We are being asked this question in preparation for an exam: "Does the financial institution maintain a current listing of prohibited countries, organizations and individuals?" We don't maitain a list anywhere, we have an automated system that performs our OFAC checks. Must I maintain a list?

The process of the automated system gives you your Yes answer.

Just make sure you actually know what is on the lists in the system. I have seen many banks that do not know what countries are in the system used, or what lists are in there besides OFAC lists. You can't just buy it and say "great!".

Just make sure that your automated system covers all of the areas that you should be checking. If any of them are non-automated, you may have to refer to the list.

Good point. I often see banks that have:

one system for deposit accounts
another system for loans
wire system with built in interdiction software
manual checks for lcs
and another system for ongoing batch checks!

Where exactly is the most current OFAC list?

And be sure you know how to access those lists within the automated system...

I think this is the most current list unless someone else knows better:

http://www.treas.gov/offices/enforcement/ofac/sdn/

and this

http://www.treas.gov/offices/enforcement/ofac/programs/