes held through an entity that is less than 50 percent blocked-owned. On a different register, the same mistake would produce a false block.

Brennick shows the regime split. Under the U.S. rule a 10% holder with board-appointment rights does not block the entity, but a contract signed by Velmorov on Brennick's behalf would still involve a blocked person (FAQ 400). Under the EU paper the appointment right meets a control criterion, so Brennick is presumed controlled and payments to it are in principle indirect availability to Velmorov.

Why aggregation needs resolved entities

The 50 Percent Rule is a sum over distinct blocked persons. Errors in identity resolution therefore become errors in arithmetic, in both directions:

• Double counting. Suppose two corporate registers supply Lowmoor's shareholder list, one recording "Arkadiy Velmorov" and the other "Arkadij Welmorow", each with 30%. Without resolving the two records to one person, the system sums 60% and blocks Lowmoor, a false positive with real cost to an unconnected business. The same applies when one person appears on two lists or twice in a customer master: one resolved person, counted once.
• Missed aggregation. Suppose Tessaro's register records the direct 20% stake as "Velmorov Arkadiy", and that string, scoring 0.472 on full-string similarity, never links to the SDN entry. The blocked sum falls to Marisol's 30%, and a blocked entity is cleared.

Resolution has to happen before summation, at the level of persons and entities, with each shareholding edge pointing to a resolved identifier. Where the parties hold Legal Entity Identifiers (LEIs), the LEI anchors entity identity (see our LEI page), and the Global LEI System publishes "Level 2" relationship data: the direct and ultimate accounting consolidating parent of each entity ^[10]. Those relationships rest on accounting definitions of consolidation, which the oversight committee chose for practicality while acknowledging they were designed for a different purpose ^[11]. Because a reported parent is a legal entity that prepares consolidated financial statements, Level 2 data helps locate a corporate group but names neither natural-person owners nor minority shareholders, so it cannot by itself compute a 50 percent sum. Beneficial-ownership registers fill part of that gap; the FATF strengthened its standard on beneficial ownership of legal persons (Recommendation 24) in March 2022 so that authorities have access to adequate, accurate and up-to-date ownership information ^[12].

What to record for each decision

OFAC asks organisations to keep complete, accurate records of the steps taken to investigate a potential match and the information relied upon ^[2]. For the three problems above, that translates into a record per decision:

Decisions must be reproducible as of a date, because lists and registers change, and identity decisions must be stored separately from ownership decisions, so that a later merge or split triggers recomputation of every sum that used them.

Review and escalation design

A workable design keeps the three problems as separate queues. Name candidates are triaged quickly, mostly to dismissal on contradictory attributes; identity decisions with multiple matching attributes are escalated, as OFAC's procedure contemplates ^[2]. Ownership determinations go to analysts who can read registers, and any sum near 50 percent, transfer near a designation date or structure matching the sham-transaction red flags is escalated ^[9]. For EU exposure, control evidence is reviewed separately, since a control finding needs no ownership threshold. Our article on entity resolution decisions and human review covers how to route uncertain merges to people and record their reasons.

Neither regime is fully restated here; for a specific case, check the current OFAC regulations and the relevant EU Council regulation. Reliable Context is a system of record built around source-backed values.