Has anyone had an issue with your OFAC scanning tool not identifying near matches and it becoming an exam issue? If so did they feel was it a significant exam issue.
Our examiner had us run a list of SDN names with variations of spelling, etc. through our OFAC scanning tool. Of the 6 SDN names and the 15 variations of the names three we not identified as potential matched. Two of 3 misspelled and one of 3 where the space between the names was deleted failed to be detected. We adjusted our confidence level and they were not picked up until we reached a score of 30. At 30 we’d have potentially y thousands of watch list alerts daily. At this point I may argue that our OFAC risk is rated low and we are willing to accept the risk. Any better rebuttal?

Did you contact your vendor?

I think you need to do a little more homework before you push back. We do this testing during our audits, but you need to understand what risks you are mitigating with the tool.

Run the names through the Treasury OFAC screening tool. There is an adjustment available for confidence, move it down to about 80. The system will provide you with a score based on the Treasury scoring model (each vendor uses their own scoring model, so don't expect your vendor score to match, but this is a good place to start.)

Get the scoring methodology from your vendor. This way you can understand how your system is scoring name variants.

Generally if I see Treasury scores in the 90's, I expect that most systems will pick these up as well. When you get into the mid and lower 80's, not so much.

If you system is only monitoring names originated from your bank, for example new customers and customer base, then you may be able to get away with higher thresholds on the model since your bank procedures can give some level of confidence that names are accurate and not missing spaces or using nicknames or variations of a name.

If the system is monitoring inbound transactions such as ACH and wires, then you may want to be able to catch any variant names where they may have been changed to avoid detection.

Then, through your OFAC risk assessment process, determine the appropriate threshold for each system, report to the Board and get their approval for accepting risk below the threshold instead of extra work hours to clear false-positives.
.