Fuzzy name matching in sanctions screening: 7 ways a name changes

A retail bank in the FCA's 2026 review processed payments after a sanctions target was designated. The name screening raised no alert. Its "phonetic matching and spelling variation rules were inadequate", according to the regulator's findings on sanctions systems and controls, published on 28 May 2026. Those rules kept the system from recognizing legitimate variants of the listed name. The FCA put the payments down to failures in name screening logic.

That logic is fuzzy name matching, the step in checking a sanctions list where a listed name meets the way your own records spell it.

What is fuzzy name matching, and what does exact matching miss?

Fuzzy name matching is a screening method, used in sanctions and anti money laundering checks, that scores how similar two names are instead of asking whether they are identical. The tool compares each name in your data with each name and alias on a list and gives every pair a score. An alert goes up when the score reaches the firm's threshold.

Exact matching says yes only when every character agrees. Picture a customer onboarded as Kathrine Walsh while the list spells the name Katherine Walsh. One letter is missing. An exact match returns nothing.

Fuzzy logic closes that gap, and draft regulatory guidance now names it. The FCA's draft Financial Crime Guide text in consultation paper CP26/38 says screening includes applying fuzzy matching logic "to detect variations" (p. 51). The same scoring runs inside name screening of customers, owners and counterparties, and inside payment screening.

How does a name change between a sanctions list and your data?

Table 1. Seven ways a name changes between a sanctions list and your data (illustrative pairs, no listed person; as of November 2026)

Rows 5 and 6 can fail before any score is computed. In the FCA's testing, some firms removed titles inconsistently, or folded them into name fields, when they loaded the list. On a short name a title costs a lot: a "Dr" in front of Jonathan Smith takes almost 18 points off the score worked out below.

Aliases fail when the tool never screens them. OFAC's entries carry full names, former names and known aliases, according to its guidance on valid matches. A tool that screens only the primary name, Robert Hale, misses a customer called Bob Hale even when the entry lists that alias.

How do screening tools match Arabic and other non Latin names?

Take one given name in Arabic script, يوسف. In Latin letters it becomes Yusuf, Yousef or Youssef, and each spelling is correct. OFAC's enhanced list data adds names and aliases written in scripts other than Latin, so a tool can compare like with like when the customer record holds the original script. The FCA's draft self assessment questions ask whether a firm has considered how it finds sanctioned persons whose names vary through "translated name variations or minor misspellings" (p. 54). PEP lists carry the same spread of transliterated spellings, and PEP screening has to match them too.

How does a matching algorithm score two names?

A matching algorithm turns two names into one number, and it can build that number from several methods. Levenshtein distance, an edit distance, counts the single character insertions, deletions and substitutions that turn one string into the other: Kathrine to Katherine is one edit. Phonetic codes work on sound instead. Soundex keeps the first letter and adds three digits, so Reed and Reid both become R300, and Robert and Rupert share R163, which is how phonetic matching over matches.

Name part matching splits each name and compares given name with given name and surname with surname, so word order stops deciding the score. Company names need one more step, because shared generic words inflate the result. Scored by edit distance as a share of the longer name, Northgate Trading Company and Southgate Trading Company reach 92.0. Strip the two generic words and compare only the cores, Northgate and Southgate, and they score 77.8.

How does OFAC's Sanctions List Search score a name?

OFAC publishes its own method in FAQ 249. Sanctions List Search first keeps candidates that share the first letter of the search term and are at least 50 percent similar on edit distance. It then scores each pair two ways: Jaro-Winkler, a string difference algorithm, on the whole name, and Jaro-Winkler with Soundex, a phonetic algorithm, on each name part. It shows the higher score. A score of 100 "indicates an exact match", and lower scores mark potential matches, says FAQ 247.

How do you set a fuzzy matching threshold?

A threshold is the score at which a pair becomes an alert. Setting it trades missed names against alert volume, and neither the FCA's draft guide nor OFAC's guidance sets a number for it.

Picture a list entry for Jonathan Smith and four customers. Score each pair as 1 minus the edit distance divided by the length of the longer name, times 100 (an illustrative formula; vendors combine methods):

• Jonathon Smyth: two edits in 14 characters, 85.7.
• Dr Jonathan Smith: three added characters in 17, 82.4.
• Jon Smith: five edits in 14, 64.3.
• Smith Jonathan: 12 edits in 14, 14.3.

At a line of 90, nothing alerts. At 85, only Jonathon Smyth does; at 80, the Dr record joins it. The reversed name never comes close. Tools that compare name parts and strip titles before scoring catch both. Scores also differ between engines, so 85 in one tool is not 85 in another.

The FCA's draft guide lists the fuzzy matching threshold as a calibration point to document, beside the lists used and suppression rules (p. 55). In complead, formerly Sanction Scanner, fuzzy matching thresholds can be set per list type and also per individual list (for example a lower threshold on sanctions lists and a higher one on watchlists).

Why do name variations cause false positives?

A line low enough to catch Jon Smith at 64.3 also catches John Smith and Joan Smith at 71.4 and Nathan Smith at 78.6. In automated client screening, common and short names sit near some listed name. Each point off the line buys recall with analyst hours. The FCA's draft guide says a customer whose name matches a listed person "will often be a 'false positive'" (p. 55). A missed listed name is the other error, a false negative.

What did supervisors find when they tested name matching?

OFAC settled with Payoneer Inc., a New York online money transmitter, for $1,385,901.40 on 23 July 2021. Between 4 February 2013 and 20 February 2018 it processed 2,220 transactions in apparent violation of sanctions, 19 of them payments on behalf of persons on the SDN List. OFAC named four causes, and two concern matching: "weak algorithms that allowed close matches to SDN List entries not to be flagged by its filter" and no screening of Business Identifier Codes even when SDN List entries carried them (enforcement release, p. 1). Codes like these need exact matching.

OFAC wrote that the case emphasizes "performing algorithm testing to be sure filters are flagging payments within expected parameters" (p. 3). Its 2019 Framework for compliance commitments already listed screening that "did not account for alternative spellings" among the root causes of violations (p. 11). Neither document prescribes an algorithm or a threshold.

The FCA tested the question directly. Since February 2022 it has assessed the sanctions controls of over 150 firms it supervises, and its 2026 findings give the results of its screening tests (section 6.9). Overall, 90 percent of the alerts raised in testing identified the right sanctioned party. For names in slightly different forms, such as minor spelling variations, the figure was 75 percent, and both rates improved over the testing period.

When the FCA tested how systems ingest names from the UK Sanctions List, it found examples where titles, appellations and suffixes pushed match scores below alert thresholds. In some systems, single word names and names containing digits were excluded by default, and long names exceeded system character limits and failed without an alert or needed manual work. A wholesale bank missed vessel names. Its controls needed prefixes or specific formats, so payments that referred to vessels linked to a designated individual went through when the names appeared in simpler forms. On alert handling, around 44 percent of firms reported resolving name screening alerts within one working day on average, and 47 percent did so for payment screening alerts (section 6.10).

Can AI give better name matching and fewer false positives?

In a September 2025 Federal Reserve Board working paper, four families of large language models judged name and address pairs better than fuzzy matching algorithms. On average across realistic matching thresholds, the models cut false positives by 92 percent and raised detection by 11 percent against the best fuzzy matching baseline. They also ran over four orders of magnitude slower. A cascade sending only uncertain pairs to a model was nearly twice as fast as the model alone, and as accurate.

Payments are screened while the transfer waits. Speed limits how much checking each name gets. The authors expect payments to need a tiered setup, with language models only for uncertain pairs, while account opening could lean on the models more.

What does entity resolution add beyond the name?

Entity resolution asks whether two records are the same person or company. It uses what the list entry holds beyond the name, which is what separates the listed person from a namesake. On OFAC's lists that can be nationalities, passport and tax ID numbers, national identification numbers, place and date of birth, business registration numbers and known addresses. OFAC's guidance on valid matches asks whether only the first or the last name matches the listed name or its aliases. A different date of birth, identification number or nationality counts against a match. When the name and the date of birth agree, OFAC's steps treat the hit as a likely match to investigate. An address alone is weak. Multiple businesses can share one address. OFAC "does not confirm potential matches or false positives", so the firm decides and keeps the record.

Names alone also miss entities a listed person owns, which carry no listed name; OFAC's 50 percent rule guidance sets the US test.

What should you test and write down?

The FCA's draft guide and its 2026 findings point to the same records. Keep these on file, each with its reason:

1. Lists per customer type. Which lists each product screens against, as decided in your sanctions risk assessment.
2. A threshold per list. Write the reason beside each number; the FCA's draft lists a firm that does not review its fuzzy logic calibration as poor practice.
3. Suppression rules. Each suppressed name or rule, who approved it and when it is next reviewed.
4. Title handling at ingestion. The FCA's good practice is fuzzy matching that keeps working when titles or extra name elements are present.
5. Single word, digit and long names. The three categories the FCA found excluded or failing.
6. A retest after every list or logic change. The FCA counts validation after material list or system changes as good practice.
7. An algorithm test on a known file. OFAC stressed it in Payoneer's case, and the same file goes to every provider when choosing compliance software or sanctions screening software.

How does a screening platform hold those settings?

On complead, fuzzy, phonetic and transliteration aware matching runs inside the API call. It covers Latin, Cyrillic, Arabic, Greek and Chinese and catches aliases, spelling variants and name order differences. Date of birth, nationality, gender, ID and passport number are scored alongside the name, so a common name does not trigger a common alert. Thresholds are set per list type or per list, and a search audit trail logs each screening search with the person who ran it, the term, the time and the result, even when nothing matched. For payments, transaction screening checks the payer and the payee over the API while the transfer is in process. Every alert shows which rule fired and which signals matched. The analyst who clears it is named on the record.

What did regulators publish on name screening in 2026?

• 28 January 2026. UK designations moved to a single source, the UK Sanctions List, when the OFSI Consolidated List closed.
• 28 May 2026. The FCA published its sanctions findings, with the 90 and 75 percent test results.
• 9 September 2026. OFAC updated FAQ 5, its guidance on deciding whether a hit is a valid match.
• 23 October 2026. The FCA published CP26/38 on Financial Crime Guide updates, with draft text on fuzzy matching and calibration. It takes feedback until 24 December 2026.

Before that consultation closes, three things are worth doing this week:

1. Seed a test list with one name, run its misspelled, reversed and titled forms through your tool and record each score.
2. Pull ten alerts closed last month and check that each record names the identifier that cleared it.
3. Write each list's threshold and its reason into the screening policy.