Entity and sanctions screening

Method

Names are normalized by Unicode NFKD decomposition, removal of combining marks, lowercasing, replacement of non-letter and non-digit characters with spaces, whitespace collapse, and merging runs of single-letter initials. Unicode letters are preserved. A core form removes trailing legal-form suffixes only.

The JavaScript normalization must remain behaviorally identical to norm() and core() in the ingest. scripts/check/normalize_parity.mjs compares the implementations across all built aliases.

Matches are classified as exact, legal-form-core, whole-token, substring or fuzzy name matches. Exact and core matches carry the list-specific severity. Contains and fuzzy matches are capped at flag and never block.

Severity is defined separately for every government list. For example, an OFAC SDN designation blocks, while CMIC is an investment restriction and the BIS Entity List indicates licensing requirements rather than a blanket trade ban.

Every ingested list receives a response row, including lists with no hit. The overall result is the worst severity across entity, jurisdiction, product-control and related compliance screens. A failed entity lookup, stale list estate or too-short name cannot produce a clean result.

The UK source is the FCDO UK Sanctions List. The OFSI Consolidated List closed on 2026-01-28.

Equations

Validation

• scripts/check/normalize_parity.mjs guards JavaScript and Python normalization parity across all 107,594 aliases. It previously caught a Thai and Khmer combining-mark divergence.
• Treasury SDN XML and the US Consolidated Screening List independently produced the same 19,199 SDN designations in the documented build.
• Every response carries list coverage, entry counts, retrieval dates, lists not covered and explicit limitations. Failed entity lookup raises the outcome to flag rather than silently returning clean.

Limitations

• Ownership is not screened. Under the OFAC 50 Percent Rule, an entity owned at least 50 percent by blocked persons can be blocked without appearing by name on a list.
• Entity-to-HS-sector mapping does not exist in these feeds. BACI has no firm dimension, so the entity and trade layers join only at jurisdiction level and cannot establish shipment-level attribution.
• Fuzzy and substring hits are possible name matches, not confirmed designations, and require identity review.
• The documented not-covered set includes the UN, Canada, Australia, Japan METI and Swiss SECO.
• List refresh is manual, and name screening can miss newly listed, renamed or differently transliterated entities.
• The registry vintage field is a platform BACI label required by the current schema; it does not date the sanctions estate. Per-list retrieval dates in the API response are the authoritative dates.

References

• Government sanctions and export-control lists linked in the data sources above.

Endpoints