Sanctions screening checklist for visitor management: 36 items.

Quick answer. A working visitor sanctions screening program has an owner, screens the OFAC SDN List and the US Consolidated Screening List at least daily, matches names fuzzily including aliases, runs the same check on every way into the site, holds potential matches for a trained reviewer who compares the list entry's identifiers with the visitor's ID, keeps a record of every hit and decision, and is tested with known list names every quarter.

Reviewed 2026-10-20. Free to reuse with attribution to BeckonDesk. Not legal advice.

Download the checklist (CSV)

Scope and ownership (items 1 to 5)

1. Write down why you screen and who is in scope: visitors, contractors, delivery drivers, interview candidates. Scope decides which check-in paths need screening. Gaps usually sit in the paths nobody listed. Source: OFAC Framework for Compliance Commitments: risk assessment.
2. Name an owner for visitor screening and a deputy. OFAC's Framework starts with management commitment; a control with no owner decays. Source: OFAC Framework: management commitment.
3. Decide which roles may clear a hit, and keep hosts out of that list. The reviewer compares identifiers and escalates likely matches. A host waiting for a meeting is not neutral. Source: OFAC FAQ 5.
4. Record which sites screen and which do not, with the reason. An auditor's first question is coverage. A written exception beats an unexplained gap. Source: OFAC Framework: internal controls.
5. Have counsel confirm which rules apply to each site: OFAC, EAR, ITAR, NISPOM, NIST SP 800-171. Defense and dual-use sites carry export rules on top of sanctions; each changes what the door must do. Source: 22 CFR 120.50; 15 CFR 734.13.

Lists (items 6 to 11)

6. Screen the OFAC SDN List. US persons are generally prohibited from dealing with SDNs, and OFAC civil liability is strict. Source: OFAC FAQ 91; Tri-Seal Compliance Note, March 2024.
7. Screen the US Consolidated Screening List for the Commerce and State lists: Entity List, Denied Persons, Unverified, Military End User, ITAR debarred, nonproliferation. On 20 October 2026 the CSL held 6,213 entries from Commerce and State lists that an SDN-only screen never checks. Source: International Trade Administration, Consolidated Screening List.
8. Add the UK Sanctions List, the EU consolidated list and the UN list if you have UK or EU operations, parents or customers. Non-US regimes bind non-US entities in your group. The UK Sanctions List has been the only official UK source since the OFSI Consolidated List closed on 28 January 2026. Source: GOV.UK: the UK Sanctions List.
9. Keep your own watchlist (trespass notices, former staff, banned contractors) separate from government lists, with an owner and a reason for each entry. Mixing internal entries into sanctions results confuses reviewers and audit trails. Source: OFAC Framework: internal controls.
10. Refresh every list at least daily and record when each was last loaded. OFAC designates without a schedule; the CSL is rebuilt daily at 5:00 AM Eastern. Source: International Trade Administration, Consolidated Screening List.
11. Alert a named person when a list fails to download. Failing to update screening software with current lists is a root cause OFAC cites in enforcement cases. Source: OFAC Framework, root causes appendix.

Matching (items 12 to 17)

12. Screen published aliases as well as primary names, list by list. 12,467 of the 26,159 CSL entries carried an alternate name on 20 October 2026. Source: CSL downloadable file.
13. Normalize accents, punctuation and word order before comparing. Jose Munoz Ortiz and José Muñoz-Ortiz should be the same comparison. Source: OFAC FAQ 249.
14. Use fuzzy matching, not exact matching. Transliteration and typing errors defeat exact comparison. OFAC's own tool uses Jaro-Winkler and Soundex. Source: OFAC FAQ 249.
15. Set and write down two thresholds: one that holds the visit for review and one that refuses it. OFAC recommends no threshold; users must make their own determination and should be able to explain it. Source: OFAC FAQ 250.
16. Screen the visitor's company as well as the person. Listed entities send employees. The person's name may be clean while the employer is not. Source: OFAC FAQ 91.
17. Escalate known ownership by listed parties even when the company name screens clean. Under the 50 Percent Rule, an entity owned 50% or more by blocked persons is blocked without being listed. Source: OFAC 50 Percent Rule guidance.

At the door (items 18 to 23)

18. Run the same screening on every way in: kiosk, pre-registration, front desk, phone check-in, contractors and drivers. A control that covers one path is bypassed by the others. Source: OFAC Framework: internal controls.
19. Screen at pre-registration so hits are resolved before the visitor travels. Clearing a hit takes time; doing it before arrival avoids holding someone in the lobby. Source: OFAC FAQ 5.
20. Hold potential matches and issue no badge until a reviewer clears them. A badge issued before review is access granted before review. Source: OFAC FAQ 5.
21. Do not tell the visitor why they are held; route them to a trained person. Explaining a match at the kiosk exposes list data and puts staff in a confrontation. Source: Operational practice.
22. Notify the reviewer at once and keep match details out of broad notifications. Hosts and receptionists need to know a visit is held, not who it matched. Source: Operational practice.
23. Re-screen people on site and upcoming visitors when lists change. A designation published at noon applies to a visitor who signed in at nine. Source: OFAC recent actions.

Review and decision (items 24 to 29)

24. Compare the full list entry's date of birth, nationality, ID numbers and address with the visitor's ID. OFAC's guidance: a close or exact name match can still be the wrong person; identifiers decide. Source: OFAC FAQ 5, step 3.
25. Check which list the hit came from before acting. An OFAC list and another agency's list carry different consequences. Source: OFAC FAQ 5, step 1.
26. Escalate likely matches to compliance or counsel before deciding. They check for licenses and exemptions the front desk cannot see. Source: OFAC FAQ 5, step 4.
27. Require a written reason for every cleared hit and every override. The reason is the evidence that a person, not a default, made the decision. Source: OFAC Framework: internal controls.
28. Know the reporting duty: blocked or rejected transactions go to OFAC within 10 business days. Confirmed matches that involve a transaction are reportable, not just refused. Source: OFAC FAQ 5, step 6.
29. Keep a record of cleared false positives so repeat visitors are handled the same way, and re-check them when the list entry changes. Repeat reviewers reaching different answers on the same person is a finding in itself. Source: OFAC FAQ 5.

Records (items 30 to 33)

30. For each check, keep the name and company as entered, the time, the lists and their refresh dates, the score and the result. Without the list date you cannot show which designations a check could have caught. Source: 31 CFR 501.601.
31. For each hit, keep the reviewer, the decision, the reason and the time. This is the record OFAC's potential-match steps end with. Source: OFAC FAQ 5, step 6.
32. Set retention with counsel: 10 years for records of transactions subject to OFAC rules since 12 March 2025; one year for foreign visitor records at cleared facilities. The OFAC period doubled in 2025; many visitor logs still purge after one year. Source: 31 CFR 501.601; 32 CFR 117.19(e)(4)(iii).
33. Make sure you can export the records yourself, without the vendor. An auditor's request should not depend on a support ticket. Source: OFAC Framework: testing and auditing.

Testing and training (items 34 to 36)

34. Test every quarter: sign in a known list name, a listed alias and a misspelling, and confirm each is held. OFAC's root causes include screening software that misses alternate spellings. Testing is how you find out first. Source: OFAC Framework: testing and auditing.
35. Train front-desk staff and reviewers, and retrain when the procedure changes. Training is one of the five components OFAC names. Source: OFAC Framework: training.
36. Review thresholds and the false-positive rate twice a year. Too many holds teach staff to override; too few means the threshold is missing variants. Source: OFAC FAQ 250.

Where BeckonDesk fits

BeckonDesk covers the software side of several items: it screens each visitor's name and company against the OFAC SDN List, the Consolidated Screening List, the UN list and your own watchlist, refreshes the government lists nightly, holds kiosk sign-ins at a score of 80 and refuses them at 88, and stores the reviewer, time and reason for every decision. The full answers, including what it does not compare, are in our buyer's guide. The program items, such as scope, ownership, escalation, retention and testing, are yours whichever system you use.

Related reading

• OFAC visitor screening: how it works
• Visitor management systems with sanctions screening: what to ask
• Visitor screening for defense, manufacturing and ITAR-adjacent sites
• Visitor log requirements by regulation

Run item 34 on BeckonDesk.

Start a 30-day trial, sign in a test visitor under a listed name, and check the hold and the review record. $79 per location per month after that.