What sanctions screening is
Sanctions screening is the process of comparing names and other identifiers against official lists of people, entities, vessels and places subject to sanctions. The aim is to stop a provider from dealing with a listed party or making funds available to one, directly or indirectly.
In Canada, sanctions laws apply to everyone in the country and to Canadians abroad. They are not limited to financial institutions. A money services business screens because dealing with a listed person would be an offence, and because its banks and correspondents require it to show that it has effective controls.
Screening is distinct from anti-money laundering checks, though the two work side by side. Sanctions rules are strict: if a party is listed, the dealing is prohibited, regardless of how legitimate the underlying trade appears. There is no risk-based tolerance for a confirmed match. That is why providers screen so widely and why they take every possible match seriously until it is resolved.
The lists providers screen against
A Canadian provider screens, at a minimum, against the persons and entities listed under Canadian law. The main sources are:
- Regulations made under the Special Economic Measures Act.
- Regulations under the Justice for Victims of Corrupt Foreign Officials Act.
- Regulations implementing United Nations Security Council sanctions under the United Nations Act.
- Entities listed as terrorist entities under the Criminal Code.
Most providers that send international payments also screen against other major lists, such as the United Nations consolidated list, the lists maintained by the United States Office of Foreign Assets Control, the United Kingdom's consolidated list and the European Union's consolidated list. A Canadian MSB is not bound by foreign laws in the same way, but its correspondent banks often are, and a payment in US dollars or euros will pass through institutions that apply those rules.
Lists change frequently, sometimes several times a week when a new sanctions regime is introduced. Providers update their screening data promptly and rescreen their existing client base against new entries.
What gets screened and when
Screening happens at two main points: when a relationship begins, and every time a payment moves.
At onboarding, the provider screens the client entity, its directors, its beneficial owners, its authorised signatories and, for trusts, its trustees, settlors and beneficiaries. It repeats this screening whenever lists are updated and whenever the client's details change.
On each payment, the provider screens the parties and data in the payment itself. That typically includes:
- The originator and beneficiary names and addresses.
- The banks involved, including intermediary banks.
- The countries and cities mentioned anywhere in the payment.
- Free text, such as the payment reference and remittance information.
- For trade payments, the names of vessels, ports and goods where they appear in supporting documents.
For digital asset transfers, providers also screen wallet addresses using on-chain analytics, which can identify addresses associated with sanctioned parties, as well as screening the names of the people and entities involved.
Ownership and control
A sanctions list names specific people and entities. The prohibitions often reach further, covering property and entities that a listed person owns, holds or controls, directly or indirectly. A company that does not appear on any list can still be off limits because a listed person stands behind it.
This is one reason providers collect beneficial ownership information and screen it. Different jurisdictions apply different tests for when ownership or control is enough to extend sanctions to an unlisted entity, and providers that operate internationally often apply the strictest test relevant to a payment.
For clients, the practical consequence is that a provider may ask about the owners of a counterparty, not just the counterparty's name. If you trade with a company in a higher-risk region, expect questions about who owns it and be ready to share what you know from your own supplier due diligence. A clean answer, backed by a corporate registry extract or similar evidence, usually resolves the point quickly.
How fuzzy matching works
An exact-match system would miss most real hits. Names are spelled differently across languages, transliterated from other scripts in several ways, shortened, reordered or misspelt. Listed parties also use aliases. Screening software therefore uses fuzzy matching, which scores how similar two names are and raises an alert above a set threshold.
Fuzzy matching looks at things such as:
- Different spellings of the same name, such as variations in vowels or doubled letters.
- Transliterations of names originally written in Arabic, Cyrillic, Chinese or other scripts.
- Names in a different order, such as family name first.
- Partial matches, where part of a long name matches a listed name.
- Common words in company names, such as trading, holdings or international, which are usually weighted lower.
Providers tune their thresholds. Set too high, the system misses genuine matches. Set too low, it produces large volumes of alerts that hide the ones that matter. The tuning is documented and tested, and it is reviewed when lists or payment volumes change.
False positives
Most alerts are false positives: a name that resembles a listed name but belongs to someone else. A common surname, a short company name, or a city that shares a name with a sanctioned region can all produce alerts.
An illustrative case: a client pays a supplier whose director shares a first and family name with a listed individual. The screening system raises an alert. An analyst compares the details. The listed person was born in a different decade, has a different nationality and is associated with a different country. The supplier's director is identified by a corporate registry extract showing a date of birth and address that do not match. The analyst records the reasons, clears the alert and the payment proceeds.
Where the payment message alone does not contain enough to rule out a match, the analyst will ask for more. Typical requests include the counterparty's full name, date of birth or date of incorporation, address, nationality or country of registration, and sometimes a copy of an invoice or contract. Supplying these promptly is the quickest way to clear a false positive.
What happens when a payment is held
When an alert cannot be cleared immediately, the payment is held while the provider investigates. A held payment has not been rejected. It is waiting for information.
The usual sequence is:
- The screening system raises an alert and the payment stops before release.
- An analyst reviews the alert against the list entry and the information already held.
- If needed, the provider contacts the client with a specific request for information.
- The analyst reviews the response and either clears the alert, escalates it to the compliance officer, or concludes that it is a genuine match.
- A cleared payment is released. An escalated payment is reviewed further.
Payments can also be held by an intermediary or receiving bank, which runs its own screening. In that case your provider may receive a request from the bank and pass it on to you. Responses from the bank side can take longer, because the provider has no control over another institution's process.
The provider may not be able to tell you exactly which list or which entry caused the alert, but it will tell you what information it needs.
When a match is confirmed
A confirmed match changes the position completely. The provider cannot carry out the payment, and depending on the regime it may be required to freeze the funds or other property involved rather than return them.
Canadian sanctions laws also impose disclosure duties on people who hold property of a listed person, typically to the RCMP and, under some regimes, to CSIS. A reporting entity that holds property of a terrorist group or a listed person also has a separate reporting obligation to FINTRAC. The provider handles these obligations itself.
In limited circumstances, a person can apply to the Minister of Foreign Affairs for a permit to carry out an activity that would otherwise be prohibited. Permits are discretionary and are the exception, not a routine route.
Confirmed matches are rare in day-to-day business. They are, however, the reason the whole screening system exists, and the reason providers do not take shortcuts on alerts that might look like obvious false positives at first glance.
How clients can reduce delays
Clients cannot avoid screening, but they can make alerts quicker to clear:
- Use full legal names for counterparties, exactly as they appear on corporate registers, rather than abbreviations or trade names.
- Include complete addresses with country in every payment instruction.
- Keep payment references factual and specific, such as an invoice number and a brief description of goods. Avoid informal text, place names that are not relevant, or jokes.
- Tell your provider in advance about new counterparties in higher-risk regions and share your own due diligence on them.
- Answer information requests completely, with documents where you have them.
It also helps to keep a short file on each regular counterparty: its legal name, registration number, address, main owners and the goods or services it supplies. When an alert arises, that file usually contains everything the analyst needs, and a reply can go back within minutes rather than days.
Before you act
This article is general information about how sanctions screening works. It is not legal advice. If you trade with parties in sanctioned or higher-risk countries, take specialist legal advice on your own obligations, which apply whether or not your provider screens the payment.
Sanctions lists and regimes change often, so check the current official lists rather than relying on any summary. The compliance page sets out the CCYFX approach to compliance, and our overview of Canadian sanctions laws sets out the legal framework behind the lists.
