Take one held payment and an examiner can test the whole control with four questions: which fields the filter read, which lists it read them against, who decided to release or stop the payment, and how long it waited. In an AML transaction monitoring program, screening and monitoring do different jobs: screening stops one payment before it moves, while monitoring reads patterns across payments that have already gone through.
What does SWIFT sanctions screening check in a payment message?
Table 1. What payment screening reads in a SWIFT message, and how each field is tuned
| Field in the message | What is screened | Typical false positive | How to tune it |
|---|---|---|---|
| Payer and payee (MT 103 Fields 50 and 59; debtor and creditor in ISO 20022) | Names against list based programs, addresses against country programs | A common name, or one word shared with a listed company | Match the name with country or date of birth; set a fuzzy threshold for this field |
| Ultimate debtor and creditor | The party a company pays or collects for | A group treasury center paying for its own subsidiaries | Screen them as parties, at the payer and payee threshold |
| Banks, by name and BIC | The institution and its country, against listed banks | A bank name containing a listed word | Resolve each BIC to one institution; match it to the BICs of listed banks |
| Addresses, towns and countries | Places under country or regional programs, such as Crimea | A street or a company named after a sanctioned city | Read structured town and country fields first; match place names exactly |
| Free text: remittance information (Field 70) and purpose | Listed names, ports, ships and goods in the text | Invoice codes equal to a short list term | Set a minimum term length; require whole word matches |
| Vessel names and IMO numbers, in trade payments | Listed ships | Ship names that repeat across fleets | Match the seven digit IMO number, not the name alone |
| Amount, date and reference | Not screened | None | Leave them out of the filter |
SWIFT sanctions screening reads every field that names a party, a bank, a place or a ship. The Wolfsberg Group's sanctions screening guidance lists the attributes screened most often, from remitter and beneficiary, bank names and BICs to vessels with IMO numbers, the free text of Field 70 and the places in Fields 50 and 59. Amounts, dates and reference numbers, it says, have no relevance from a screening perspective (2019, p. 9).
A message can name a bank by its SWIFT/BIC code alone, and then the filter has to turn that code into an institution and a country. The guidance also suggests enriching the lists with the BICs of listed banks (p. 11).
You can run that step by hand on a single code. The free SWIFT/BIC checker from complead, formerly Sanction Scanner, validates the code against the ISO 9362 format, names the bank, branch and country behind it, and shows the country's AML risk classification and any sanctions restriction on either.
How did the move from MT to ISO 20022 change payment screening?
SWIFT's implementation FAQ gives 22 November 2025 as the day MT and ISO 20022 coexistence ended for cross border payment instructions between banks. A bank that still sends an MT 103 or MT 202 goes through contingency processing. SWIFT converts the message and flags it. The conversion FAQ adds that "converted messages do not contain structured and rich data", so the flag tells a receiving bank which messages still need its free text rules.
An address shows the difference. In an MT 103, the word Kerch in the beneficiary's address lines could be a street, a company or a town. In a structured ISO 20022 address, Kerch in the town element is a town, with the country code next to it, so a place rule can match it exactly. SWIFT put the ISO 20022 share of payment instructions at more than 98 percent in August 2026.
Which dates in 2026 changed payment screening?
- 1 January 2026. SWIFT started charging for the MT messages it converts, to push senders to finish the move.
- 28 January 2026. The OFSI Consolidated List closed, so a filter's UK feed now comes from the UK Sanctions List alone.
- 27 August 2026. SWIFT deferred all payments changes in its 2026 standards release, including the structured address deadline planned for November, with new timing due by December.
- 13 October 2026. OFAC settled with Bank of America for $11,662,930 over 475 apparent violations, 403 of them payments through blocked banks that its filter had screened.
What happens when a payment hits the screening filter?
Picture a $64,000 payment from a grain trader in Rotterdam to a shipping agent in Istanbul, cleared in US dollars through a correspondent bank in New York (illustrative). The names and the banks pass. The remittance information reads "PORT DUES KERCH INV 4471", and Kerch is a port in Crimea. The filter holds the payment because its place list carries the cities and ports of Crimea and not only the word Crimea, as OFAC's 2015 Crimea advisory asks.
The analyst asks the sender's bank for the invoice. It shows port dues for a call at Kerch. Executive Order 13685, the advisory notes, bars virtually all transactions by US persons to or from Crimea, so the correspondent rejects the payment and reports the rejection to OFAC within 10 business days under 31 CFR 501.604. Had the payee been a listed person, the bank would have blocked the funds and reported the blocking instead (501.603).
Most hits end in one of four ways: a release with the reason written down, a rejection, a block, or an escalation for a suspicious activity report. The hold comes first, because the Wolfsberg guidance places screening at the point where a transaction can still be stopped. Meanwhile the GPI tracker shows the Rotterdam bank that its payment sits at the New York correspondent.
What do the sender's bank, the intermediary and the receiver's bank each check?
Each bank screens what it knows. The Wolfsberg Group's Payment Transparency Standards of 2023 start from the bank in the middle: an intermediary, usually a correspondent bank, "can only be expected to conduct real time sanctions screening on the information that is included in the message" (p. 5).
The sender's bank puts its customer's verified name, address and account into the message, passes on the payee's details unverified, as the customer gave them, and decides whether the payment breaches a sanctions program (pp. 6 to 9). The receiver's bank knows the payee and decides from the message whether to execute, reject or suspend the payment (p. 12).
The route needs screening too. Bank of America picked intermediary banks from a vendor's routing directory that still held banks OFAC had blocked. It screened those payments, bank details included, yet sent 403 of them, worth $14,340,100, through 35 blocked banks between February 2022 and March 2025, according to OFAC's release of 13 October 2026.
How does payment stripping defeat screening, and what stops it?
OFAC's 2015 advisory describes SWIFT messages for parties in Crimea that left out the originator's or beneficiary's address, or gave a street with no town, region or country.
That is payment stripping. It means removing or changing information in a payment message so the next bank's filter cannot see a sanctioned party or place. OFAC's compliance framework of 2 May 2019 names stripping or manipulating payment messages among the conduct its enforcement investigations focus on. The Wolfsberg standards say a bank should not omit, delete or alter payer or payee information to avoid detection, and should change a message only to correct errors or add detail (p. 5).
The FATF's revised Recommendation 16, agreed in June 2025 and in effect by the end of 2030, sets out who in the chain adds the information and keeps it unchanged. An intermediary that records what it received, as the Wolfsberg standards ask (p. 11), can compare it with the message it sends on. The Crimea advisory adds a check: ask parties that sent incomplete addresses before for more detail.
How are SEPA and instant euro payments screened?
For instant credit transfers in euro, EU law moved sanctions screening from the payment to the customer. Article 5d of Regulation (EU) No 260/2012, inserted by Regulation (EU) 2024/886, has applied since 9 January 2025. A provider that offers instant transfers checks all of its users against EU targeted financial restrictive measures (asset freezes and bans on making funds available) right after any new or amended measure enters into force, and at least once every calendar day. During the transfer itself, neither the payer's provider nor the payee's checks the payer or payee against those measures again.
Recital 25 explains why. Screening both parties to every transfer flagged a very high number of payments, most involving no listed person, and with no time to clear the flags, those payments were rejected.
Picture an EU listing that enters into force at 18:00 on a Friday (illustrative). Your provider rescreens its users that evening, not at the next daily run, and freezes any account that matches. Article 5d(2) keeps the checks for other restrictive measures and EU anti money laundering law in place, and it does not mention non EU lists such as OFAC's.
Which payment screening controls do examiners and auditors test?
Examiners and auditors test whether the filter catches what it should, in time, with each decision on record. OFAC's Bank of America release shows how these controls fail; use it as a test script for your own filter.
- Routing data. Banks picked by a routing directory are screened like any party.
- List updates. Every list a payment touches, the UK Sanctions List included, loads as it publishes. Bank of America's vendor file missed SDN changes from 24 May to 28 June 2023, and six payments went through.
- Suppression under review. The Wolfsberg guidance accepts suppression rules and "Good Guys" lists for common false positives with a documented rationale (p. 5); Bank of America's rule released alerts that matched ones cleared before, payments to blocked banks among them. Moka United, which monitors cross border transaction data on complead, cuts false positives with safelists and filtering.
- Thresholds per field. Fuzzy matching for names, exact matching for BICs and IMO numbers, each threshold with a written reason.
- Free text and stripping. Remittance text read for names, ports and ships without short codes firing; inbound messages compared with outbound ones.
complead's payment screening covers items 2 and 4. During processing, an API call screens both the sender and the receiver. Fuzzy thresholds can differ by list type and by individual list, and the lists hold 3,500+ sanctions, PEP and watchlists from 220+ jurisdictions, refreshed every 15 minutes. Each search is also logged with who ran it and the outcome, empty results included.
Does SWIFT offer its own sanctions screening service?
Yes. SWIFT sells Transaction Screening, which its product page also calls the Transaction Screening Service (TSS). This hosted service screens a bank's incoming and outgoing MT and MX messages, SEPA and CHAPS messages included, against more than 90 sanctions lists plus the bank's private lists, with exception rules and a four eyes review. Sanctions Testing, a separate SWIFT service, assesses a bank's own filters.
Had the Rotterdam payment cleared, the alert would have closed but the customer file would not. The next question is whether the grain trader's payments fit its usual counterparties, ports and amounts over weeks and months, which the monitoring rules of an AML program are written for.
What was read for this page. Sinan Tekin opened each source cited here on 1 November 2026, reading the swift.com and FATF pages in archived copies because both sites refuse automated reads.
