OFAC Rewrote Its Name-Match Guidance on 9 September. It No Longer Sends You to the Hotline to Confirm a Hit, and Your Onboarding Team Now Owns the Call.

Until this month, OFAC's published answer to how do I know whether this hit is real ended the same way: work through a short checklist, and if the details still line up, call the compliance hotline. On 9 September 2026 OFAC replaced that answer. The new version of FAQ 5 walks through six steps that end with blocking, rejecting and reporting, and closes with a sentence that moves the decision onto whoever is doing the screening: OFAC does not confirm potential matches or false positives to its sanctions lists, and instead encourages organizations to make risk-based determinations.

For the people who board merchants, a principal whose name and date of birth match a listing used to be a phone call. It is now a decision your team has to make, document and defend. Here is what changed, what surrounds it as of September 2026, and what OFAC's February case against a Florida school says about payments from someone other than the customer.

What Changed on 9 September

OFAC amended ten FAQs that day, including FAQ 5, Assessing OFAC Name Matches, as part of what it called an ongoing review to keep published guidance current. FAQ 5 was first released on 30 January 2015, and the version in place until the amendment was a pair of five-step checklists, one for live transactions and one for accounts. Both ended at the same place: if there are a number of similarities or exact matches, contact the compliance hotline.

The rewritten FAQ keeps the core test of comparing the full list entry against what you know about your party, but it changes where the process ends. In summary, the six steps are:

1. Work out which list the alert is against. Screening tools often mix OFAC's lists with others, such as the Commerce Department's Entity List; a match against another agency's list goes to that agency.
2. Decide whether it is a name match or another nexus, such as a sanctioned country or government or an entity blocked under the 50 Percent Rule. Escalate the non-name cases before acting.
3. Evaluate a name match against the complete list entry: aliases, nationality, ID and tax numbers, date and place of birth, registration numbers and addresses. OFAC notes that many potential matches are false positives and that a shared address alone may not be enough.
4. For an exact match, or a close one with several similarities and nothing that disqualifies it, follow your own procedures for likely matches and make a risk-based decision, then check whether a general or specific licence or an exemption covers the activity.
5. If nothing authorises it, decide whether the property must be blocked or the transaction rejected. SDNs and entities blocked under the 50 Percent Rule are blocked; a sanctioned jurisdiction or sector with no blocked person involved is a rejection.
6. Report blocks and rejections to OFAC within 10 business days and keep complete records of how the match was investigated and what information the determination relied on.

The hotline still takes questions about the guidance, but it is no longer where a match gets confirmed. One loose end: FAQ 23, released in 2002 and not part of this batch, still tells a screener with many similarities to contact OFAC's hotline for verification. Write procedures against the newer FAQ 5, but expect vendor and sponsor-bank material to quote the hotline route for a while.

Why This Lands on an ISO, Not Just the Bank

OFAC sanctions bind all U.S. persons: U.S. citizens and permanent residents wherever they are, all individuals and entities within the United States, and U.S.-incorporated entities and their foreign branches. That is FAQ 11, and unlike the Bank Secrecy Act it does not depend on being a covered financial institution. An ISO, a payment facilitator and a software platform that boards merchants are all inside it.

Nor is it a screening mandate. FAQ 43 says there is no legal or regulatory requirement to use software or to scan, but there is a requirement not to do business with a target or fail to block property, and that the important thing is not to conclude transactions before the analysis is completed. For a boarding queue, that last line is the operational rule: an unresolved alert on a principal is a hold on the application, not a note to revisit after the MID is live. In practice the screening requirement usually reaches you through the sponsorship agreement; the September change removes the step many of those programs leaned on when an alert could not be cleared internally.

The 50 Percent Rule Is Why Ownership Data Matters

A merchant's legal name can screen clean while the merchant is still blocked. Under OFAC's 50 Percent Rule, an entity owned 50 percent or more, directly or indirectly, by one or more blocked persons is itself blocked, whether or not it appears on any list. Since OFAC's revised guidance of 13 August 2014, ownership is aggregated across blocked persons: two SDNs holding 25 percent each block the entity, even if they were designated under different programs. Indirect ownership runs through intermediate entities that are themselves 50 percent or more owned by blocked persons.

The rule covers ownership, not control, though OFAC urges caution with entities a blocked person controls or holds a significant minority stake in, since they may be designated later. For underwriting, that means screening the control person you already collect, not only the owners, and treating a significant blocked-person stake under 50 percent as a risk decision rather than a pass.

Blocking, Rejecting and the Ten-Year File

If a match is valid, the reporting clock is short. A U.S. person holding property blocked under OFAC's regulations must file an initial blocking report within 10 business days, and anyone who rejects a transaction that would have violated the regulations must file a rejected-transaction report within the same period. Both go through the OFAC Reporting System. Holders of blocked property also file an annual report, as of 30 June, by 30 September.

The regulation puts primary responsibility on the actual holder of the property, and another person's filing excuses you only if you actually know it was made. In a typical card flow that is the sponsor bank; a payment facilitator that controls sub-merchant settlement funds should agree in advance who files.

Records now have a longer life. Since 12 March 2025, 31 CFR 501.601 requires records of transactions subject to OFAC's regulations to be kept for at least 10 years, up from five, matching the 10-year statute of limitations Congress set in April 2024. Blocked property records must be kept while the property is blocked and for 10 years after it is unblocked. The new FAQ 5 expects records of how each potential match was investigated and what the decision relied on. A cleared alert with no written reason is now the weakest record you can hold.

What the IMG Academy Case Adds

On 12 February 2026, IMG Academy, a boarding school and athletic training facility in Bradenton, Florida, agreed to pay $1,720,000 to settle 89 apparent violations of the Foreign Narcotics Kingpin Sanctions Regulations. Between 2018 and 2022 it entered into annual tuition agreements with two individuals designated for supporting a Mexico-based drug trafficking organisation, and it processed tuition and related payments under those agreements. The 89 apparent violations, dated 2019 to 2025, were six agreements and 83 payment transactions.

Three details from OFAC's release apply directly to payments teams:

• The names were not hidden. OFAC says the two individuals gave full names that matched their SDN List entries at application, enrolment and each contract signing, and that minimal due diligence at any point would have revealed they were sanctioned. OFAC treated the failure to screen counterparties as reckless disregard.
• The money came from someone else. The obligations were met mainly through wire transfers from non-designated third parties, mostly in Mexico, and through credit cards the sanctioned individuals had placed on file. OFAC's suggested starting point for schools is to screen students, counterparties to tuition agreements and payors.
• Disclosure came too late to count. IMG told OFAC as soon as it found out, but OFAC had already opened an investigation, so the case was treated as not voluntarily self-disclosed. It was also treated as non-egregious, and the settlement equalled the base penalty.

A school is exactly the kind of merchant an ISO boards, and OFAC's release says even entities operating largely domestically have international touchpoints. That is worth passing on to merchants in education, recurring billing and any vertical where the payer is often not the customer.

What to Put in Place

• Rewrite match resolution against the new FAQ 5: a step that ends in "call OFAC to confirm" should end in a documented decision by a named role.
• Hold boarding on any unresolved principal or owner alert.
• Screen every owner and the control person, not just the legal entity.
• Rescreen the portfolio when the lists change. OFAC added names to the SDN List on 8, 9 and 10 September 2026 alone; a merchant boarded clean can become blocked without anything in its application changing.
• Keep the file for 10 years, including cleared false positives and the data each clearance relied on.
• Agree with your sponsor who files a blocking or rejection report, and by when.
• Check vendor workflows and training material for the old hotline step.

The One-Line Version

OFAC now expects whoever runs the screen to decide whether a match is real and to keep the evidence for ten years, which makes match resolution an underwriting decision that needs the same staffing and paper trail as any other decline.