How to Use Sanctions and Risk Lists Without Overreading Them

Sanctions and risk datasets are powerful because they turn difficult research questions into structured records.

They are dangerous for the same reason.

A structured result can look final.

It often is not.

A person appears in a sanctions dataset.

A company is linked to that person.

A PEP record exists.

A related entity appears in an investigative database.

Within a few clicks, the language can drift from:

a potentially relevant risk signal exists

to:

this company is sanctioned

or even:

this person is involved in wrongdoing.

That drift is not a tool problem.

It is an interpretation problem.

The safe method is to treat sanctions and risk data as typed, time-bound evidence that must be connected to an exact entity, exact source and exact legal or analytical meaning.

The core rule is:

resolve identity first, classify the type of risk signal second, verify the underlying authority third, and write no conclusion stronger than that signal actually supports.

The first question is not "Is there a hit?"

The first question is:

What kind of hit is this?

Possible answers include:

direct designation;
entity blocked by an ownership rule;
entity potentially captured by a control rule;
sanctioned owner or director;
PEP classification;
relative or close associate;
entity mentioned in a risk dataset;
investigative-document mention;
fuzzy name candidate;
historical listing;
removed or amended listing;
unrelated namesake.

Those are not equivalent.

A responsible workflow keeps them separate.

Start with entity resolution

Do not screen a company name before you know which company you mean.

Names are weak identifiers.

A minimum company identity record should ideally include:

legal name
jurisdiction
registration number
registered address
legal form
status
known previous names
other identifiers

For a person, useful discriminators can include:

full name
date of birth
nationality
passport/ID where lawfully public and relevant
address
known aliases
position

The more important the conclusion, the stronger the identity resolution should be.

OpenSanctions matching is candidate generation, not automatic identity

OpenSanctions provides a matching API specifically for screening people and companies against sanctions and PEP datasets.

Its current API documentation explains that matching can use:

fuzzy name similarity;
nationality;
dates of birth;
tax identifiers;
addresses;
other entity properties;

to score candidate matches and reduce false positives.

That wording matters.

The output is a candidate match.

It still requires review.

A score should not silently become:

same entity = true

without understanding the underlying identifiers.

Search relevance and match quality are different

OpenSanctions also distinguishes text search from entity matching.

Its current API documentation notes that search ranking expresses search relevance, not entity match quality.

This is an extremely useful methodological distinction.

A result appearing first in a search interface does not mean:

this is the same person or company.

Search answers:

which records are textually relevant?

Matching asks:

how closely does this structured entity resemble the target?

Those are different problems.

Direct designation is the cleanest sanctions signal

The simplest case is a direct list record.

Example:

Target legal entity:
Example Holdings Ltd
Company number:
12345678

Official sanctions list:
Example Holdings Ltd
Company number:
12345678

If the identifiers align and the record is current, you may be able to state:

Example Holdings Ltd appears directly on sanctions list X as of date Y.

Even here, preserve:

issuing authority;
sanctions regime/program;
list identifier;
listing date;
current status;
applicable measures if stated;
source URL;
retrieval time.

Do not reduce all sanctions regimes to one generic label.

The list itself may contain many different regimes

The United Nations Security Council Consolidated List is a useful example.

The UN explains that its consolidated list combines persons and entities subject to measures under multiple Security Council sanctions regimes.

The fact that names appear in one consolidated file does not mean:

every person is listed under the same regime;
every listing has the same legal basis;
every listing carries identical measures.

The specific sanctions committee and regime still matter.

This is why:

appears on the UN Consolidated List

is sometimes only the beginning of the legal/source analysis.

Aggregators are maps, not substitutes for the underlying authority

OpenSanctions is valuable because it normalizes many sanctions, PEP and risk datasets.

That makes screening far easier.

But for important conclusions, trace the record back to:

OFAC;
United Nations;
UK Sanctions List / OFSI;
EU or national authority;
other original issuing body.

A strong research chain looks like:

OpenSanctions candidate
↓
resolved entity
↓
source dataset
↓
issuing authority
↓
exact legal/list record
↓
current status

The aggregator makes the path easier.

It does not eliminate the path.

Ownership can create sanctions consequences even when the company is not named

This is one of the hardest concepts in sanctions research.

A company may not appear directly on a list and can still be subject to sanctions restrictions because of ownership rules.

But these rules are jurisdiction-specific.

Do not invent one global standard.

OFAC: the 50 Percent Rule

The U.S. Office of Foreign Assets Control states that entities owned, directly or indirectly, 50 percent or more in the aggregate by one or more blocked persons are themselves considered blocked under OFAC's 50 Percent Rule.

This means an entity can be blocked even when it is not separately named on the SDN List.

Example:

Blocked Person A owns 30%
Blocked Person B owns 25%
Combined blocked ownership = 55%

Under OFAC's rule, the aggregate ownership can matter.

The research implication is:

direct list search alone may be insufficient.

Ownership structure can change the result.

OFAC ownership and control are not the same test

OFAC also explicitly states that its 50 Percent Rule speaks to ownership, not control.

A company controlled by a blocked person but owned less than 50 percent in the relevant aggregate is not automatically blocked by virtue of that rule alone.

OFAC may still:

designate the entity;
identify blocked property;
restrict particular dealings;
apply other sanctions-program rules.

The methodological lesson is not:

control does not matter.

It is:

the legal effect of control depends on the applicable sanctions regime and rule.

That distinction is essential.

UK sanctions use a broader ownership-and-control framework

The UK framework illustrates why analysts cannot export the OFAC rule everywhere.

OFSI explains that UK financial sanctions regulations contain ownership-and-control tests intended to prevent designated persons from avoiding sanctions through companies, trusts or proxies.

The UK framework can therefore capture entities that are not explicitly named where the relevant ownership or control conditions are satisfied.

The exact test is legal and fact-specific.

Do not convert:

potentially controlled by designated person X

into:

definitely sanctioned

without applying the relevant UK regulation and current official guidance.

Different regimes can produce different answers

Imagine:

Designated person owns 40% of Company B
and appears able to exercise significant control.

Possible outcome:

OFAC 50 Percent Rule: not automatically blocked under that rule alone based solely on 40% ownership;
UK sanctions: a control analysis may still become relevant.

This is not a contradiction.

It reflects different legal frameworks.

The safe write-up is:

The entity's sanctions treatment depends on the applicable jurisdictional ownership/control rules and cannot be determined from direct-list presence alone.

Ownership evidence must itself be verified

A sanctions rule may depend on ownership.

That means your ownership data must be defensible.

Possible sources include:

official company register;
beneficial ownership register where available;
securities filings;
regulatory disclosures;
corporate filings;
official ownership statements.

Do not apply sanctions logic to a relationship inferred from:

shared address;
same director;
same website;
social-media claim.

A director is not automatically an owner.

An owner is not automatically a controller.

A parent company relationship needs evidence.

Indirect ownership can matter

Ownership chains can be multi-level.

Example:

Blocked Person
  ↓ 60%
Holding Company A
  ↓ 80%
Company B

Depending on the legal framework, indirect ownership calculations can make Company B relevant even though the blocked person is not shown as its direct shareholder.

This is where graph tools are useful.

But the graph should contain:

entity A
relationship type
ownership percentage
effective date
source

not anonymous lines.

A graph edge is not a legal conclusion

Aleph can be useful for organizing relationships among:

people;
companies;
documents;
ownership clues;
other entities.

But a graph edge can represent many things:

director
shareholder
owner
beneficial owner
mentioned in document
same address
family relation
unknown association

Those relationships have radically different sanctions significance.

Always label the edge.

PEP is not sanctions

This distinction deserves its own rule.

A politically exposed person is not automatically:

sanctioned;
criminal;
corrupt;
under investigation.

FATF guidance explicitly states that PEP status does not prejudge a connection to criminal activity and is not equivalent to being a criminal.

PEP identification belongs to a risk-management framework.

It should not become reputational accusation.

PEP datasets should preserve the exact category

Depending on the source, records can distinguish:

foreign PEP;
domestic PEP;
international-organization PEP;
family member;
close associate;
former PEP;
other public-function categories.

Do not collapse all of them into:

high risk person

The classification, applicable framework and current status matter.

"Risk list" is too broad unless you define the dataset

Sanctions and PEP data are already different.

Other risk-oriented datasets may include:

debarment;
law-enforcement notices;
wanted lists;
regulatory enforcement;
adverse media collections;
state-owned enterprise data;
persons of interest;
corruption investigations;
organized-crime datasets;
leaked data;
court records.

Each category has different meaning.

Write:

appears in World Bank debarment data

or:

appears in dataset X as a PEP

not:

appears on a risk list.

Specificity protects the analysis.

Dataset presence is not guilt

An investigative dataset can contain a person or company because they are:

witness;
victim;
counterparty;
customer;
officer;
document author;
unrelated reference;
target of an investigation;
subject of reporting.

The presence of a name is not the same as adverse significance.

Open the underlying record.

Read the relationship.

Adjacency is one of the biggest sources of overclaiming

Suppose:

Person A → sanctioned
Person A → director of Company B

What can you conclude?

You can conclude:

A sanctioned person is listed as a director of Company B, subject to source/date verification.

You cannot automatically conclude:

Company B is sanctioned.

Whether Company B is legally subject to sanctions can depend on:

ownership;
control;
jurisdiction;
applicable program;
transaction;
other facts.

The relationship creates a follow-up question.

Not a universal verdict.

Same address is even weaker

Suppose:

Company A → address X
Sanctioned Company B → address X

Possible explanations:

shared office building;
registered-agent address;
corporate-services provider;
coworking location;
old/stale filing;
genuine relationship.

A shared address is a signal.

It is not ownership proof.

Do not transform proximity into control.

Name similarity is the weakest common "hit"

Consider:

Global Trade LLC
Global Trading LLC
Global Trade Limited

A fuzzy matcher may reasonably surface all three.

The correct state is:

candidate

Then compare:

jurisdiction;
registration number;
address;
date of birth for people;
nationality;
aliases;
tax IDs;
source identifiers.

A sanctions workflow without entity resolution becomes a false-positive generator.

Negative screening also needs careful language

Suppose you search OpenSanctions and find nothing.

Do not write:

The company is not sanctioned.

A safer statement is:

No matching record was identified in the datasets and search/matching conditions used at the time checked.

Why?

Because:

datasets change;
list updates occur;
matching can fail;
ownership-derived restrictions may not appear as direct names;
jurisdiction-specific rules may apply;
identifiers may be incomplete.

Absence from an aggregator is not universal legal clearance.

Time is a first-class sanctions field

Sanctions change.

Entities can be:

added;
removed;
amended;
renamed;
granted licenses;
subject to changing measures;
affected by ownership changes.

Always record:

checked_at
source_updated_at if available
listing_date
delisting_date if relevant
program/regime

Do not describe sanctions status as timeless.

Current lists supersede previous versions

The UN, for example, publishes a current Consolidated List and indicates when it was last updated.

Historical versions can still matter for:

timeline research;
past transactions;
past reporting.

But historical listing should be written historically.

Example:

The entity appeared on list X during period Y.

not:

The entity is sanctioned.

Delisting does not erase historical relevance

Suppose a company was sanctioned in 2022 and removed in 2025.

For a 2023 investigation, the historical listing may be critical.

For a 2026 current-status assessment, the company should not be described as currently listed solely because an old article or archived dataset still contains it.

Current and historical questions must be separated.

Sanctions data can be legally high-impact

OSINT research can describe public records.

It should not pretend to replace sanctions legal advice.

If the result will determine:

whether a payment is lawful;
whether assets must be frozen;
whether a transaction is prohibited;
whether reporting is mandatory;
whether licensing is required;

consult the applicable authority, legal/compliance function or qualified counsel.

OSINT.dev should help users understand and document the evidence.

It should not issue a legal clearance verdict.

A practical evidence schema

For every important sanctions/risk finding, preserve:

target_entity_id
target_legal_name
jurisdiction
registration_number / personal identifiers

match_state
  candidate
  confirmed
  rejected
  unresolved

signal_type
  direct_designation
  ownership_derived
  control_relevant
  pep
  associate
  related_entity
  investigative_mention
  other

dataset
source_authority
program_or_regime
source_record_id
source_url

listing_or_record_date
retrieval_date
current_status

relationship_type
ownership_percentage if relevant
relationship_source

analyst_note
limitations

This structure prevents one Boolean from carrying too much meaning.

Worked example 1 — direct corporate designation

Target:

Example Trading Ltd
Company No. 12345678
Jurisdiction: X

OpenSanctions returns a candidate.

Identifiers match:

exact company number;
jurisdiction;
legal name.

The underlying official list contains the entity.

Finding

Example Trading Ltd, registration number 12345678, appears directly on authority X's sanctions list under program Y as of the date checked.

That is a direct-list finding.

Worked example 2 — same name, different company

Target:

Northstar Holdings Ltd
Jurisdiction: GB
Company No. 11111111

Sanctions candidate:

Northstar Holdings Limited
Jurisdiction: another country
Registration No. 99999999

Finding

A similarly named sanctioned entity exists, but the available identifiers support treating it as a different legal entity.

This is valuable research.

You prevented a false positive.

Worked example 3 — sanctioned director, company not directly listed

Target Company B is not directly listed.

Director A is directly sanctioned.

You verify:

Person A → current director of Company B

But you have no evidence that A owns 50% or otherwise satisfies an applicable ownership/control test.

Finding

Company B has a current director who is designated under sanctions regime X. This relationship does not by itself establish that Company B is directly listed or automatically subject to the same sanctions measures; ownership/control and transaction-specific analysis may be required under the applicable regime.

That is much stronger than:

Company B is sanctioned.

Worked example 4 — OFAC ownership rule

Target Company C is not named on the SDN list.

Verified ownership:

Blocked Person A: 30%
Blocked Person B: 25%

Under OFAC's aggregate 50 Percent Rule, this can be highly consequential.

Finding

Although Company C is not separately named, verified aggregate blocked-person ownership exceeds 50%, which engages OFAC's ownership rule subject to the applicable program and current official guidance.

For an operational transaction, escalate to sanctions counsel/compliance.

Worked example 5 — possible UK control

A designated person owns 35% but appears to possess significant control rights.

Do not apply OFAC's ownership-only rule and stop.

The UK framework can treat ownership/control differently.

Finding

The entity is not directly listed in the checked source, but the relationship may require a UK ownership-and-control analysis under the applicable regulations. The public evidence identified here is not sufficient by itself to issue a legal sanctions conclusion.

Worked example 6 — PEP record

OpenSanctions returns:

Person A
PEP
former minister

Identifiers match.

Finding

Person A is classified in the source dataset as a politically exposed person based on the documented public function.

Do not write:

Person A is sanctioned.

Do not write:

Person A is corrupt.

The PEP classification changes due-diligence context.

It is not a criminal allegation.

Worked example 7 — Aleph document mention

Aleph contains a document mentioning the target company alongside a sanctioned person.

Read the document.

It is a list of conference attendees.

Finding

The target company and designated person are both mentioned in conference document X.

That does not prove:

ownership;
control;
transaction;
partnership;
sanctions violation.

Context prevents the graph from overclaiming.

Worked example 8 — historical sanctions record

A 2022 report says Company D is sanctioned.

Current authority list no longer contains it.

You confirm delisting in 2024.

Finding

Company D was listed under regime X during the historical period relevant to the 2022 report and was later removed. It should not be described as currently listed based solely on historical sources.

Time solved the apparent contradiction.

OpenCorporates fits before and beside sanctions screening

OpenCorporates is useful because legal-entity clarity is one of the best defenses against false sanctions matches.

Use it to help establish:

exact legal name;
jurisdiction;
registration number;
status;
officers;
public-record provenance.

Then screen the normalized entity.

If an ownership question emerges, return to:

official registry;
filings;
ownership records;
other authoritative corporate sources.

The sequence is iterative.

Aleph fits when the sanctions signal creates a relationship question

Aleph becomes useful when you need to ask:

Where else does this entity appear?
Which documents describe the relationship?
Are ownership clues present?
Which people or companies connect to the target?
Can I build a sourced graph?

Use it to expand context.

Do not use the visual graph itself as the sanctions decision.

Every relevant edge needs evidence.

OpenSanctions fits as the normalized screening layer

OpenSanctions is especially useful for:

sanctions screening;
PEP screening;
structured entity matching;
dataset normalization;
source mapping;
programmatic workflows.

The strongest use is:

normalized target entity
↓
OpenSanctions match
↓
candidate review
↓
source dataset
↓
official authority
↓
legal/contextual interpretation

This is much stronger than:

name
↓
search box
↓
hit
↓
verdict

A decision tree

Ask these questions in order.

1. Is the target identity resolved?

If no:

stop and resolve it.

2. Is the record a direct list entry?

If yes:

verify authority, identifiers, regime and current status.

3. Is the signal ownership-derived?

If yes:

verify ownership and apply the correct jurisdiction-specific rule.

4. Is the signal control-related?

If yes:

identify which legal framework defines control and what evidence is required.

5. Is the signal PEP?

If yes:

treat it as a due-diligence/risk category, not a criminal or sanctions verdict.

6. Is the signal merely adjacent?

If yes:

preserve the relationship type and investigate only if relevant.

7. Is the record historical?

If yes:

keep the conclusion historical.

8. Will the finding drive a regulated transaction decision?

If yes:

escalate to the applicable legal/compliance process.

Confidence should reflect the evidence type

A useful model:

High confidence

exact official-list identifier;
exact company registration number;
authoritative source;
clear direct designation.

Medium confidence

strong multi-field candidate match;
relationship well supported;
underlying legal effect still requires analysis.

Low confidence

name-only match;
stale record;
unclear jurisdiction;
weak relationship;
secondary-source allegation.

Low confidence does not mean useless.

It means:

investigate before concluding.

Language discipline

Use exact verbs.

Stronger, accurate verbs

listed;
designated;
blocked under rule X;
classified as a PEP;
matched as a candidate;
linked by ownership;
mentioned in dataset;
appears in document;
requires further review.

Dangerous shorthand

sanctioned;
risky;
criminal;
corrupt;
affiliated;
controlled;

when the source does not establish the exact meaning.

The strongest writing is often the most specific.

Common mistakes

Mistake 1 — Searching the name before resolving the entity

This creates avoidable false positives.

Mistake 2 — Treating a fuzzy match as identity

Candidate is not confirmation.

Mistake 3 — Treating an aggregator as the legal authority

Trace material findings to the issuing source.

Mistake 4 — Treating direct listing and ownership-derived blocking as the same evidence

They have different proof chains.

Mistake 5 — Applying OFAC's 50 Percent Rule globally

Sanctions frameworks differ.

Mistake 6 — Treating control as identical across jurisdictions

Definitions and legal effects vary.

Mistake 7 — Calling PEPs sanctioned or criminal

PEP is a risk-management classification.

Mistake 8 — Treating a sanctioned director as proof the company is sanctioned

Relationship does not automatically transfer legal status.

Mistake 9 — Treating a shared address as affiliation

Low-specificity evidence needs context.

Mistake 10 — Ignoring time

Listings and ownership change.

Mistake 11 — Treating no database hit as legal clearance

Coverage and derivative rules matter.

Mistake 12 — Writing a legal verdict from an OSINT workflow

High-impact sanctions decisions require the applicable compliance/legal framework.

A repeatable sanctions and risk workflow

Use this sequence.

1. Define the question

Are you asking about:

current sanctions status;
historical sanctions status;
PEP status;
ownership exposure;
investigative context?

2. Resolve the entity

Use strong identifiers.

3. Screen the correct dataset scope

Do not mix sanctions and PEP searches unless that is intentional.

4. Review candidate quality

Compare:

IDs;
jurisdiction;
DOB;
address;
aliases.

5. Classify the signal

Direct, ownership-derived, control-relevant, PEP, adjacency, historical, other.

6. Trace to the source authority

Preserve the exact record.

7. Verify relationships

Especially ownership and control.

8. Apply time

Current or historical?

9. Corroborate

Use corporate records, filings, documents and official guidance.

10. Write the narrow finding

Describe the evidence type.

11. Escalate where legal consequence matters

Do not issue legal clearance from an OSINT article.

12. Stop

Do not convert every sanctions adjacency into unlimited relationship expansion.

Related OSINT.dev tools

OpenSanctions

Use for:

normalized sanctions/PEP datasets;
entity matching;
candidate screening;
source-dataset discovery.

Treat matching output as candidates requiring review.

OpenCorporates

Use to improve legal-entity identity before and during screening.

Particularly useful for:

company number;
jurisdiction;
public-record provenance;
officer context.

OCCRP Aleph

Use when a sanctions signal creates a broader document or relationship question.

Best for:

cross-referencing;
documents;
entity graphs;
investigative context.

A Responsible Method for Company Research with Public Sources

Use the broader company-research guide when the task extends beyond risk screening into:

legal identity;
ownership/control;
corporate history;
documentary corroboration.

The core principle

Sanctions and risk data should make your research more precise, not more accusatory.

Use this sequence:

identity → dataset scope → candidate match → signal type → source authority → relationship verification → jurisdiction-specific rule → time → calibrated conclusion

The most important distinction is not:

hit / no hit

It is:

what exactly is the relationship between this resolved entity and this exact record under this exact framework at this exact time?

A direct designation is not a PEP record.

A PEP is not a criminal.

A sanctioned director does not automatically make a company sanctioned.

A control relationship does not have identical legal effect in every jurisdiction.

A historical listing is not necessarily a current listing.

And an aggregator is not a substitute for the authority that created the underlying rule.

The goal is not to make sanctions research sound certain.

It is to make the boundaries of certainty auditable.

References

Primary and official references used in this guide:

OpenSanctions API — search, matching and dataset scopes
https://api.opensanctions.org/docs
OpenSanctions — Data Documentation
https://www.opensanctions.org/docs/data/
OpenSanctions — Matching API
https://www.opensanctions.org/docs/api/matching/
United Nations Security Council — Consolidated Sanctions List
https://main.un.org/securitycouncil/en/content/un-sc-consolidated-list
United States Treasury / OFAC — Frequently Asked Questions
https://ofac.treasury.gov/faqs
OFAC FAQ 401 — 50 Percent Rule and indirect ownership
https://ofac.treasury.gov/faqs/401
OFAC FAQ 398 — ownership versus control under the 50 Percent Rule
https://ofac.treasury.gov/faqs/398
UK Office of Financial Sanctions Implementation — ownership and control guidance/context
https://ofsi.blog.gov.uk/2026/02/16/call-for-evidence-on-ownership-and-control-in-financial-sanctions-regulations/
UK OFSI — Am I dealing with a sanctioned entity?
https://ofsi.blog.gov.uk/2019/12/17/am-i-dealing-with-a-sanctioned-entity/
FATF — Politically Exposed Persons, Recommendations 12 and 22
https://www.fatf-gafi.org/content/dam/fatf/documents/recommendations/Guidance-PEP-Rec12-22.pdf

tagsOSINTEthicalVerificationCompanyRisk Intelligence

cite this article

OSINT.dev · Published Apr 21, 2026 · Updated Aug 20, 2026. Canonical URL: https://osint.dev/articles/how-to-use-sanctions-and-risk-lists-without-overreading-them

03explore next