OFAC changed the SDN list in 94% of weeks since 2022: what that means for rescreening

How often is the OFAC SDN list updated?

We define an update day as a calendar day on which OFAC published at least one addition, removal or change to an SDN record in its Recent Actions notices. On that definition OFAC updated the SDN list on 1,489 days between 1 January 2010 and 5 October 2026. Our sanctions list change data shows the source changes Verifex detects.

The rate has climbed. In 2010 to 2015 OFAC averaged 70 update days a year. In 2022 to 2025 it averaged 115, with a high of 132 in 2024. The gaps got shorter too. The median gap between two update days fell from 5 days in 2010 to 2015 to 2 days in 2022 to 2026, and the longest gap between two update days since 2022 was 20 days.

The weekly view is the one that matters for rescreening. From 2022 to 5 October 2026, 234 of 250 calendar weeks (93.6%) contained at least one SDN change. A week without a change is now the exception. OFAC itself told firms in 2015 that it “is updating its sanctions lists at an ever increasing pace” [3]. The counts since then are consistent with that.

1,489

days with an SDN change, 1 January 2010 to 5 October 2026

93.6%

of weeks since 2022 had at least one SDN change (234 of 250)

2 days

median gap between update days since 2022 (5 days in 2010 to 2015)

How many names does OFAC add and remove each year?

Between 1 January 2010 and 5 October 2026 OFAC's notices add 20,556 SDN records, remove 4,721 and change at least 9,278. A record here is one list entry, so a company with six aliases counts once.

Additions ran at 400 to 900 a year until 2017. 2018 brought 1,436, and every year from 2022 to 2025 brought more than 2,200, peaking at 3,360 in 2024. 12,191 of the 20,556 additions (59.3%) were published on or after 1 January 2022. Removals are much smaller and lumpier: 705 in 2025 and 468 so far in 2026, the latter including OFAC's 2026 clean-out of outdated entries [4].

Other counts differ because they measure different things. CNAS reports 1,322 persons added to the SDN list in 2025, built from press releases and Federal Register notices [11]; our 2,239 counts every SDN record in OFAC's notices, including vessels (447 of the 2025 additions still listed today are vessels). For the first half of 2023, a vendor survey reported 57 OFAC list updates, a unit that may include OFAC's other lists [10]; we count 56 SDN update days in the same months.

Changes come in bulk. On 3 July 2024 OFAC added the line “Secondary sanctions risk: See Section 11 of Executive Order 14024” to 3,870 existing records in a single notice [5]. For a screening team, that kind of day matters even though nobody new was sanctioned: any system that stores its own copy of list records has to take in thousands of edits at once.

Was 2022 the biggest spike in SDN designations?

Not by month. The baseline did reset in 2022: the median month from 2010 to 2021 brought 40 additions, and the median month from January 2022 to September 2026 brought 170. March 2022 alone added 627 records, and February to December 2022 added 2,509.

But the single biggest month in the series is November 2018, with 749 additions, 701 of them on 5 November 2018, the day OFAC's notice describes as the full re-imposition of sanctions on Iran [12]. January 2025 (626) and February 2024 (613) came within a whisker of March 2022. The pattern is less a one-off spike than a new, higher normal with very large days on top.

Those large days carry most of the volume. Half of all 20,556 additions since 2010 arrived on just 87 days, 6.7% of the 1,307 days on which OFAC added anyone. A screening process that copes with an ordinary week but stalls on a 400-name day is weakest on the days with the most new listings.

On which days does OFAC publish SDN changes?

OFAC publishes on working days. Of the 1,489 update days since 2010, 410 (27.5%) were Thursdays, 328 (22.0%) Wednesdays, 317 (21.3%) Tuesdays, 262 (17.6%) Fridays and 167 (11.2%) Mondays. Only five fell on a weekend: two Saturdays and three Sundays, which together carried 136 additions.

Friday is worth a second look. 262 update days, with 4,462 additions, landed on a Friday. A team that rescreens on business days will not screen those names until Monday, three days later.

We wanted to report the share of changes published outside US business hours. The notices and OFAC's change files carry a publication date but no time of day, so that figure is not available from public data. Answering it would need OFAC's own publication timestamps, or a monitor that records the time each file changes.

How often should you rescreen customers against sanctions lists?

OFAC does not set a frequency. FAQ 28 says it “must be guided by your organization's internal policies and procedures” [6], and in a 2022 enforcement notice OFAC said the frequency “should be based on the financial institution's assessment of its unique sanctions risk” [7]. The same notice shows what a long cycle costs: a bank's vendor “only screened MidFirst's entire existing customer base once a month”, and notified the bank that blocked persons among its customers had been added to the SDN list 14 days after OFAC added them [7].

To put numbers on the trade-off, we took every SDN addition since 2010 and asked how long it would wait before a customer base was first screened against it under five schedules. We assume each run happens at the start of a day, so a name published on Tuesday is first screened on Wednesday under a daily schedule. For weekly runs we average over all seven possible run days, and monthly runs fall on the 1st.

The average wait per new SDN record is 1.0 day for daily runs, 1.43 days for business-day runs, 4.0 days for weekly runs, 15.3 days for monthly runs and 43.6 days for quarterly runs. Under weekly runs, 57.1% of new records wait more than three days. Under monthly runs, 89.0% do.

A more practical way to read it is to ask how many newly listed SDN records sit unscreened on an ordinary day. Since 2022 the answer is 7 for daily runs, 11 for business-day runs, 28 for weekly runs, 102 for monthly runs and 305 for quarterly runs. Even a daily batch, like the daily screening for instant payments, leaves a gap of most of a day for each new listing. Screening triggered by each list update, as in continuous sanctions monitoring, can shorten that gap further; by how much depends on how fast that screening runs, which this model does not cover.

What this means for compliance teams

1. Write down the number of days, not just the schedule. For each rescreening cycle you run, state the expected wait between an OFAC listing and your first screen against it. Since 2022, weekly means about 28 unscreened new names on an average day. Check that your risk assessment accepts that figure for your customer base. Read why continuous monitoring matters.
2. Test your process on a 400-name day. Half of all additions arrive on 6.7% of the days on which OFAC adds anyone. Pick a past large day, for example 23 February 2024 with 568 additions, and replay it through your list update, batch screening and alert review to see how long the backlog takes to clear.
3. Plan for Friday listings. 17.6% of update days are Fridays. If nobody rescreens or reviews alerts at weekends, Friday's names wait about three days. Decide whether that is acceptable and record the decision.
4. Watch changes as well as additions. OFAC edited 3,870 existing records in one notice on 3 July 2024. Make sure that edits to existing records, such as new aliases or identifiers, also trigger a rescreen, not only new names. See rescreening on list changes.
5. Ask vendors for their lag. The MidFirst case turned on a vendor screening monthly. Ask any screening vendor how long, in hours, it takes from OFAC publication to a completed rescreen of your customers, and test the answer. The procurement checklist has the other questions to ask.

Methods

Data. OFAC refused 304 of the 1,913 action pages during collection, all dated 2001 to January 2009, so the study covers 1 January 2010 to 5 October 2026, where every page was captured: 1,556 action pages.

Processing. Each action page is split into sections at sentences such as “The following individuals have been added to OFAC's SDN List:”. A section is typed as an addition, removal or change from its header, and assigned to the SDN list or to one of the non-SDN lists (SSI, NS-MBS, FSE, CAPTA, CMIC, PLC). Entries in addition and removal sections are counted as runs of programme tags such as “[SDGT]”, each of which closes one entry. Older removal notices print each alias of a removed record as its own line, so lines that share a name with another line in the same section are merged into one record. Changes are counted as occurrences of “-to-”, the marker OFAC places between the old and new version of a record. 10 SDN records sat in sections whose header did not say whether they were added, removed or changed, and are left out.

Definitions. An update day is a release date with at least one SDN addition, removal or change. A week runs Monday to Sunday. In the rescreening model, an added record published on day d is first screened at the next scheduled run after d. Daily runs happen at the start of each calendar day; business-day runs at the start of the next weekday; weekly runs on a fixed weekday (results averaged over all seven); monthly runs on the 1st; quarterly runs on 1 January, April, July and October. Publication time of day is not available, so a same-day run is never assumed. Unscreened on an average day is the sum, over added records, of days waited before the first screen, divided by the number of days in the period.

Validation. OFAC's archive lists 520 delta files from 22 September 2022 to 5 October 2026. We hold 170 distinct files covering 164 publication dates; they are the ones that downloaded successfully, not a random sample. On those dates the delta files list 4,147 SDN additions and our parsed notices give 4,165 (0.4% more). Removals are 412 and 410 (0.5% fewer). The counts agree exactly on 150 of 164 dates for additions (91.5%) and on 160 of 164 dates for removals (97.6%). For changes, the notices show 190 “-to-” changes where the delta files show 355 amended entities. Some technical edits are not printed in notices, so our change counts are a lower bound. As a second check, for every year from 2010 to 2026 the additions in the notices are at least the number of entries from that year still on the list today (for example 2,554 added in 2022, 2,441 still listed).

Statistics. Counts from notices are full counts of OFAC's publications in the period, not samples, so no confidence intervals are given. The agreement rates with delta files describe the files we hold and are not generalised.

This study describes public data and general regulatory context. It is not legal advice; confirm your obligations with a qualified adviser.

Limitations

• The notices are a human-readable record. Our parser recovers additions and removals within about half a per cent of OFAC's machine files on the dates we could check, but some individual days differ.
• Change counts miss technical edits that OFAC applies in its data files without printing them in a notice, so they understate how often records change.
• Time of day is not published, so we cannot say what share of changes appear outside US business hours. The weekend share (0.3% of update days) is the closest available measure.
• The rescreening model assumes a run never happens on the day of publication. A firm that rescreens in the evening would see slightly shorter waits.
• The study covers the SDN list only. We did not measure the EU, UN or UK lists here; the EU and UK publish change notices in different formats and dates that would need their own parsers.
• 304 pages from 2001 to January 2009 could not be captured, so the series starts in 2010, the first full year with every page captured.

Questions and answers

Data and code

Every value plotted in Figures 1 to 6 is in the figures file below. The daily file has one row per SDN update day with the number of records added, removed and changed (aggregates only; no names). Both were computed from OFAC's public notices; no customer data was used. The collection, parsing and validation steps are described under Methods, with the hashes of the source files.

• jsonFigures 1 to 6: every plotted value
• csvDaily counts: one row per SDN update day