You've Got a Real Match. Now What?

A confirmed sanctions match isn’t the end of a screening process. It's the start of an obligation most compliance content never covers, because almost everything written about sanctions screening focuses on finding the match. But the clocks that start running the moment a match is confirmed are short, specific, and urgent.  An initial blocking report is due to OFAC within 10 business days of the property becoming blocked, filed through the OFAC Reporting System under 31 CFR Part 501. 

Blocking vs. Rejecting, and Why It Determines Your Next Move

The first decision a confirmed match forces is whether the transaction or relationship gets blocked or rejected, and the two paths lead to different reports and different obligations.

Blocking

Blocking applies when a US person is in possession or control of property in which a sanctioned party has an interest, funds already in your custody, an existing account, an asset. Blocked property doesn't sit in your ordinary operating accounts. It must be segregated, and under most OFAC sanctions programs, blocked funds specifically need to be placed in a blocked, interest-bearing account, held separately from the institution's own funds and from any account the blocked party could otherwise access. 

The property stays blocked, earning interest for the blocked party's eventual benefit, until OFAC authorizes its release, whether through a general license, a specific license, or a delisting.

Rejecting

Rejecting applies when the transaction hasn't yet resulted in property coming into your possession, a wire transfer you decline to process, an application you decline to complete, because completing it would itself violate sanctions, but there's no property to hold onto because the transaction never completes. Rejected transactions get a different report, filed on the same 10-business-day clock, but without the ongoing custodial obligations that come with holding blocked property.

Getting this distinction wrong leads into the wrong report and, potentially, the wrong custodial treatment of funds that should have been segregated and weren't.

The Reporting Clocks

Both blocking and rejected-transaction reports are due within 10 business days of the triggering event, filed through OFAC's Reporting System under 31 CFR 501.603 and 501.604. Beyond the transaction-level reports, any US person holding blocked property must also file a comprehensive Annual Report of Blocked Property by September 30 of each year, covering everything held as of the preceding June 30, regardless of whether individual blocking reports were already filed during the year.

The UK offers a genuinely useful, if uncomfortable, comparison point. UK sanctions guidance requires breaches to be reported "as soon as reasonably practicable" after discovery, a standard, not a fixed number of days. The FCA's own May 2026 review of sanctions systems and controls found that firms averaged 116 days between identifying a suspected breach and reporting it in 2025, a slight improvement on 120 days in 2024, but still a long way from "as soon as reasonably practicable" in any ordinary reading of that phrase. 

The same report found that 35% of 2025 reports related to activity that had occurred in a prior year. A standard without a fixed number of days is not the same as a standard without teeth, and the FCA's own data shows the gap between what firms are supposed to do and what they're actually doing.

{{snippets-guide}}

What You Can and Cannot Tell the Customer

The instinct to be transparent with a customer runs directly against a specific legal prohibition.

Under 31 U.S.C. § 5318(g)(2), a financial institution and its officers, directors, employees, and agents are prohibited from notifying any person involved in a transaction that the transaction has been reported in a suspicious activity report. This is the "tipping off" prohibition, and it's a distinct legal violation from the underlying sanctions issue, meaning getting this wrong creates a second offence layered on top of whatever prompted the report in the first place.

What you generally can tell a customer is that you're unable to proceed with a transaction or unable to open or continue an account, a factual statement about the outcome, not a disclosure of why. What you generally cannot tell a customer is that a SAR has been filed, that the transaction was reported as suspicious, or any information that would reveal the existence of a report. A joint statement issued by FinCEN and the federal banking agencies addresses exactly this tension, clarifying how institutions should communicate with customers about declined or flagged transactions, including fraud-related communications, without crossing into disclosure of SAR-related information. 

The Specific License, and What Happens to the Relationship After

When blocked property needs to move, whether for a legitimate reason unrelated to the sanctions issue, a humanitarian exception, or a resolved case of mistaken identity, the path back is a specific license application, filed individually with OFAC and reviewed case by case. 

Processing timelines vary significantly by program and case complexity; reported ranges across published guidance run from a few months for straightforward matters to well over a year for complex or interagency-consulted cases, and there's no way to expedite the process once an application is in the queue. A customer relationship that hinges on a specific license decision may be in limbo for a long, and unpredictable, period.

What happens to the relationship in the meantime depends on the nature of the match. If it's a confirmed hit on an actual sanctioned party, the relationship generally cannot continue, funds stay blocked, the account stays frozen, and the institution's obligation is custodial instead of commercial. 

If it's resolved as a false positive or a case of mistaken identity, the institution can typically release the funds and resume the relationship once that determination is documented, though the documentation itself matters here. A cleared match needs a written, specific rationale, not just a status change back to normal, because the review chain that got the match wrong the first time is exactly what an examiner will want to see corrected in the future.

{{snippets-case}}

One Match, Start to Finish

Walk a single confirmed hit through the sequence. A screening system flags a customer name against the SDN list at a match score above threshold. An analyst reviews the alert, confirms it's a true match using secondary identifiers, not a false positive, and the account is blocked, funds moved to a segregated, interest-bearing account. 

Within 10 business days, a blocking report is filed with OFAC through ORS. The customer is told the institution is unable to proceed with the relationship, nothing more specific than that. No mention is made of any underlying report, if one was separately filed, that disclosure stays confidential under 31 U.S.C. 5318(g)(2). If the customer or counsel later contacts the institution asking whether a specific license could unblock the funds, that application, if pursued, goes to OFAC as a standalone, individually reviewed request, with no guaranteed timeline. The blocked property stays in the segregated account, accruing interest, until OFAC issues a decision. 

The relationship, for as long as the match stands unresolved, does not continue in its prior form.

Our Sanctions Screening Guide covers how to build the review process that confirms a match into a broader screening implementation. 

sanctions.io is a highly reliable and cost-effective solution for real-time screening. AI-powered and with an enterprise-grade API with 99.99% uptime are reasons why customers globally trust us with their compliance efforts and sanctions screening needs.

To learn more about how our sanctions, PEP, and criminal watchlist screening service can support your organisation's compliance program: Book a free Discovery Call.

We also encourage you to take advantage of our free 7-day trial to get started with your sanctions and AML screening (no credit card is required).

‍