How to screen QuickBooks vendors against the OFAC list

Screening a QuickBooks vendor means checking the vendor's name against the sanctions lists published by the Office of Foreign Assets Control (OFAC). You do it before you pay them. This guide covers the manual way: export the list, search each name, and keep a record. If your books are in Xero, see how to check Xero contacts against sanctions lists.

What you are checking and why vendors come first

OFAC publishes the Specially Designated Nationals (SDN) List and several smaller lists. All U.S. persons must comply with OFAC sanctions. That covers U.S. citizens, permanent residents, anyone in the United States, and every U.S.-incorporated business. U.S. persons are generally prohibited from dealing with the people and companies on the SDN List.

Start with vendors because vendors are where your money goes out. A bill payment to a listed company is a transaction with a blocked person. OFAC applies strict liability to civil penalties, as it states in its 2020 advisory on ransomware payments. You can be liable even if you did not know the vendor was listed.

OFAC's regulations do not prescribe one screening method. You choose an approach that fits your business. For what a proportionate setup looks like, see do small businesses need OFAC screening. For a small business on QuickBooks Online, the usual starting point is a full check of the vendor list, then a check of each new vendor before the first payment.

Step by step, by hand

1. Export the vendor list from QuickBooks Online

QuickBooks Online has a standard report called the Vendor Contact List. Intuit's help article gives these steps:

1. Go to Reports, then Standard reports.
2. In the Find report by name box, type "contact list".
3. Select Vendor Contact List.
4. Use Columns to add the fields you want. Add the address fields if they are available. You will use them later as tie-breakers.
5. Select Refresh report.
6. Select Export/Print, then Export to Excel.

Intuit notes that report layouts differ between the classic view and the newer report experience. If a label on your screen does not match, look for the same report name and the export option near the top of the report.

Open the file and delete the report header rows so the column names sit in row 1. Add four new columns: Date checked, List checked, Result and Checked by.

2. Search each name in OFAC Sanctions List Search

Open OFAC Sanctions List Search. It is OFAC's free lookup tool. It searches the SDN List and OFAC's non-SDN lists.

For each vendor:

1. Paste the vendor name into the Name field. Use the legal name, and run the trade name too if it differs.
2. Set List to All so the search covers SDN and non-SDN entries.
3. Lower the Minimum Name Score slider below 100. At 100 the tool returns exact character matches only. A lower setting returns similar spellings as well.
4. Run the search and read every row in the results table.

OFAC does not recommend a specific score threshold. FAQ 250 says each search has its own facts. Pick a setting, write it down, and use the same one every time so your log is consistent.

3. Record the result for each name

Fill in the four columns for every vendor, including the clear ones. A blank row tells an auditor nothing.

• Date checked: the day you ran the search.
• List checked: "OFAC Sanctions List Search, all lists". Add the list update date the search page shows, and the minimum score you used.
• Result: "No results", "Reviewed, not a match" with a short reason, or "Possible match, escalated".
• Checked by: the name of the person who ran the search.

OFAC's recordkeeping rule, 31 CFR 501.601, sets a 10-year retention period. Save each dated copy of the spreadsheet. Do not overwrite last quarter's file.

Screen customers too

Vendors carry the clearest risk because you send them money. The prohibition covers dealings with blocked persons in either direction, though. Taking a payment from a listed customer, or shipping them goods, is also a transaction with a blocked person.

The process is the same. QuickBooks Online has a Customer Contact List under Standard reports, and it exports the same way. Run it, add the same four columns, and search each customer name. If your customer list is long, start with active customers and anyone outside the United States.

How to read the results

The score

The score shows how similar the name you typed is to the name on the list. A score of 100 is an exact match. Lower scores are potential matches. A high score does not prove the vendor is the listed party. It means the names look alike.

Only the name field affects the score. Anything you type in the address, city or country fields has no effect on it.

Aliases

Many SDN entries include aliases, listed as AKAs. A result may show a name that looks different from the one you typed. Open the entry and read every name on it before you decide.

Some aliases are flagged as weak. OFAC defines a weak alias as a broad or generic alias that may produce many false hits. OFAC does not expect you to screen for weak aliases. They are still useful when another detail already points at a listed party.

Tie-breakers

Open the full entry for every result you cannot dismiss on the name alone. OFAC's FAQ 5 says to compare the listing's details against your own records:

• Address and country
• Nationality
• Date of birth, for individuals
• Identification numbers, such as a tax or registration number

Pull these from the vendor record in QuickBooks and from the vendor's W-9 or invoices.

What a false positive looks like

Say your vendor is "Ocean Freight Services LLC" in Ohio. The search returns a shipping company with a similar name, a Middle East address and a foreign registration number. The names overlap on common words. Nothing else matches. That is a false positive.

Record it as "Reviewed, not a match" and write the reason: different country, different address, different registration number. OFAC's FAQ 5 says many potential matches are false positives. If few details match, the match may not be valid.

What to do with a likely match

A likely match is a result where the name is exact or close and the other details also line up. For example, the name, country and address all match.

Then follow the steps in OFAC FAQ 5:

1. Confirm the hit is on an OFAC list, and not on a list kept by another agency.
2. Review the full list entry against everything you know about the vendor.
3. Check whether an OFAC general or specific license or an exemption applies.
4. If the match holds, the property must be blocked or the transaction rejected. Blocked funds go into a segregated, interest-bearing account at a U.S. federally insured institution.
5. Report any blocked or rejected transaction to OFAC within 10 business days.
6. Keep complete records of the review.

OFAC does not confirm potential matches or false positives for you. The decision stays with your business. You can call the OFAC Compliance Hotline with questions about the guidance.

Get a sanctions lawyer involved as soon as a match looks real. Do the same if money has already gone to the vendor, or if you are unsure whether to block or reject. A blocked-property report has legal consequences, and the 10-business-day clock is short. This guide is not legal advice.

Keeping it current

A clean result is only true on the day you ran it. OFAC adds and removes names often. The Recent Actions page lists each change by date, with titles such as "Counter Terrorism Designations" and "Iran-related Designations". You can sign up for OFAC's email updates from that page.

A workable manual routine looks like this:

1. Screen every new vendor before the first bill payment.
2. Rescreen the full vendor and customer lists on a fixed schedule, such as monthly.
3. Rescreen sooner after a large Recent Actions update.
4. Save a new dated copy of the log each time.

The spreadsheet log works at 30 vendors. At 300 it gets hard to keep up. Each rescreen means another export, another round of searches, and another set of review notes. New vendors get added in QuickBooks between runs and miss the check. Edited names drift from the logged version. Review notes for old false positives get lost between files, so the same hits get reviewed again.

Sanctions Clear, opening to QuickBooks Online and Xero users, will run these searches against your vendors and customers, add a note with the result to each record, and keep the dated record of every check. It is not available yet. Until then, the manual process above does the job.