Sanctions Screening False Positives: The 60% Budget Drain You Can Actually Fix

Michelangelo Frigo (Co-Founder at Zyphe) Published August 21, 2026 Updated August 21, 2026

Magnifying glass over a list with one flagged row representing sanctions screening false positives

Most of a sanctions screening budget clears noise. See where false positives originate, why name-match tuning is the wrong fix, and what OFAC expects.

Table of contents

Sanctions screening false positives dominate the queue, with industry benchmarks putting the false-positive rate above 90 percent, so most of a team's effort clears noise rather than catching the rare true match.
They come from name fragmentation, transliteration, over-tuned thresholds, and uneven watchlist quality, not from a single fixable setting.
The OFAC SDN list, the EU consolidated list, and the UN list overlap but diverge, so screening against all of them multiplies near-duplicate alerts.
Name-match scoring is a downstream signal, not the right knob: lowering thresholds risks missing true hits, and raising them buries analysts.
A reasoning agent that reads the underlying records and disposes clear noise changes the unit economics in a way that threshold tuning alone cannot.
OFAC publishes no official acceptable false-positive rate, so the audit focus is on false-negative testing, tuning rationale, and calibration history, not hitting a magic number.

Sanctions screening false positives are alerts where a customer or transaction matches a sanctions list by name or attribute but is not actually the sanctioned party. They dominate screening queues, with benchmarks above 90 percent, so most of a team's effort clears noise rather than catching the rare genuine match.

TL;DR

If you run a sanctions operations team, you already know the maths: most of your budget clears noise, while the tiny fraction of alerts that actually matter sits in the same queue. Sanctions screening false positives are not a tuning afterthought, they are the dominant cost of the function, with the false-positive rate commonly benchmarked above 90 percent.

They originate in name fragmentation, transliteration of names across scripts, thresholds tuned to never miss, and the uneven quality of the watchlists themselves, compounded by screening against the OFAC, EU, and UN lists at once. The instinct is to tune the name-match score, but that is a downstream signal and tuning it trades false positives against false negatives. The durable fix is a reasoning layer that reads the underlying records and disposes clear noise. This guide covers the sources, the lists, why name-match tuning misleads, what a reasoning agent changes, the Starling lesson, and what OFAC actually inspects.

11 min read. Last updated 21 August 2026.

Where do sanctions screening false positives actually come from?

Sanctions screening false positives are not random; they come from identifiable structural causes, and naming them is the first step to fixing them. Name fragmentation: common names, partial matches, and missing or extra middle names generate matches against sanctioned individuals who share a name. Transliteration: names rendered across alphabets and scripts produce many plausible spellings, each a potential match. Threshold over-tuning: a matching engine set to never miss flags everything remotely similar, trading recall for an avalanche of noise. Watchlist quality: lists vary in the richness of their identifiers, so a hit on a sparse entry is hard to confirm or dismiss. And overlapping sanctions regimes multiply near-duplicate alerts for the same underlying name.

The common thread is that the alert volume is driven by the structure of names and lists, not by the actual prevalence of sanctioned customers, which is low. That is why the false-positive rate sits above 90 percent across the industry, and why throwing more analysts at the queue scales cost without scaling signal. The screening sits on top of the same monitoring stack covered in our AML transaction monitoring guide.

How do the OFAC, EU and UN lists overlap and diverge?

Most regulated firms screen against several sanctions regimes at once, and the relationship between them creates noise. The US OFAC Specially Designated Nationals list, the EU consolidated list, and the UN Security Council list share many designations, because major sanctions are often coordinated, but they diverge meaningfully: each adds names the others do not, uses different identifier formats, and updates on its own schedule.

The practical effect is twofold. First, a single underlying person can generate separate alerts across multiple lists, inflating volume. Second, divergence means you cannot rely on one list as a proxy for the others, so coverage requires screening all the relevant regimes for your footprint, which multiplies the near-duplicate matches. Good screening de-duplicates across regimes and reconciles the differing identifiers, rather than treating each list as an isolated source, and it screens against the full set Zyphe covers, including OFAC, the EU consolidated list, UK OFSI, and UN lists.

Why is name-match scoring the wrong layer to tune?

When the queue overflows, the reflex is to adjust the name-match score: raise the threshold to cut alerts, or lower it to catch more. Both are traps, because the match score is a downstream signal, a measure of textual similarity, not of whether the customer is actually the sanctioned party. Raise the threshold and you reduce false positives but risk missing a genuine hit, the one error sanctions compliance cannot make. Lower it and you drown analysts in even more noise.

Tuning the score therefore just slides you along a false-positive-versus-false-negative trade-off without addressing the cause. The real signal is contextual: does this customer's date of birth, nationality, address, and activity actually match the listed individual, or is it a name collision? That judgement lives above the match score, in reading the records, which is exactly the layer name-match tuning cannot reach. This is the same insight behind L1 alert triage with AI: the disposition, not the score, is where the leverage is.

How does reasoning-agent disposition differ from threshold tuning?

Threshold tuning changes how many alerts the engine emits. Reasoning-agent disposition changes what happens to each alert after it is emitted, and that is where the noise actually gets cleared. A reasoning agent takes a hit, fetches the customer's record and the listed entry, compares the identifiers, date of birth, nationality, identifiers, and judges whether they are the same person, writing a cited disposition and escalating only genuine candidates.

The difference is decisive. Tuning forces a single global trade-off; an agent makes a per-alert judgement, so it can clear the obvious name collisions, the bulk of the queue, while preserving recall on the cases that need a human. It does not lower your standards, it applies them faster and more consistently, with an audit trail per decision. That is how teams cut the sanctions screening false positives that consume the budget without raising the risk of a missed match, and it is the AI compliance agents pattern applied to sanctions.

What did the Starling FCA case reveal about screening?

The cautionary case is Starling Bank. In 2024 the FCA fined Starling about £29 million for financial-crime and sanctions-screening failings, after finding that for years it had screened customers against only a fraction of the full sanctions list. When Starling eventually re-ran its customer base against the complete list, it generated 48,000 alerts in a single pass, a backlog that had been invisible precisely because the screening was incomplete.

The lesson cuts two ways for false positives. First, completeness is non-negotiable: screening against a partial list hides risk, and fixing it surfaces a wave of alerts you must be able to work. Second, that wave is exactly the scenario where false-positive management makes or breaks you, because most of those 48,000 will be noise, and clearing them quickly and defensibly is the difference between a controlled remediation and an unworkable queue. Complete screening plus efficient disposition is the combination; one without the other fails.

What audit pack does OFAC inspect?

There is a myth that regulators publish an acceptable false-positive rate to hit. They do not. OFAC has no official benchmark false-positive percentage, so optimising to a number is optimising to a fiction. What OFAC and other regulators actually scrutinise is whether your screening program is risk-based, complete, and well-governed.

The audit pack they inspect includes evidence of false-negative testing, are you confident the engine is not missing true hits, the rationale for your matching thresholds and any tuning, a calibration history showing how and why settings changed, the completeness of the lists you screen against, and the quality and auditability of your alert dispositions. A program that can show why it is configured as it is, that it tests for misses, and that each disposition is documented, is defensible regardless of its raw false-positive rate. A program that simply cranked thresholds to reduce alerts, with no rationale, is not, which connects to the governance posture in AML compliance software.

When should you not just lower thresholds?

Lowering thresholds is the tempting shortcut, and there are clear cases where it is the wrong move. Never lower thresholds to hit a budget or volume target, because reducing alerts by loosening matching directly raises the chance of missing a true sanctioned party, the one error with the gravest consequences. Do not tune away alerts on higher-risk segments or in response to a backlog, where the temptation is greatest and the risk highest.

The defensible alternative is to attack the cause, not the symptom: improve data quality so identifiers disambiguate matches, de-duplicate across regimes, and add a reasoning layer that disposes noise on its merits rather than suppressing it at the engine. If you do adjust thresholds, do it with documented rationale and false-negative testing, never silently. The goal is fewer false positives with the same or better recall, not simply fewer alerts. To pressure-test your configuration, run your screening engine through a tuning review.

The bottom line

Sanctions screening false positives are the dominant cost of the function, not a tuning detail, and they come from the structure of names and lists rather than the real prevalence of sanctioned customers. That is why the rate sits above 90 percent and why adding analysts scales cost without scaling signal. The wrong fix is to crank the name-match threshold, which just trades false positives for the false negatives you cannot afford.

The right fix is completeness plus disposition: screen the full set of relevant lists, de-duplicate across regimes, improve identifier data, and add a reasoning layer that clears noise on the merits while preserving recall. Document your rationale and test for misses, because OFAC inspects governance, not a magic number. That is how you fix the budget drain without raising the one risk that matters.

Run your screening engine through a tuning review, or see how it works.

Cited sources

US Treasury OFAC, Specially Designated Nationals list and sanctions compliance: https://ofac.treasury.gov/
EU Sanctions Map (EU consolidated list): https://www.sanctionsmap.eu/
United Nations Security Council Consolidated List: https://www.un.org/securitycouncil/content/un-sc-consolidated-list
Financial Conduct Authority, Starling Bank enforcement (2024): https://www.fca.org.uk/news/press-releases/fca-fines-starling-bank-failings-financial-crime-systems-and-controls
FATF Recommendations: https://www.fatf-gafi.org/en/topics/fatf-recommendations.html

Michelangelo Frigo (Co-Founder at Zyphe) Michelangelo Frigo is a privacy and identity infrastructure expert and co-founder of Zyphe.

Frequently Asked Questions

There is no official acceptable rate; OFAC and other regulators do not publish a benchmark percentage. Industry false-positive rates commonly exceed 90 percent, but the regulatory question is not whether you hit a number, it is whether your program is risk-based, complete, well-governed, and tested for false negatives. Optimising to a target rate, especially by loosening matching, is a mistake.

No. OFAC focuses on whether your sanctions compliance program is risk-based and effective, including the completeness of your screening and the soundness of your controls, rather than a specific false-positive ratio. Its enforcement guidance emphasises a risk-based approach and the elements of an effective program, so your defensibility rests on governance and testing, not on achieving a particular false-positive percentage.

Auto-clearing purely on a low match score is risky, because the score measures textual similarity, not whether the customer is the sanctioned party, and a low-score hit can still be genuine. A safer approach is a reasoning layer that auto-disposes hits it can confidently clear on the underlying identifiers, with a documented rationale per decision, rather than blanket auto-clearing by score alone.

Retune on a risk basis and on triggers, not just on a calendar: when watchlists change materially, when your customer base or product mix shifts, when testing reveals misses, or when alert quality degrades. Any tuning should be documented with rationale and validated by false-negative testing, so a regulator can see why settings changed and that recall was preserved.

Because alert volume is driven by the structure of names and lists, not the actual prevalence of sanctioned customers. Common names, transliteration across scripts, sparse list identifiers, thresholds set to never miss, and overlapping OFAC, EU, and UN regimes all generate matches that are not the sanctioned party. The result is a false-positive rate above 90 percent across the industry.

Yes, in raw volume, because a single underlying name can match across the OFAC, EU, and UN lists and generate near-duplicate alerts. But screening the full set relevant to your footprint is necessary for completeness, as the Starling case showed. The answer is not to screen fewer lists but to de-duplicate across regimes and dispose the resulting noise efficiently.

A reasoning agent reduces the human burden of false positives by disposing the clear name collisions, the bulk of the queue, on the underlying identifiers, while escalating genuine candidates, with a cited audit trail. It changes the per-alert economics in a way threshold tuning cannot, and because it preserves recall rather than suppressing alerts, it reduces noise without raising the risk of a missed true match.

A false positive is an alert that is not actually the sanctioned party, the noise that dominates queues. A false negative is a genuine sanctioned party the system failed to flag, the rare but severe error sanctions compliance must avoid. The two trade off against each other in threshold tuning, which is why reducing false positives by loosening matching is dangerous: it raises false negatives.

Related products

Sanctions screening

that catches matches, not just names

Real-time sanctions and watchlist screening against 100K+ global lists, re-checked daily — on a privacy-first architecture that never builds a central PII honeypot.

Learn more →

Anti-Money Laundering

Trusted AML protection, built for global regulations

AI-driven risk detection with decentralized security to screen threats in real time, leveraging global compliance frameworks that can slash 39% of compliance costs.