How to screen a company against US sanctions lists (OFAC SDN and the CSL)

Updated 2026-10-27

Before you pay a new supplier, onboard a reseller or let an AI agent buy something, a basic question comes up: is this company on a US restricted-party list? This guide explains how to check it yourself for free, what to watch out for, and how to automate it when you have more than a handful of names.

What the lists are

Two names come up all the time:

• OFAC SDN list: the Specially Designated Nationals list, published by the U.S. Treasury's Office of Foreign Assets Control. Official site: ofac.treasury.gov.
• Consolidated Screening List (CSL): according to the official CSL page on trade.gov, it is a consolidation of multiple export screening lists of the Departments of Commerce, State and the Treasury. It is offered as a search engine, downloadable files and an API, and the tools are updated automatically every day at 5:00 AM Eastern time.

The CSL page also says it "may be used as an aid to industry in conducting electronic screens". It is a convenience layer, not the legal source. The same page tells users to check the official publication in the Federal Register and the official lists on the Commerce, State and Treasury websites before taking further action.

The free manual method

1. Open the CSL search engine and search the company's legal name. Try the name as printed on its registration documents, not only the brand name.
2. Repeat with known alternative names, the former name and the name in the local language if there is one.
3. For any hit, open the source_information_url of the record. It links to the specific agency page that explains the list and its restrictions.
4. For Treasury hits, confirm with the Sanctions List Search tool linked from the OFAC website.
5. Write down the date, the exact name searched and the result. A screening you cannot show later is worth little.

Pitfalls that cause wrong answers

• A match is not a verdict. The CSL page says that when a party appears to match, additional due diligence should be done before proceeding. A name match can be a different company. Compare address, country and other identifiers.
• Weak aliases create false hits. OFAC's own FAQ on weak aliases explains that some generic aliases "may generate a large volume of false hits" when run through a computer-based screening system. Expect noise with short or generic names.
• No result is not a certificate. An empty result only says the name did not match at that moment on those lists. It says nothing about the company's finances, ownership structure, or other countries' sanctions lists.
• OFAC does not prescribe one method. Its FAQ states that its regulations do not explicitly require a specific screening regime and that organisations choose based on their circumstances and compliance approach. So document your own policy: which lists, how often, who decides on a hit.

When manual is not enough

Checking one vendor by hand takes a few minutes. Checking a supplier file of 500 companies, or checking every new vendor automatically before a payment, does not scale. Typical triggers:

• onboarding a batch of vendors or resellers
• a procurement workflow that must screen before a purchase order
• an AI agent that selects and pays suppliers on its own

The fast way with Tolca

Tolca's verify-business service runs a KYB check on a company name and returns a simple verdict: ok, review, blocking or not_found. Sources: the US consolidated screening lists (including OFAC SDN), Companies House (UK), Canadian federal corporations, GLEIF (LEI records) and contractor licences in Québec, Washington and Oregon. It does not return data about individuals. Price: 0.05 $ per company.

Three ways to use it:

• Humans, in batch, paying by card: the Apify Store actor. Upload a list of companies and get a verdict for each.
• AI agents: POST https://tolca.tonbot.ca/v1/verify-business, paid per call with x402 (USDC on Base). The request format is described in the OpenAPI file.
• MCP clients: the public MCP server at https://tolca.tonbot.ca/mcp/public.

Treat review as "a human should look", the same way you would treat a manual hit: it is the start of due diligence, not a conclusion. And not_found means nothing matched in the sources, not that the company is trustworthy.

A simple policy you can copy

• ok: continue, keep the result with its date.
• review: pause the payment, compare identifiers, escalate to someone accountable.
• blocking: do not proceed, check the official list and get proper compliance advice.
• not_found: the company could not be matched in the sources; ask for registration documents.

This guide is general information, not legal advice. For decisions with legal exposure, rely on the official publications linked above and qualified compliance counsel.