Close Enough to Flag: What Sanctions Name Matching Catches and Misses

A sanctions screen on a shipping document compares the party names on the paperwork with the names and aliases on the sanctions lists, and flags anything that scores above a similarity threshold. We measured our own screen against the full consolidated list, rewriting each listed name the way it might plausibly appear on a document. A dropped letter was flagged in every one of 2,000 cases. The same words in a different order were missed in 98.7% of cases, a person’s name written surname first in 52%, and a name with its accents dropped in 28%. The single threshold also runs the other way: the four-letter name “Beta” is flagged against a listed entity called “BEHTA”.

This post walks through how the comparison works, what each kind of variation does to the score, and the part of sanctions exposure no name comparison can reach. The measurements were made on September 24th, 2026, with our production matcher.

What the screen compares, and against what

CargoLint screens three parties on each document: the shipper, the consignee, and the notify party, as the extraction step read them off the page. It compares each one against the OpenSanctions consolidated sanctions dataset, which merges 93 source lists, among them the US OFAC SDN list, the EU Council’s sanctioned entities, the UN Security Council consolidated list, and the UK FCDO list. On September 24th it held 72,620 designated targets carrying 299,745 names and aliases between them.

The aliases matter. The Islamic Republic of Iran Shipping Lines has 26 in the feed, including IRISL, IRISL Group, “The Islamic Republic of Iran Shipping Lines”, and translations of the name into more than a dozen languages. A document that says “IRISL” is flagged because the list records that alias. The matcher does not derive initialisms or translations by itself.

The comparison is Jaro-Winkler similarity. It pairs up equal characters that sit near the same position in both strings, deducts for pairs that appear in a different order, and adds a bonus for each of the first four characters the strings share at the start. The result is a score from 0 to 1. Both names are lowercased before comparing, and that is the only normalization. A score of 0.92 or above raises a finding. It is the same threshold our cross-document party comparison uses, and the measurements in this post are how we test what it does to sanctions names.

We are not alone in using this algorithm. OFAC’s own Sanctions List Search uses two: Jaro-Winkler, and Soundex, a phonetic code that groups names that sound alike. Asked whether it recommends a threshold, OFAC answers that it “cannot make such a recommendation because each search has its own unique set of facts surrounding it.”

How we measured

We took every listed name of a given shape, applied one rewrite to it, and screened the result against the whole list, all 299,745 names and aliases. A rewrite counts as missed only if it matches nothing on the list at 0.92 or above, so a variant that happens to match one of the entity’s other aliases counts as flagged. Where more than 2,000 names had a given shape, we screened a random sample of 2,000.

The rewrites are mechanical, so they measure the matcher, not how often each variation shows up on real paperwork.

What the scores catch

A typo, a missing comma, or a suffix added at the end changes one to four characters and leaves the rest in place. On a name of twenty or thirty characters that barely moves the score: “Islamic Republic of Iran Shiping Lines” scores 0.995 against the listed name, and the same name with “Ltd” added scores 0.981. The 11 misses in the “Ltd” row are all names of four or five characters, such as “Avax” and “NFPC”, where the added “ Ltd“ nearly doubles the length.

What the scores miss, and why

Word order. Jaro-Winkler only pairs characters that sit within roughly half the longer string’s length of each other, and it deducts for pairs that come out of order. Move two words from the front of a name to the back and most of the pairs are either out of range or out of order. “Shipping Lines of the Islamic Republic of Iran” is not flagged against the full list, with its 26 IRISL aliases. A person written surname first fares better, at 52% missed, largely because the list already records many people that way: of the 961 surname-first rewrites that were flagged, 659 matched an alias the list itself records surname first, with a comma.

Equivalent forms. “Company” and “Co., Ltd.” mean the same thing and share few characters. Whether the swap is flagged depends on how much of the name is left: “China Shipbuilding Trading Company” scores 0.932 against the listed “China Shipbuilding Trading Co., Ltd.” and is flagged, while “Sinotech Industry Company” scores 0.908 against “Sinotech Industry Co., Ltd.” and is not.

Accents. A dropped accent costs more than one character. Jaro-Winkler pairs each character with the first unused match nearby. When “é” becomes “e”, that “e” can pair with the next “e” further along the name, and every pair between them is then counted as out of order. On one listed person’s name, a single dropped accent took the score from 1.000 to 0.893. “Denkar Gemi Insa Anonim Sirketi”, a listed Turkish shipbuilder written without its three accented letters, scores 0.904 and is not flagged.

Field boundaries. When the extraction step returns the consignee’s name with the street address still attached, the screen compares the listed name against a much longer string. In our benchmark, “Islamic Republic of Iran Shipping Lines” followed by a Tehran address on the next line scores 0.907 against the listed name and is not flagged by anything on the full list. The name is in the field and still is not flagged. A document screen can only be as precise as the point where the extraction step ends the name field.

Each of these has a known remedy: compare names as sets of words instead of one string, fold accented letters to their plain forms, and reduce corporate suffixes to one form before comparing. OFAC lists this failure among the root causes of sanctions violations in its compliance framework: organizations whose screening “did not account for alternative spellings of prohibited countries or parties,” with Habana for Havana and Kuba for Cuba as its examples.

One threshold for every length

The same fixed threshold produces the opposite error on short names:

“Beta” and “BEHTA” differ by one letter, and in a four-letter name every other character pairs in order, so the score clears 0.92. “Beta” is flagged against a listed entity, while a listed company with its suffix written out is not. A fixed 0.92 is loose for short names and strict for long names with one changed word. The usual remedy is a threshold that rises as names get shorter.

The full party name avoids the short-name case: “Beta Logistics Ltd” scores 0.739 against BEHTA and is not flagged. The false positive appears when a document carries a short trading name on its own. False positives still carry a cost of their own: each one is a blocked shipment that someone has to clear by hand.

Why the misses are written down as tests

The full list does not fit in a unit test, so the screen’s behavior is pinned by a benchmark test against a small list carrying the same name shapes: a long formal name, an initialism alias, a short name, accented characters, corporate suffixes, punctuation, and a person. Some entries are real listed names (IRISL, Hafiz Darya Shipping Lines, BEHTA); the others are written for the test. Every case sits in one of three groups:

• Flagged variations must keep matching the right listed name. If one stops matching, the test names the variation that broke.
• Known gaps must keep not matching. That sounds backwards. The point is that the set of misses cannot change without someone noticing: when a change closes a gap, the test fails with a message telling whoever made the change to move the case into the flagged group, where it is protected from then on.
• Unrelated names such as “Maersk Line” and “Pacific Rim Trading Company” must never match. We ran those against the full list too, and none is flagged. The Beta case is pinned separately as a known false positive, to be moved into this group once a length-aware threshold lands.

A final check counts the flagged group as a whole, so a change that trades several catches for several misses shows up as a number that moved. Any threshold-based fuzzy screen has cases on both sides of its line. Without tests like these, where they fall is undocumented.

What a name screen cannot see

Everything above is about finding a listed name. Some sanctions exposure has no listed name to find.

OFAC’s 2014 guidance on the 50 Percent Rule states that any entity owned 50 percent or more, directly or indirectly and in the aggregate, by one or more blocked persons is itself blocked, “regardless of whether the entity itself is listed in the annex to an Executive order or otherwise placed on OFAC’s list of Specially Designated Nationals.” A subsidiary with an unrelated trading name, majority-owned by two listed parties, produces no finding in a name screen, because nothing on the list resembles its name. Finding it takes ownership research, which is a different kind of work from comparing strings.

Our screen also compares party names only. It does not screen the destination or origin country against embargo programs, and it does not screen vessels, addresses, or identifiers.

What a finding means, and what a clean result means

When the screen flags a name, the finding shows the field it came from, the value as extracted, the listed name it matched, and the similarity score. A sanctions match is one of the few findings that holds a document back from approval and marks the whole shipment, because a real match is the one outcome that must not reach filing. It is still a prompt to verify, not a determination: two unrelated companies can share a name, and the score measures how alike two spellings are, not whether they belong to the same company.

A clean result is narrower than it looks. It means no name or alias on the list scored 0.92 or higher against the party name as the extraction step read it. It says nothing about reordered names, stripped accents, spelled-out suffixes, or owners who are not on the list. A document screen covers the names printed on the paperwork, and the rest of the check stays with whoever knows the parties.

CargoLint provides document automation software, not sanctions compliance or legal advice. Screening findings are advisory; clear any potential match, and any question of ownership or control, with your compliance team, broker, or counsel. Measurements were made on September 24th, 2026 against the OpenSanctions consolidated sanctions feed as published that day; list contents change daily.