True Hits and What Happens Next

A true hit means the payment genuinely involves a sanctioned party, and the response depends on the sanctions programme. Under a blocking programme, such as the OFAC SDN list, the bank must freeze the funds and hold them in a blocked account. The money is not returned to the sender and not sent to the beneficiary, it stays frozen until OFAC grants a licence or the listing is removed. Under a rejection programme, the bank refuses the transaction and returns the funds to the sender, because the rules require rejection rather than blocking. Getting this distinction wrong is a serious error, so the case management system must tell the analyst clearly which action applies to which list and programme. Once a true hit is confirmed, the bank has reporting duties. In the United States, blocked and rejected transactions must be reported to OFAC, usually within ten business days, with full details of the payment and the parties involved. In the European Union, frozen assets must be reported to the national competent authority. The bank must also file internal records, notify relevant internal teams, and consider whether the attempted transaction suggests a wider problem, such as a customer deliberately trying to evade sanctions. If the customer is an existing customer of the bank, the relationship itself must be reviewed, and the account may need to be closed. None of this can be improvised, so banks maintain detailed playbooks for true hits. Payments that hit sanctions can also create a difficult customer situation. The customer may not know why their payment stopped, and the bank often cannot explain in detail because of tipping off rules and the sensitivity of the screening process. The standard response is a generic message that the payment could not be processed, and front line staff are trained not to speculate about the reason. For a BA, this is a requirements point. The system must generate the right customer message for each outcome, suppress the wrong details, and log exactly what was communicated and when. A poorly worded message can accidentally reveal that the customer is under suspicion, which creates legal risk for the bank. When an alert is a true hit, the payment must be blocked, and the blocking procedure must be followed exactly. The payment is stopped before it leaves the bank, the funds are held, and the customer is not told the reason, because telling the customer would be tipping off, which is an offence under anti-money-laundering law. The compliance team is notified, and the team decides whether to file a report with the relevant authority. In the United States the report goes to OFAC, and the blocked funds must be held in a blocked account and reported annually. In the European Union the report goes to the national competent authority, and the funds are frozen. The blocking must be recorded in a way that survives an audit. The record must include the payment details, the list entry that matched, the analyst who confirmed the hit, the date and time of the block, and the reference of the report filed. The record must be retained for the statutory period, which is usually five years after the end of the relationship. A block that is not recorded is a block that cannot be proven, and a block that cannot be proven is a regulatory breach. The requirements must state the record, the retention, and the access control, because the record contains sensitive information. After the block, the bank must decide whether to exit the customer relationship. A customer who attempted to send a payment to a sanctioned person is a high-risk customer, and the bank may decide the risk is not worth the revenue. The exit decision is made by the compliance team, not by the operations team, and must be documented with the reason. The customer must be given notice, and the notice must not reveal the reason, because that would be tipping off. The exit must be handled carefully, because the customer may complain, and the complaint must be answered without disclosing the screening information.