False Match on a Sanctions List: How a Founder's Account Was Unfrozen in 7 Weeks

This case study is anonymized and based on Aegis Reputation Lab's aggregated practice with projects of this type. The client's name, country of business registration, and certain details have been altered under NDA terms — in this text, the client is referred to as "Marat Safin."

The email from the bank arrived without warning: transactions on the account were suspended "as part of a standard compliance procedure," and a payment to a supplier was on hold indefinitely. No phone representative could, or would, explain the reason more precisely. Marat Safin — co-owner of a trading company with accounts in several jurisdictions — only found out what was going on three weeks later, when he received a formal request from the compliance department: the bank's screening system had flagged a full match between his name, in Latin transliteration, and an approximate date of birth, against an entry on the OFAC SDN sanctions list. The person behind that entry had no connection to Marat whatsoever.

What actually happened

The bank was under no obligation to explain the reason for the freeze immediately, and in most jurisdictions has a formal right not to — this is a standard defensive reaction from a compliance department whenever the screening system triggers, not a signal that some investigation had been opened against the client. But for the business, three weeks of uncertainty cost a missed delivery deadline and tense negotiations with a counterparty who didn't understand why the payment wasn't going through.

The mechanics of a false match: why it happens regularly

Nearly all Tier 1–2 banks and payment institutions use commercial screening systems to vet counterparties — World-Check (now part of LSEG, formerly Refinitiv/Thomson Reuters), Dow Jones Risk & Compliance, LexisNexis WorldCompliance, and similar. These systems check client data in real time against sanctions lists from several jurisdictions at once: the US Office of Foreign Assets Control's (OFAC) SDN list, the EU's Consolidated Sanctions List, the UK's OFSI list, and UN Security Council lists.

A match is almost never literal across every field — it's statistical. The system assigns a weight to each matching field: surname, first name, birth year, nationality, and sometimes a similar-sounding spelling in another alphabet. Transliteration of a name from Cyrillic, Arabic, or another non-Latin alphabet is especially prone to this: the same person can appear across different documents and databases in three or four different Latin renderings, and at least one of them may statistically coincide with a list entry. Add an approximate — rather than exact — date of birth, sometimes recorded as only a year, and the odds of a coincidental match for a common name stop looking so remote.

From the bank's side, this looks different: the system generated an alert, and internal policy requires any alert against an SDN-type list to trigger an immediate freeze on transactions pending manual review — regardless of how plausible the match looks at first glance.

Why the bank doesn't call and sort it out itself

In Marat Safin's case, as in most similar situations, the bank wasn't acting with hostility — it was following procedures dictated by FATF requirements and national anti-money-laundering (AML/CFT) law. A bank's compliance department answers to the regulator, not to the client, and the cost of an error in the direction of "we missed a genuine match" is incomparable to the cost of an error in the direction of "we froze a legitimate client's account." That's an asymmetric risk, and it explains why banks almost never take it upon themselves to sort out a match independently, and almost always shift the burden of proof onto the client.

That's precisely why speed of response in the first few days matters just as much here as in any other reputational crisis — the parallel legal, communication, and monitoring tracks relevant to situations like this are covered in detail in "Reputational Crisis Management: The First 72 Hours" — the principle is the same: the sooner a parallel evidence-gathering track is set up, the smaller the chance the freeze drags on for months simply because the bank didn't get the right document package in time.

PEP or sanctions: why the two never got tangled up in Marat's case

The first question the client's lawyers asked upon receiving the bank's request was whether this involved PEP (Politically Exposed Person) status. That's a sensible precaution, because banks often react to both signals with the same level of caution — but the grounds and procedures are different, and it's important not to conflate them in a single communication to the bank.

PEP status is assigned because of a position or connection to one and carries no legal force — it's an internal flag for enhanced due diligence. A sanctions list is an official decision by a state or intergovernmental body, binding on every regulated organization. A false sanctions match isn't a dispute over a status (there is no status attaching to the client to begin with) — it's a correction of a technical matching error: proof that the list entry belongs to a different person. How to dispute an already-assigned but inaccurate or outdated PEP status is a separate topic and a separate procedure, covered in detail in "World-Check and PEP Status: How to Remove an Inaccurate Record."

See also · Compliance Databases World-Check and PEP Status: How to Remove an Inaccurate Record A different database, different grounds, and a different procedure — when the issue is PEP status itself rather than a name match. Read the article →

In Marat's case, the Aegis Reputation Lab team made a point from the very first exchange with the bank of using the precise term "false positive sanctions match" rather than the generic "compliance review error" — this matters, because a bank's compliance officer only routes a request down a specific, well-understood protocol when the grounds are stated precisely.

How differently banks react to matches like this

The reaction to the same false match varies noticeably depending on the jurisdiction where the account is held — worth planning for in advance rather than discovering after the fact.

Swiss and European banks, on average, respond more slowly and demand more documentation — in those jurisdictions, excess caution has historically been cheaper than a mistake. Banks in the UAE and Singapore more often offer a faster and more predictable path to clearing a technical error — but precisely because the process is formalized, any deviation from protocol (an incomplete document package, an imprecise formulation) is penalized there with the sharpest delays.

What actually cleared the suspicion

By the third week it was clear that phone explanations alone wouldn't be enough — a bank's compliance department works with documents, not verbal assurances. The package that ultimately resolved the issue had several components, and none of them alone would have been sufficient.

An independent compliance dossier. Aegis Reputation Lab prepared a document that broke down the match line by line: comparing the full name, every known transliteration variant, birth year, and country of origin — showing exactly where the client and the listed individual diverged despite a formal match under the screening algorithm.

A notarized identity confirmation. An official document verifying the client's identity, leaving no room for doubt about who exactly had approached the bank.

A letter of good standing from a prior bank. Confirmation from a bank where the client already had an unblemished service history — a meaningful signal to a compliance department that the client had already passed a similar check before.

Direct correspondence with the compliance officer, not the front office. One of the practical lessons from this case: as long as correspondence ran through the ordinary account manager, documents got lost between departments and had to be requested again. Once direct contact was established with the compliance officer responsible for the specific case, the pace of review picked up noticeably.

Worth noting separately is what this case did not require: a formal petition to the sanctions list holder asking it to correct or remove the entry (a formal delisting petition to OFAC, the EU, or UK OFSI). Such a petition only makes sense if the error is rooted in the list entry itself — for example, if the entry merges data belonging to two different people. In Marat's case, the entry itself was correctly compiled; the error was purely in the automated matching on the bank's side, so the entire process was resolved through correspondence with the bank itself, without escalating to the level of a state regulator.

How long different scenarios take

The spread here matters: a technical error that the bank itself resolves based on submitted documents is a matter of weeks. Once the question escalates to the list holder, it becomes a different process, with different participants and different timelines that no one can promise in advance.

Where Aegis's work ends and a lawyer's work begins

We spell out this boundary with a client in the very first conversation, and in Marat's case it was documented in writing. Aegis Reputation Lab is not a law firm and does not represent clients in sanctions proceedings — had the error been in the list entry itself, requiring a formal petition to OFAC, the EU, or UK OFSI, that part would have been handled by an outside law firm specializing in sanctions law.

Our part of the work is compliance-reputational: an independent dossier, a breakdown of the match, communication with the bank, and systematic work on the client's digital profile so that at the next check — at this bank or another — a compliance officer sees a consistent, verifiable digital footprint rather than a bare name match. A separate article covers this in depth — "Digital Profile and International Compliance" — which breaks down how open sources influence decisions made by banks, consulates, and deal partners.

Service Compliance Risk Assessment Discuss →

What to do in the first few days if an account is frozen over a name match

Most clients' first instinct is either to demand explanations from the bank in an escalating tone, or to wait and assume the bank will sort it out on its own. Both strategies drag the process out equally. In Marat's case, a different sequence proved effective: first document the fact and the wording of the freeze in writing (verbal explanations over the phone carry no weight in any later dispute), then request written grounds from the bank in parallel — to whatever extent that's obtainable — and start assembling an independent dossier without waiting for the bank's response. Waiting for a reply before starting to gather documents is the single most common reason a simple technical error stretches from weeks into months.

If a business holds accounts at multiple banks or in multiple jurisdictions, a separate task for the first few days is to check whether the same match has triggered at other servicing banks in parallel, not just the one that already sent a letter: banks don't update their screening data in sync, and a second freeze can arrive weeks later, once attention has already shifted to the first bank. After resolution, it's worth putting the client's name on regular monitoring across open sources and screening databases — a separate Aegis Reputation Lab service that surfaces a new match before the bank reacts to it, rather than through an official account-freeze letter.

1. Document the wording of the freeze in writing and ask the bank to confirm the grounds officially.
2. Without waiting for the bank's reply, start assembling an independent dossier and supporting documents.
3. Check the client's other accounts at other banks and in other jurisdictions for the same match.
4. Establish direct contact with the compliance officer, not only the front office handling the account.
5. After the freeze is lifted, put the name on regular monitoring to avoid missing a repeat trigger.

What we don't promise

The outcome of this case is an unfrozen account and a documented bank position for the future — not a guarantee that a similar match won't recur at the next check at a different institution: every bank has its own screening system, its own sensitivity thresholds, and its own database update schedule. Nor can an exact timeline be promised once a matter moves beyond correspondence with the bank — once the list holder itself gets involved, timelines are set by its own procedures, not by how quickly the client or the agency would like the process to move.

Questions that come up in similar situations

If an account is frozen over a similar match, or a new account is about to be opened in a jurisdiction where a comparable screening reaction can reasonably be expected, it makes sense to run a preventive risk assessment before the screening system makes the decision for you. Aegis Reputation Lab prepares independent compliance dossiers, communicates with banks on cases like this across Tier 1–3 jurisdictions, and builds a resilient client digital profile that reduces the odds of repeat false matches. Contact us to discuss your situation.

See also

Compliance Databases

World-Check and PEP Status: How to Remove an Inaccurate Record and Restore Banks' Trust

Read the article → Compliance

Digital Profile and International Compliance: How Online Reputation Affects Accounts, Visas, and Deals Abroad

Read the article → Crisis Management

Reputational Crisis Management: The SEO Reputation Protocol for the First 72 Hours After a Data Leak or Scandal

Read the article → Anonymized under NDA

Clean Search Results in 4 Countries in 8 Months: An SEO Reputation Project for a Senior Executive

Read the case study → Anonymized under NDA

The Investor Who Googled and Changed Their Mind: Synchronizing Search Results in 3 Countries in 7 Months

Read the case study →

Show more