Amazing Devs

U.S. Compliance Teams: 6 OFAC Screening RFP Questions On 50% Rule

Uncategorized / By

U.S. Compliance Teams: 6 OFAC Screening RFP Questions On 50% Rule

Decorative OFAC screening RFP title card

OFAC screening vendors match your supplier and customer names against U.S. sanctions lists and flag potential hits for review. The vendors worth hiring share three traits: current SDN and SSI coverage updated on a predictable schedule, matching logic that catches aliases and transliterations without burying you in false positives, and an audit trail detailed enough to survive an OFAC examination. Before signing anything, confirm the vendor supports ownership checks tied to the 50% Rule.

TL;DR:

  • OFAC screening vendors must update their sanctions list data regularly and support ownership checks under the 50% Rule to ensure compliance accuracy.
  • Quality matching logic, including fuzzy matching and alias handling, is crucial for minimizing false positives and catching aliases or transliterations effectively.
  • Vendors should provide transparent data sourcing, detailed audit trails, and sample false-positive rates from comparable client pilots before signing contracts.
  • Integration options like APIs, batch uploads, and platform compatibility are essential, alongside clear performance metrics for onboarding and ongoing monitoring.
  • Relying solely on list coverage is insufficient; focus on match quality, update speed, transparency, and the ability to produce compliance-proof audit reports.
Amazing Devs
Build Your Compliance Technology Team
Amazing Devs connects businesses with skilled nearshore developers from Brazil, aligned to technical needs, culture, and business goals.

Table of Contents

What OFAC screening covers and why it matters for U.S. compliance programs

The Office of Foreign Assets Control administers U.S. economic and trade sanctions, and its sanctions programs are the reason screening exists at all. Most vendors screen against the Specially Designated Nationals (SDN) list and the Sectoral Sanctions Identifications (SSI) list, both part of OFAC’s broader consolidated sanctions lists. Any U.S. person, and any entity or transaction touching U.S. jurisdiction, is expected to avoid dealing with blocked parties, which is why vendor due diligence has become a standard procurement step rather than a legal afterthought.

Ownership adds a layer many teams miss. Under the 50% Rule, a company owned 50% or more in the aggregate by one or more blocked persons is itself considered blocked, even if it never appears on a list by name. OFAC also notes that control and other factors can trigger designation independent of the ownership math, so a name-only screen is not enough for higher-risk vendors.

OFAC’s enforcement history points to recurring, avoidable gaps. Its compliance framework cites specific patterns behind screening failures:

  • Screening software that was never updated after a new SDN or SSI designation.
  • Systems that failed to account for alternate spellings, transliterations, or nicknames.
  • Programs missing basic identifiers like date of birth or address that would have caught a true match.

Those three failure modes are exactly what a procurement checklist should be built to rule out.

Key features and capabilities you should require from screening vendors

Not all screening tools are built the same, and the differences show up fastest in matching logic and data coverage. Before comparing vendors on price, compare them on these capabilities.

  1. Matching modes. Look for exact matching, fuzzy matching, and transliteration support, plus alias handling for known aka names, with sensitivity settings you can tune rather than a fixed threshold.
  2. Data coverage and cadence. Confirm the vendor screens the SDN list, the SSI list, and other relevant consolidated lists, and ask exactly how often the underlying data refreshes and how updates are published to clients.
  3. Operational features. Check for API access, batch upload, a web portal, and prebuilt integrations with common GRC or ERP platforms, along with case management tools for tracking each alert to resolution.
  4. Governance features. An immutable audit log, tamper-evident reporting, and a defined data retention period are what turn a screening tool into something you can show an examiner.
  5. False-positive handling. Ask how the vendor’s workflow routes likely false positives for human review instead of dumping every partial match into one queue.

Pro Tip: Ask every finalist for a sample false-positive rate from a comparable client pilot, not a marketing average, before you commit to a contract.

Vendors who hesitate to share sample metrics or resist a limited pilot are telling you something about how their matching performs in practice.

Integration and operational considerations for vendor onboarding and ongoing monitoring

How you connect a screening vendor to your workflow depends on volume and existing systems more than on brand reputation. High-volume onboarding usually calls for API access, while smaller teams doing periodic checks often do fine with batch uploads or a portal.

Whichever method you choose, the vendor needs clean input data to produce a reliable match:

  • Full legal name and any known trade or alternate names.
  • Ownership and beneficial-owner information sufficient to support 50% Rule checks.
  • Government identifiers such as tax ID, date of birth for individuals, or registration numbers where available.
  • Country of incorporation or residence and any known addresses.

Ask about throughput, latency, and uptime commitments, and treat onboarding screening and ongoing monitoring as separate performance questions since a vendor can be fast at one-time checks and slower at continuous list-change monitoring. A workable pilot uses a shared sample dataset with sandbox access, then measures results against a set acceptance threshold for accuracy and false-positive rates before you scale up. Recordkeeping matters here too: confirm how long screening records are retained and how the vendor handles the supplier data you share, since that data often includes identifying and ownership details you are responsible for protecting.

Vendor evaluation checklist, RFP/demo questions, and red flags

A vendor demo will always look clean. The questions below are designed to get past the demo and into how the tool performs on your actual data.

Build your RFP around these checkpoints:

  1. Coverage and cadence. Which lists does the platform screen, and what is the documented update cycle from OFAC publication to your system reflecting it?
  2. Matching approach. What fuzzy-matching and transliteration logic is used, and can sensitivity be adjusted by risk tier?
  3. Integrations. Does the vendor offer API, batch, and portal access, and which GRC or ERP systems does it already integrate with?
  4. Auditability. Can the system produce a tamper-evident audit report showing every screen, hit, and disposition?
  5. Pricing transparency. Is pricing based on volume, per-seat access, or flat licensing, and are overage costs disclosed upfront?
  6. References. Can the vendor provide a client reference in a comparable industry or size range?

Pro Tip: Request the vendor’s list-sourcing documentation in writing. A vendor that cannot explain where its SDN and SSI data comes from cannot explain why a match failed.

The most reliable way to validate any vendor’s claims is a pilot built on a shared test file containing known true positives and known true negatives. Run that file through the vendor’s system and measure the false-positive rate and false-negative rate directly rather than relying on the vendor’s own reported averages.

Illustration of sanctions screening pilot outcomes

Treat these as disqualifying red flags: a vendor that will not explain where its list data originates, a system with no audit log or exportable report, resistance to running any pilot or sharing sample output, or SLA commitments that shift between the sales call and the contract.

Amazing Devs’ perspective: how staffing partners support sanctions due diligence

Amazing Devs is a nearshore staff augmentation partner, not a sanctions screening vendor, and the distinction matters when you are building a compliance program. What a staffing partner can do is reduce the documentation burden around the people it places: managing contracts, keeping identity and engagement records organized, and giving your compliance team a clear point of contact when a question comes up.

When evaluating a staffing partner as part of vendor risk assessment, ask for:

  • Onboarding records showing how contractor identity was verified.
  • Contract language covering compliance cooperation and audit access.
  • A named escalation contact for compliance-related requests.

A staffing partner like Amazing Devs, through its Team Extension Model, can make ownership and identity documentation easier to produce on request. It does not replace an automated OFAC screening tool, and no compliance program should treat it as one.

For primary confirmation, use OFAC’s sanctions list search tool for ad hoc name checks, the OFAC FAQs for rule interpretation, and the Framework for OFAC Compliance Commitments for program design guidance.

What compliance teams keep getting wrong

The most common mistake in vendor selection is treating list coverage as the deciding factor. Nearly every serious vendor screens the SDN and SSI lists. What separates a solid vendor from a liability is match quality, update speed, and whether the audit trail would hold up under OFAC review, and those are exactly the things a sales demo is not built to show you.

The second mistake is skipping the pilot. A shared test file with known positives and negatives costs an afternoon and tells you more than a week of vendor calls. If a vendor resists that request, that alone is useful information.

Procurement teams should also stop expecting a staffing partner to double as a screening system. A good nearshore partner reduces paperwork and gives you a documented contractor record, but the sanctions check itself still belongs to a dedicated vendor with current list data and a defensible audit log. Get that division of labor right before you worry about anything else on the checklist.

— Gabriel

This article is general information, not a substitute for advice from a qualified financial advisor. Consult a qualified financial professional about your own circumstances before acting on anything here.

Sources

FAQ

Who is required to do OFAC screening?

Any U.S. person, along with entities and transactions subject to U.S. jurisdiction, must avoid dealing with parties on OFAC’s sanctions lists, which is why businesses build vendor screening into standard due diligence. This applies broadly to companies handling payments, contracts, or supplier relationships that touch U.S. commerce, as described on OFAC’s site.

What is the OFAC list for the United States?

OFAC maintains several sanctions lists, most notably the Specially Designated Nationals (SDN) list and the Sectoral Sanctions Identifications (SSI) list, both part of its broader consolidated sanctions lists. These lists identify individuals, companies, and vessels that U.S. persons are restricted from dealing with, and they are searchable through the official sanctions list search tool.

How to check if a company is OFAC sanctioned?

Run the company’s legal name, known aliases, and ownership details through OFAC’s sanctions list search tool or a screening vendor’s matching engine. Because of the 50% Rule, also check whether the company is owned 50% or more in the aggregate by a blocked person, as explained in OFAC’s FAQ.

What are the top OFAC screening software options for banks?

There is no official OFAC-endorsed ranking of screening vendors, so any “top vendors” list reflects a third party’s own criteria rather than a regulatory standard. Banks typically evaluate vendors on list coverage, matching accuracy, integration options, and audit reporting rather than relying on a fixed ranking.