OFAC visitor screening: how it works, from the list to the audit record.

Quick answer. OFAC visitor screening compares a visitor's name with the Specially Designated Nationals (SDN) List and usually the US Consolidated Screening List (CSL), using fuzzy matching so spelling variants are caught. Potential matches are held for a reviewer, who compares the list entry's date of birth, nationality and ID details with the visitor's ID before clearing or escalating. OFAC sets no match threshold and confirms no matches, so the method and the record of each decision are yours to define and keep.

Reviewed 2026-10-20. Entry counts are from the CSL download on that date. Not legal advice.

Step 1: the lists

The SDN List

The Specially Designated Nationals and Blocked Persons List names individuals, companies, vessels and aircraft whose property is blocked. US persons are generally prohibited from dealing with them (OFAC FAQ 91). Since 6 May 2024, OFAC delivers its list files through the Sanctions List Service, which replaced the older download pages.

The non-SDN lists

OFAC also publishes a Non-SDN Consolidated Sanctions List: the Sectoral Sanctions Identifications (SSI) List, the Non-SDN Menu-Based Sanctions List, the Non-SDN Chinese Military-Industrial Complex Companies List, the CAPTA List, the Palestinian Legislative Council list and the Foreign Sanctions Evaders list, which OFAC reports as currently empty. These carry narrower prohibitions than the SDN List, so a hit means checking the specific program's rules rather than assuming a block.

The Consolidated Screening List

The International Trade Administration combines the export screening lists of Commerce, State and Treasury into one file and rebuilds it every day at 5:00 AM Eastern. It is the practical way to cover the lists that matter to exporters and defense suppliers alongside OFAC's. On 20 October 2026 the downloadable file held 26,159 entries from 12 lists:

Three things in that file matter for visitor screening. First, the SDN List is three quarters of it, but a visitor screened against the SDN List alone is never checked against the Entity List, the Denied Persons List or the ITAR debarred list. Second, 12,467 entries (48%) carry at least one alternate name, so a screen that reads only primary names misses a large share of the published spellings. Third, the file includes 7,634 individuals, 10,411 entities, 1,559 vessels and 342 aircraft; at a front desk only the people and companies are relevant. The CSL is published as an aid, and its own terms say the agencies' official lists govern.

What no list contains

Under OFAC's 50 Percent Rule, a company owned 50% or more, directly or indirectly and in total, by blocked persons is itself blocked, whether or not it is listed. A visitor from such a company will screen clean on the company name. Where you know a visitor's company is owned by a listed party, treat it as a hit.

Step 2: keeping the lists current

OFAC publishes designations when they happen, not on a timetable, and the CSL is rebuilt daily. Three practical rules follow:

• Download, do not scrape. OFAC says its Sanctions List Search website should not be used by automated systems (FAQ 287). Screening software should use the published data files.
• Refresh at least daily and record when each list was last loaded, so a check can be tied to the list it ran against.
• Treat a failed download as an incident. OFAC's Framework lists failing to update screening software with current lists among the root causes of past violations.

Step 3: comparing names

An exact comparison fails on the variation real names carry. Each kind of variation needs a different technique:

OFAC's own search tool shows one way to do this. It first narrows candidates to names that share the first letter and are at least 50% similar, then scores each candidate with Jaro-Winkler (a string-similarity measure) and Soundex (a phonetic code), on the full name and on its parts, and reports the higher result (FAQ 249). Fuzzy logic applies to the name field only (FAQ 252), and the tool's default score of 100 returns exact matches only (FAQ 247).

The threshold is the decision that shapes everything at the door. OFAC does not recommend one: users "must make their own match threshold determinations" (FAQ 250). Set it too high and spelling variants pass. Set it too low and the front desk holds a visitor every hour, staff learn to override, and the control stops working. Most systems use two thresholds: one that holds the visit for review and a higher one that refuses it.

Step 4: the review

OFAC's guidance on potential matches (FAQ 5, updated 9 September 2026) sets out the reviewer's steps. Applied to a visitor held at the door:

1. Check which list the hit came from. An OFAC list and another agency's list (such as the Entity List) carry different consequences.
2. Escalate program hits. If the concern is a sanctioned country, region or government rather than a listed name, escalate before acting.
3. Compare identifiers. Open the full list entry and compare its date of birth, nationality, ID numbers, addresses and aliases with the visitor's ID. If few or none match, the hit can be cleared, with the reason written down. A close or exact name match can still be the wrong person.
4. Escalate likely matches. Follow your internal procedure: usually compliance or counsel, who check for licenses or exemptions.
5. Decide. Refuse, or let the visit proceed.
6. Keep the record, and if a transaction was blocked or rejected, report it to OFAC within 10 business days.

Two habits make this work at a reception desk. Keep the reviewer separate from the host, who wants the meeting to start. And do not tell the visitor why they are waiting: route them to a trained person and keep match details out of broad notifications.

Step 5: the audit record

The record is what shows, months later, that the control ran. For each hit it should hold the name as entered, the company, the time, the list and the list's refresh date, the matched entry and score, the reviewer, the decision and the reason. It should be exportable without help from the vendor.

On retention: since 12 March 2025, 31 CFR 501.601 requires records of transactions subject to OFAC regulations to be kept for at least 10 years, up from five, following the 2024 extension of the statute of limitations. Whether a given visit is part of such a transaction depends on why the visitor is there, so set the retention period for screening records with counsel rather than defaulting to your general visitor log period.

OFAC's Framework for Compliance Commitments names five components of a compliance program: management commitment, risk assessment, internal controls, testing and auditing, and training. Visitor screening is an internal control. Testing it, by signing in a known list name and confirming the hold, belongs in the fourth component.

How BeckonDesk runs these steps

BeckonDesk screens each visitor's name and company against the OFAC SDN List, the Consolidated Screening List, the UN Security Council list and your own watchlist, with the government lists refreshed nightly from their publishers. Kiosk sign-ins scoring 80 or above are held for an admin, 88 or above are refused, and every decision stores the reviewer, time and note. The full answers, including thresholds and what is and is not compared, are in our buyer's guide.

Frequently asked

What is the difference between the SDN List and the Consolidated Screening List?

The SDN List is OFAC's list of blocked individuals, companies, vessels and aircraft. The Consolidated Screening List is a combined file from the International Trade Administration that includes the SDN List plus 11 other lists from Commerce, State and Treasury, such as the Entity List, the Denied Persons List and the ITAR debarred list. On 20 October 2026 it held 26,159 entries, 19,457 of them SDN entries.

Does OFAC require businesses to screen visitors?

No OFAC regulation names visitor screening. OFAC civil liability is strict, so dealing with a blocked person is a violation even without knowledge, and OFAC expects a risk-based compliance program. Screening visitors is a control many sites choose for that program.

What match score should trigger a review?

OFAC does not recommend one and says users must make their own threshold determinations. Most screening systems use two: a lower score that holds the visit for a person to review and a higher score that refuses entry until someone with authority overrides it. BeckonDesk holds at 80 and refuses at 88 on a 0 to 100 scale.

How long should visitor screening records be kept?

Records of transactions subject to OFAC regulations must be kept for at least 10 years since 12 March 2025 under 31 CFR 501.601. Whether a visit is part of such a transaction depends on its purpose, so set retention for screening records with counsel.

Related reading

• Visitor management systems with sanctions screening: what to ask
• Visitor sanctions screening checklist: 36 items
• Visitor screening for defense, manufacturing and ITAR-adjacent sites
• OFAC visitor screening: what facilities must do at check-in

Sources

• OFAC FAQ 91 (the SDN List) and Other OFAC sanctions lists
• OFAC launches the Sanctions List Service, 6 May 2024
• OFAC FAQs 247, 249, 250, 252 and 287 (Sanctions List Search)
• OFAC FAQ 5 (potential matches, updated 9 September 2026)
• OFAC 50 Percent Rule guidance
• 31 CFR 501.601 and 89 FR 74832 (10-year recordkeeping, effective 12 March 2025)
• A Framework for OFAC Compliance Commitments
• Consolidated Screening List and the downloadable CSV (counts taken 20 October 2026)

OFAC, CSL and UN lists, refreshed nightly.

BeckonDesk screens visitors against the OFAC SDN List, the Consolidated Screening List and the UN list, and holds potential matches for an admin. Included at $79 per location per month.