Sanctions Screening Glossary: 30 Terms Every Compliance Team Should Know

New joiners on a compliance team drown in acronyms in week one: SDN, MEU, UBO, BIS, OFSI, CSL. This glossary defines the thirty terms that appear most often in screening work, in plain language, with the operational meaning (what each term obliges you to do), not just the dictionary entry.

LEGAL & REGULATORY NOTICE This document reflects publicly available regulatory guidance as of October 2026. It is intended for educational and research purposes and does not constitute legal advice.

---

1. Lists & Authorities

OFAC (Office of Foreign Assets Control). The U.S. Treasury office that administers American sanctions. Its rules bind U.S. persons. Non-U.S. companies are exposed when a transaction has a U.S. connection, most often a payment in U.S. dollars that clears through a U.S. bank, and a few programs add secondary sanctions aimed at non-U.S. parties.

SDN List (Specially Designated Nationals and Blocked Persons). OFAC's flagship list of individuals, entities, vessels, and aircraft whose property is blocked. U.S. persons must freeze their assets and stop transacting with them.

EU Consolidated List. The European Union's combined sanctions list covering asset freezes and travel bans across all EU regimes. Updated by the Commission's Financial Sanctions Database.

UN Consolidated List. Sanctions designations from the UN Security Council, binding on all member states. Often the floor every national regime builds on.

UK Sanctions List. The UK's list of sanctioned persons, published by the Foreign, Commonwealth & Development Office (FCDO). Since 28 January 2026 it is the only source of UK designations; OFSI's separate Consolidated List has closed. OFSI, part of HM Treasury, still implements and enforces UK financial sanctions. Post-Brexit the UK maintains autonomous regimes that can diverge from the EU.

BIS (Bureau of Industry and Security). The U.S. Commerce Department bureau enforcing export controls, including the Entity List and Military End-User rules.

Consolidated Screening List (CSL). A single download published by the U.S. International Trade Administration that combines export-control and sanctions screening lists from the Departments of Commerce, State and the Treasury, so exporters can check one source instead of several.

Sectoral sanctions. Restrictions targeting parts of an economy (e.g., energy, finance, defense) rather than named parties: you can transact with the entity but not in the restricted activity.

---

2. Screening Concepts

Sanctions screening. Checking a name or entity against watchlists before (and during) a business relationship. The check that produces CLEAR / match / review verdicts.

Denied party screening. Checking the export-control lists. The name comes from BIS's Denied Persons List, and the term now covers the whole family: the Entity List, Unverified List, Military End-User List and others. It covers different lists from sanctions screening, not a smaller set of the same ones. See denied party vs restricted party vs sanctions screening.

Restricted party screening. The umbrella term covering denied parties plus sanctioned, debarred, and otherwise restricted entities across trade regimes.

KYC (Know Your Customer). Identity verification at onboarding: who is this counterparty, really? Screening asks whether they're allowed; KYC establishes who they are.

Ongoing monitoring (rescreening). Re-checking existing customers and vendors against list updates. A party clean at onboarding can be designated later: only rescreening catches that.

Fuzzy matching. Name-matching tolerant of transliteration, spelling variants, and word order ("Mohammed" vs "Muhammad"). Exact matching alone misses spelling and transliteration variants, which turns real hits into false negatives. Names can also change outright: in our Pegasus breakdown, a designated supplier traded under a new name while keeping its listed phone number.

False positive / false negative. A false positive flags a clean party (operational cost); a false negative clears a sanctioned one (legal exposure). Tuning a program means choosing where on this tradeoff to sit, deliberately, with a record of why.

---

3. Ownership & Structure

UBO (Ultimate Beneficial Owner). The natural person who ultimately owns or controls an entity, no matter how many layers sit between. Most regimes look through to 25% ownership; sanctions analysis goes further.

OFAC 50 Percent Rule. Any entity owned 50% or more in aggregate by blocked persons is itself blocked, even if unnamed on any list. See our full compliance guide.

Control test. Separate from ownership: OFAC may designate entities controlled by blocked persons even under 50% ownership. Control without majority ownership is not a safe harbor.

Shell company. An entity with no real operations, often layered to obscure ownership. Not illegal per se, but a standard sanctions-evasion vehicle: opaque shells in high-risk jurisdictions deserve enhanced review.

---

4. Export Controls

ECCN (Export Control Classification Number). The alphanumeric code classifying dual-use items under the EAR. Screening the item matters as much as screening the party.

Deemed export. Releasing controlled technology to a foreign national inside your own country counts as exporting it to their country. Lab access, code repos, and factory tours are all in scope.

Entity List. A BIS list of foreign parties (Supplement No. 4 to Part 744 of the EAR) that need a license for exports, reexports and in-country transfers of specified items subject to the EAR. Many entries carry a policy of denial. A party can be on the Entity List and on no sanctions list.

Military End-User (MEU). Restrictions on exports supporting military applications in listed countries, including ostensibly civilian buyers with military ties.

Red flags (BIS). Published indicators of diversion risk: reluctant end-use disclosure, mismatched shipping routes, cash payments for expensive goods. Staff handling orders should know these by sight.

---

5. Process & Evidence

MLRO (Money Laundering Reporting Officer). The accountable individual for a firm's financial-crime controls in many jurisdictions. Screening decisions should be recorded in a form an MLRO can defend.

Audit trail. The record of what was screened, against which list versions, when, and with what result. A verdict you cannot reproduce from a record is an assertion, not evidence.

SHA-256 fingerprint. A cryptographic hash of a saved screening report. Anyone holding the report can recompute the hash and compare it with the fingerprint Sanctix stored when the report was saved, which shows whether the report has changed since. This is the basis of public verification.

Risk-based approach. Regulators expect controls proportionate to exposure: a domestic bakery and a cross-border payments firm do not need identical programs. Document why your controls fit your risk.

Voluntary self-disclosure. Reporting your own apparent violation to the authority before it finds out another way. OFAC treats it as significant mitigation, and it is lost if another agency gets there first, as in our Fracht FWO breakdown. Programs should include a path for it.

General vs specific license. A general license authorizes a category of otherwise-prohibited activity for everyone; a specific license authorizes one party's transaction on application. Check both before concluding a deal is dead.