Why Your Deposit or Withdrawal Gets Held: Sanctions and AML Screening Explained

Picture the moment. You have sent a payment to a supplier, or you are waiting for funds to land in your account. The money left one side. It has not arrived at the other. Nobody is accusing you of anything. And yet, somewhere in the payment chain, a compliance team is staring at your transaction and deciding what happens next.

Screening stopped your payment, not suspicion of you personally. Banks and payment firms run automated checks against sanctions lists and anti-money-laundering (AML) rules before money moves. Most of the time the check takes seconds and nobody notices. Occasionally it does not, and understanding why is genuinely useful.

First, the jargon, plainly

Sanctions screening means comparing names, addresses, dates of birth, identification numbers and similar details against government lists of restricted people and organisations. AML is the wider set of rules firms follow to avoid handling the proceeds of crime. Customer due diligence (CDD) is the identity and background checking that happens when a relationship begins.

These are related but distinct obligations. As one sanctions guide puts it, OFAC compliance is separate from AML compliance and cannot be satisfied by AML controls alone. Think of them as two different locks on the same door.

The list is longer than you think

The most cited list is the US Treasury's Specially Designated Nationals (SDN) list, maintained by the Office of Foreign Assets Control (OFAC). But screening rarely stops there. Tools also check the EU consolidated list, the UK's OFSI list, the UN Security Council list, sectoral sanctions lists, and the firm's own internal watchlists.

Some restrictions are not about a named person at all. OFAC also administers sanctions programs that broadly prohibit activity involving certain regions, countries or governments. So an alert may not mean "this person is designated" — it may mean "this transaction touches a jurisdiction we must think carefully about."

Lists change constantly. A firm that downloaded its data on Monday may be screening Tuesday's payment against Monday's world.

Why so many alerts are false alarms

Name matching is harder than it sounds. "Mohammed," "Muhammad" and "Mohamed" are the same name rendered differently. Transliteration from Arabic, Persian or Cyrillic scripts creates dozens of plausible spellings. Common names collide with list entries by pure coincidence.

This produces false positives — alerts that look like matches but are not. They are described as an unavoidable feature of any name-based screening program. Industry commentary suggests most financial institutions see false positive rates in the region of 90–95%, which means analysts spend most of their time clearing innocent people.

Here is the uncomfortable trade-off. Stricter matching thresholds (say, 85–90% similarity) catch more potential hits but generate more false alarms. Looser thresholds reduce the workload but may let a genuine match slip through. There is no setting that is simultaneously fast, cheap and perfectly safe. Every firm is choosing where to sit on that curve, and those choices are why your experience can differ between two providers handling the same payment.

OFAC's own guidance walks through the resolution process: check whether the alert relates to an OFAC list or another agency's list; review the full list entry including aliases, nationality, passport or tax numbers, place and date of birth; then compare every available detail. Does only the first or last name match? Is the date of birth different? A shared address alone proves little, since multiple businesses can be registered at one location.

When a match is real

If the details genuinely align, the response is not a judgement call. OFAC guidance is direct: where sanctions require blocking, the firm must freeze the assets — for example, placing blocked funds in a segregated, interest-bearing account at a federally insured US financial institution, from which only authorised debits may be made.

Where a transaction is prohibited but there is no blockable interest involved, it must be rejected instead. Either way, the firm reports to OFAC within 10 business days and keeps records. Different jurisdictions have their own reporting duties and timelines, so the specifics depend heavily on where the institution sits and which regime applies. That jurisdictional patchwork is one reason two banks can treat the same customer differently.

The quiet second gate: the Travel Rule

Separately from sanctions, there is the Travel Rule — formally FATF Recommendation 16. It requires financial institutions involved in transfers to collect and pass along information about who is sending and who is receiving, so the data travels with the money.

The rule dates to October 2001, adopted after the 9/11 attacks. It was revised in June 2025, with compliance required by the end of 2030 — an unusually long runway by FATF standards. The revisions broaden scope to all "payments or value transfers and related messages," not just wire transfers, and add obligations around beneficiary information.

Thresholds vary by jurisdiction, and this is where people get caught out. The FATF baseline is USD/EUR 1,000. The US has long used USD 3,000 for traditional wire recordkeeping. The EU applies a zero threshold to crypto transfers under its Transfer of Funds Regulation. A small transfer that feels trivial can be fully in scope somewhere else.

One clarification worth noting: the 2025 revisions state that the Travel Rule does not itself require real-time sanctions screening, deferring to national regulation. But in practice the two run together — and as one industry glossary bluntly notes, transmitting compliant data to a sanctioned beneficiary is not Travel Rule compliance, it is a sanctions violation.

What actually happens to your money

When a payment is stopped, it is usually held rather than confiscated. A hold is often procedural: the firm needs more information before it can clear an alert. That may mean a document confirming your address, a birth certificate, a driver's licence, or corporate registration papers for a business.

This is also where customer due diligence matters. Firms must identify customers and, where applicable, beneficial owners — the people who ultimately own or control a company. Under UK Money Laundering Regulations, where a firm cannot satisfy itself who the beneficial owner is, it must not enter into or continue the business relationship. For a company with a layered ownership structure, that can mean a lengthy pause.

Expect questions about source of funds (where this particular money came from — salary, sale proceeds) and source of wealth (how the person built their overall wealth). It can feel intrusive. It is also the mechanism that separates a legitimate payment from a laundered one, and firms are required to ask.

Why systems sometimes miss things entirely

Screening is only as good as its plumbing. The UK regulator once found that three key parts of HSBC's transaction monitoring systems showed serious weaknesses over several years — including a failure to check the accuracy and completeness of data feeding the systems. The result: millions of transactions worth billions of pounds either monitored incorrectly or not at all. The penalty was £63,946,800.

The lesson cuts both ways. Poorly tuned systems annoy the innocent and miss the guilty. Alert fatigue — analysts drowning in false positives — is itself a recognised risk, because genuine hits get buried.

What you can do, and what nobody can promise

Keep your details consistent across accounts and providers. Full legal name, current address, correct date of birth. If you are sending to a new counterparty in a new country, expect the first payment to move more slowly than the tenth.

What no one can offer is a guarantee that a payment will clear quickly. Screening outcomes depend on the lists involved, the jurisdiction, the provider's thresholds, the accuracy of the data on file, and whether a real match exists. Rules differ materially between the US, EU, UK, Singapore and elsewhere — and they are changing, with FATF guidance on implementing the 2025 revisions expected in late 2026.

A delayed payment is frustrating. It is also, most of the time, the system doing exactly what it was built to do — imperfectly, expensively, and with your money sitting in the middle of it.