OFAC updates the SDN list on average two to three times per week. Some updates add a single entry. Some add hundreds. A few, like major Russia-related sanction waves, restructure entire sections of the list. Keeping pace without building a full-time monitoring function requires a systematic approach.
The worst strategy is periodic batch re-screening on a fixed calendar schedule — monthly or quarterly — without any trigger-based layer. A designee can appear on the SDN list on a Tuesday and stay undetected until your next scheduled run four weeks later. That window is a regulatory exposure.
A practical two-layer cadence
Tier one is automated continuous monitoring. Every relationship in your active portfolio should be screened on a recurring interval — daily for high-risk, weekly for standard, monthly for low-risk dormant accounts. This is not a manual process. It requires tooling that can run unattended and alert on new matches.
Tier two is triggered re-screening on list change events. When OFAC publishes a significant update — particularly one affecting your industry, geography, or entity types — you run a targeted re-screen of your full portfolio against the new list version. Not everything needs to be a triggered run; major updates do.
What to document for each list update
- Date and version number of the updated OFAC SDN list.
- Which entities in your portfolio were re-screened against it.
- Any new matches identified and how they were adjudicated.
- The name of the compliance officer who reviewed the update and signed off.