Sanctions Screening for Merchants: Who Is Checked and Why Some Countries Block

Banks and acquirers screen each name in a merchant file against sanctions lists: the entity, signer and owners at onboarding, then payment geography and wire parties once live. Matching runs on names, so common names produce false positives that a date of birth and an ID clear. A business run from a comprehensively sanctioned country cannot be onboarded; a US entity changes nothing. Expect to be asked where you operate from; answer truthfully.

Sanctions screening compares every name in your merchant file against lists of persons, companies and jurisdictions that US institutions may not do business with. A bank runs it at account opening and on every wire; an acquirer runs it on the entity, the signer and the beneficial owners before it issues a MID, then on the transactions the MID processes. The main US list is the Specially Designated Nationals (SDN) list kept by OFAC, the Treasury's Office of Foreign Assets Control; other governments' lists sit on top. A hit is not always a sanctioned person: matching works on names, and common names collide. A confirmed hit, or a business run from a comprehensively sanctioned country, ends the file everywhere, because no US bank, acquirer or card network can serve it.

Who is screened, when, and against what

The bank screens at account opening, at every refresh and on the parties to each wire; the acquirer at underwriting, at every re-review and on card payments; the card networks at their own level, which is why some cards are unreachable whatever the acquirer decides. The KYB guide on this blog covers the wider review.

How list matching works, and why common names collide

A screening engine does not look for an exact match but for anything close enough to be the listed person, so it applies fuzzy matching: transposed letters, missing middle names, reversed name order and transliterations from other scripts, where one name has several Latin spellings. The threshold errs on the side of a false positive, so the engine returns many people who are not the listed person. A signer with a frequent surname will produce a partial hit at some point; it is normal and cleared with identifiers the list entry carries.

• Date of birth: many entries carry one; a different date of birth on the ID usually closes the hit.
• Place of birth and nationality: checked against the government ID on file.
• Address history: the listed person's known addresses against the proof of address.
• Identity numbers: a passport or national ID number on the entry that does not match the one on file.

A compliance analyst clears it, not the merchant, with the documents already in the file; a government ID and a proof of address that agree with each other are what stands between a partial hit and a stalled file. On an IBOCore package the director is a real, KYC-verified US resident whose government ID and proof of address ship in the bundle, exclusive to one merchant, so those identifiers are on hand.

Country rules: comprehensive programmes, targeted programmes and risk ratings

Sanctions programmes come in two shapes. A comprehensive programme covers a whole country or territory: US persons, which includes every US bank, acquirer and processor and the US entity itself, generally may not deal with persons ordinarily resident there, and funds connected to it are typically blocked rather than returned. A targeted programme lists specific persons, companies or sectors in an otherwise open country; a merchant from that country is not sanctioned by being from there, but every name in the file is read more carefully and every address carries a higher risk rating. Each institution also keeps its own restricted-country list, shaped by the FATF lists and its own experience, so two acquirers can answer the same country differently.

This is why a merchant operating from a comprehensively sanctioned country cannot be onboarded, and why a US entity with a US director changes nothing. The entity is a US person and its director a US resident; neither may serve a sanctioned operator, and the location surfaces anyway: the IP address the dashboard is opened from, the supplier wires leaving the account, the origin of shipments. Using a company and a director to hide that a business is run from a sanctioned country is sanctions evasion. IBOCore's refused list on the industries page includes anything fraudulent, and this sits on that side of the line.

Transaction-level screening: cardholders, wires and geography

Once the MID is live, screening moves from the file to the flow. Each authorization passes geographic rules: the networks and the issuer act on the card's issuing country, read from the bank identification number (BIN); the acquirer's fraud rules add the shopper's IP address and the billing and shipping addresses. A card issued in a comprehensively sanctioned jurisdiction is typically refused at network or issuer level, before your acquirer is involved. The bank screens the parties to every wire by name and by country; a wire touching a listed party or a comprehensively sanctioned country is held rather than processed. All of it is measured against the customer geography declared at underwriting: sales in undeclared countries, a supplier in a restricted jurisdiction, a refund to a card from one, each is a monitoring finding first. One declined authorization is noise; a stream from a sanctioned jurisdiction reads as marketing there, and the file is reopened.

What a match request looks like and how to answer it

A match request arrives as a short email or portal message from the bank's or acquirer's compliance team, usually titled a possible match or a screening review. It names the person, not always the list entry, and asks for a fixed set of identifiers: full legal name with middle names, date and place of birth, nationality, current address and a copy of a government photo ID. The account, application or wire is on hold while it is open, and it is addressed to the person screened, the signer or the owner, not to whoever runs the store. The bank compliance review guide on this blog covers requests for information; a sanctions match is stricter and the answer simpler.

1. Answer within the deadline, from the person named, through the channel the request came in. Silence is read as a refusal to identify, and the hold can become a closure.
2. Send exactly the identifiers requested, as they appear on the documents. A screenshot in place of the document is sent back.
3. Keep every detail identical to the file the institution holds; a new spelling or a second address reopens the file instead of closing the hit.
4. Do not argue the match. The analyst clears it on identifiers, not on explanations; the covering note is one line.
5. Ask for written confirmation that the hit is cleared and keep it; the next institution will run the same name.

Why you should expect questions about where you operate from

Every institution in the chain asks where the business is operated from, and the answer is checked rather than taken. The bank sees the login country on the online banking session and the counterparties on the statement. The acquirer sees the IP on the dashboard and the origin of shipments. When these point to a country not in the file, the file is reopened. The question is how an institution tells a foreign-owned US business, which is lawful and common, from one hiding a sanctioned or restricted location, which it cannot serve.

On an IBOCore package the director's side of that answer is documented from the start. The director, the IBO (Independent Business Operator), is a US resident in the state where the LLC or C-Corp is incorporated; the state filing and the EIN letter show the director, the bank account at Bluebanc or Relay is in the company's name, and the government ID and proof of address in the package agree with the articles. IBOCore asks no KYC of you, but it reviews your business proofs before dashboard access, and the IBOCore team on Telegram asks about your business model and volume; where you operate from belongs in that conversation. The dedicated US residential proxy in the package is an operational tool, not an answer to a compliance question: a sanctioned operator stays sanctioned whatever IP address the dashboard is opened from.

A word on beneficial ownership, because the bank's due diligence form and FinCEN's reporting rule are two different things. At the time of writing, under FinCEN's interim final rule of March 2025, domestic companies and US persons are exempt from beneficial ownership information reporting, while companies formed under foreign law that register in a US state remain subject to it. Verify current FinCEN guidance and treat what must be recorded where as a question for a professional; IBOCore gives no legal or tax advice. The documents in the package show the director on the state filing and on the EIN, and that is where this guide stops.

Questions merchants ask

Does a sanctions hit on my director's name mean the application is declined?

Not by itself. Most hits are partial: the engine returns every name close enough to a list entry. The analyst clears it with the date of birth, nationality, address and ID number already in the file. A true match, where the identifiers line up with the listed person, ends the file at that institution and every other.

Are my customers screened as well, or only the business?

Both, at different levels. The business and the people behind it are screened by name at onboarding and every refresh. Customers are screened per transaction, mostly by geography: the card's issuing country, the shopper's IP address, the billing and shipping addresses, and the parties to any wire. What you control is the customer geography declared on the application and whether your marketing matches it.

My country is under targeted sanctions but I am not on any list. Can I still get a US merchant account?

A targeted programme lists specific persons, companies and sectors, so being from that country does not put you on a list. It does put a higher risk rating on every address in the file: enhanced due diligence, more questions about where you operate from and, at some institutions, a refusal by policy. Which programme applies is for a sanctions professional to confirm; IBOCore does not advise on it. Tell the IBOCore team on Telegram which country you operate from before you buy; the contact page carries the Telegram lines.

Compliance touchpoints that survive audit

Clean setups disclose beneficial ownership, file BOI, use genuine IDs, and keep the IBO informed of website and descriptor changes. Processors re-scan for prohibited products, undisclosed aggregation, and transaction laundering. Violations land on MATCH and kill future MID applications.

• AML / CDD: customer due diligence on the merchant entity.
• PEP screening: politically exposed persons get enhanced review.
• OFAC / SDN: sanctions lists checked on owners and signers.
• Website compliance: refund policy, terms, pricing visible before checkout.

Compliance shortcuts that trigger MATCH

Fake guarantors, borrowed SSNs, cloaked websites, and third-party processing through your MID are the fastest paths to MATCH listings. Recovery requires legal work and years of delay. Disclose, document, and keep the IBO in the loop.

FAQ: quick answers

How fast can I get an IBO package on IBOCore?

Available inventory ships the same day after payment. You receive Articles, EIN letter, registered agent details, bank onboarding pack and signer contact through your merchant dashboard. Processor onboarding typically follows over the next one to two weeks.

Where can I look up payment-processing jargon?

Use the Resources glossary on IBOCore (/resources) for 580+ definitions: MID, chargeback ratio, MATCH, rolling reserve, MCC, RDR, KYB and high-risk vertical vocabulary.