Yes, they screen. No, that does not cover you. Banks, card processors and accounts payable platforms run sanctions controls because the rules apply to them. The same rules apply to you, and their controls only see the activity that goes through them.
This guide explains what each kind of provider checks, what falls outside their check, and the small amount of screening that closes the gap.
Why do banks and platforms screen at all?
Because they are bound by the same rules you are. A US bank or a US payment company is a US person under OFAC's rules. If it processes a payment for someone on the SDN list, and no exemption or OFAC license applies, it has broken the rules itself. Its controls protect it.
That shapes what their controls cover. They are built around their own customers and the payments they process. Activity that never goes through them is outside their view.
Does their screening move the obligation to them?
No. OFAC's FAQ 11 says: "All U.S. persons must comply with OFAC sanctions." It does not make an exception for a US person whose bank also screened the payment.
OFAC's June 2026 introduction guide adds that civil penalties can apply "based on a strict liability legal standard." In many cases a US person can be liable "even without having knowledge or reason to know it was engaging in activity prohibited under sanctions laws."
So if a platform misses a match, the payment can still be your violation. If a payment never goes through a screened channel at all, nothing was checked.
The same applies in the UK. OFSI's general guidance says UK financial sanctions "apply to all persons within the territory and territorial sea of the UK and to all UK persons, wherever they are in the world." A bank's screening does not take a business out of that group.
What does each provider check?
Providers rarely publish exactly how they screen, and the details change. Read each provider's current terms. What they do publish shows the general shape.
| Provider | What its published rules cover | What you see if something matches |
|---|---|---|
| Your bank | Payments it sends or receives for you | A held, rejected or blocked payment and questions from the bank |
| Card processor, such as Stripe | Who may hold an account and which countries it serves | A closed account or a refused payment |
| AP platform, such as BILL | Payments made through the platform | A payment held for review, then released, rejected or blocked |
None of them gives you a dated record of checks on your contacts that you can hand to an auditor.
Stripe's restricted businesses policy, for example, says it prohibits use of its services by people and entities on US, UK or EU restricted-party lists, including those subject to OFAC sanctions. It also lists high-risk territories it does not serve, such as Cuba, Iran, North Korea and Syria. That is a rule about who may use Stripe. It is not a check of your vendors.
BILL publishes an AML and OFAC program statement and a help article on payments held for OFAC review. It describes holding a payment, asking for information, and releasing, rejecting or blocking it depending on the result. That check runs on payments made through BILL.
What falls outside their check?
Four gaps are common.
Payments that go another way
A customer who pays by check, a vendor you pay by wire from a different account, a refund sent through a marketplace. Each platform sees only its own traffic. Your QuickBooks Online or Xero file is the only place that lists everyone you pay and everyone who pays you.
The moment before payment
You sign a contract, ship goods or deliver a service before any money moves. If the customer is sanctioned, dealing with them can already be a violation. A payment check at the end comes too late for that.
Ownership
A name search finds names. It does not find a company that is not listed itself but is 50% or more owned by someone who is. OFAC treats those companies as blocked under its 50 Percent Rule. Platforms screen the name on the payment. Asking who owns a new supplier is up to you.
Lists your provider doesn't use
A US processor's controls are built around OFAC's lists. They may not cover the UK, EU, Australian or New Zealand lists that bind you if you trade there. If you sell into the UK, the UK Sanctions List applies to that business whatever your payment processor checks.
Why your own record matters
A platform's check leaves no trace you can use. When a bank, an auditor or a large customer asks "how do you screen your vendors?", the answer "our payment provider does it" usually leads to the next question: "can you show us?"
If something goes wrong, OFAC's enforcement guidelines weigh whether you had a risk-based compliance program at the time. Its compliance framework describes what one looks like. OFAC's recordkeeping rule, 31 CFR 501.601, requires records of transactions subject to its regulations to be kept for at least 10 years. A screening log with dates is the simplest evidence of a program.
A minimum setup that closes the gaps
A screening routine and dated records are a practical baseline for a small business.
- Screen every new vendor and customer when you create them in QuickBooks Online or Xero, before the first bill, invoice or contract.
- Rescreen when the lists change, or on a schedule you can defend. A clean name in March can be listed in June.
- Ask new foreign suppliers who owns them, and screen the owners too.
- Keep a dated record of each check: name, date, lists, result, reviewer.
Our step-by-step guide to screening QuickBooks vendors against the OFAC list shows how to do this by hand. For a wider view of who has to screen, read do small businesses need OFAC screening?
Sanctions Verified, opening to QuickBooks Online and Xero users, screens every vendor and customer in your file against eight official lists, rechecks them when they change or appear on a new bill or invoice, and keeps a dated certificate for each check. You can check one name now with the free check.
If your provider flags a payment
Answer the provider's questions quickly and accurately. Don't resend the payment through another channel. Check the name yourself against the official list, comparing details such as address, date of birth or registration number. If the match looks real, stop all dealings with that party and get legal advice before you do anything else. Our guide to sanctions compliance for small businesses covers what to do with a true match.
