Compliance Doesn't Pause: Why a Clean August Screening Can Become an October Problem
A sanctions screening result is a timestamp, not a lifetime clearance. Here is why the gap between a school's onboarding review and the money that keeps moving all year is a coverage problem, an ownership problem, and an evidence problem.
A business office screens a tuition payer in early August, before the first invoices go out. The name comes back clear. The report goes in the file, the family is enrolled, and the office moves on to the eleven other things that have to happen before opening day.
Six weeks later, OFAC designates someone connected to that payer. Not the payer, at first. A related person, an entity with an ownership link, or an alias that finally gets attached to an existing listing. Nothing the school did was wrong. The August screening was accurate on the day it ran, and it is still accurate about that day. It simply no longer answers the question the school needs answered in October, which is not was this person clear in August but is this payment, today, one we can accept.
A clean screening result is not a lifetime clearance. It is a timestamp.
The short answer
Why isn't a once-a-year OFAC screening enough for a school? Because the screening answers a question about one day, and a school year is a relationship that keeps generating new transactions and new parties after that day. The defensible position is not screening everyone constantly. It is a written, risk-based process that says who is covered, when they are checked again, who reviews a possible match, and what evidence the school can still produce months later.
What a screening result actually means
A screening result is a comparison. It takes the identifying information a school holds about a person or an organization and compares it against the contents of a set of lists as those lists existed at that moment. That is the whole of it. It is a useful, documentable act, and it is genuinely worth doing.
What it is not is a status conferred on the person. Three things can move underneath a result without anyone at the school touching anything. The lists change, because designations and removals are published continuously. The identifying data changes, as an existing listing picks up an alias, a date of birth, a passport number, or a new address that makes a previously weak comparison much stronger. And the relationship changes, because the school begins a new transaction, or a different person starts paying.
None of that means a prohibited transaction has occurred. Most list activity in any given month will have nothing to do with any school in the country. The point is narrower and harder to argue with: the answer you have is about a date that is receding, and nothing about the passage of time refreshes it.
August 2026, as a worked example
This is not hypothetical, and it does not require an enforcement story to make the point. Take the month most independent schools spent opening: August 2026. OFAC's Recent Actions log records twelve dated actions between August 3 and August 28, of which eight are categorized as sanctions list updates.
OFAC dated actions, August 2026
Source: OFAC Recent Actions, as listed on August 29, 2026. Categories are OFAC's own.
A screening run on August 4 was compared against a list that changed on eight separate days before the month was over. That is the mechanism, stated plainly. It is also why the interesting question for a school is not really about frequency at all. If you want the frequency argument in full, including what OFAC has told a heavily regulated industry about screening cadence, we covered that in how often a school should screen. This piece is about the three things that decide whether your cadence is worth anything: coverage, ownership, and evidence.
The back-to-school gap
Enrollment is compressed. It happens in a defined season, with a defined checklist, and it is the moment a school is most organized about diligence. Everything the money actually does happens afterward, and it is spread across ten months.
Tuition arrives on a payment plan. A grandparent or a family trust starts paying in January without ever appearing in the admissions file. A sponsor takes over for a boarding student in the spring term. The advancement office closes a major gift in November from someone admissions never met. International students and their payers stay active for years, across renewals that nobody re-examines because the family is familiar. Vendors get onboarded in October because a boiler failed.
Every one of those is a party or a transaction that arrived after the onboarding review closed. This is what makes the problem a coverage problem first. Most schools that discover a gap do not discover that their screening was bad. They discover that a whole category of people was never in scope.
On payment processors and tuition platforms
Providers in the payments chain run sanctions controls of their own, and those controls are real. What they generally will not hand you is your own institution's review record: which of your parties were checked, who at the school evaluated a possible match, what they decided, and why. A provider's control is a layer, and it is a useful one. It is not a substitute for a documented process you can describe and evidence yourself. We went deeper on this in why your payment processor isn't your compliance program.
What a point-in-time record leaves open
A result treated as a clearance
- ✕Speaks only to the lists as they stood on the date it ran
- ✕Silent on designations, alias additions, and identifier updates published since
- ✕Silent on parties who joined the file after onboarding closed
- ✕Possible matches resolved informally, with no record of who decided or why
- ✕Re-running depends on someone remembering, in a season when nobody has time
A result treated as one step in a process
- Scope is written down, so you know who is covered and who is not
- A defined interval re-checks the active population without anyone remembering
- Material events trigger a check regardless of where you sit in the interval
- Possible matches go to a named reviewer who records a disposition and a reason
- The source list, date, result, reviewer, and rationale are retained together
The question an auditor asks is rarely "did you screen." It is "who was outside the scope, and how would you know."
What a defensible process looks like
There is no OFAC rule that gives schools an interval. What OFAC has published is a posture. The Framework for OFAC Compliance Commitments asks organizations to take a risk-based approach and to develop, implement, and routinely update a sanctions compliance program built on five components: management commitment, risk assessment, internal controls, testing and auditing, and training. It also says a program varies with an organization's size and sophistication, its products and services, its customers and counterparties, and its geography. A school is entitled to reason from that rather than to copy a bank.
Define who the school screens
Write down the population: students, parents and guardians, tuition payers who are not the parents, guarantors, sponsors, placement agents, trustees, major donors, and vendors with facility access. The gap is usually in this list, not in the software.
Choose a documented, risk-based cadence
Pick an interval your institution can actually sustain and explain, and record the reasoning. A day school with a domestic payer base and a boarding school with international sponsors are not the same risk profile and should not default to the same answer.
Re-screen when a material event occurs
A new payer, a changed guarantor, a mid-year sponsor, a large or unusual gift, and a new vendor relationship are all moments where the file changed. Those are screening events regardless of where you sit in the interval.
Route possible matches to a named reviewer
Name the role, not just the team. Someone specific should own the decision, and that person should have the identifying information needed to make it rather than a score in isolation.
Record the decision and the rationale
A disposition without a reason is hard to defend later. Capture what distinguished the party from the listed entry, or what did not.
Preserve the source, date, result, and evidence
Keep the list version and screening date alongside the outcome. 31 CFR 501.601 sets a five-year examination window for transaction records, which is longer than most people assume when they save a PDF to a shared drive.
Revisit the program when the population changes
A new international recruiting partnership, a new payment method, or a new campus changes the risk assessment. The Framework treats the program as something you routinely update, not something you finish.
Screening software is not a verdict machine
A possible match is a prompt to look, not a finding. OFAC's own FAQ 5 reads like a triage script, and it is worth handing to whoever does this work at your school. Establish that the hit is against an OFAC list at all rather than some other list the tool happens to carry. Check whether an individual is being matched against a company or a vessel, which is not a valid match. Check whether only part of the name lines up, such as a surname alone. Then compare the full listed entry against everything you hold: nationality, place and date of birth, passport or tax identifiers, addresses, former names, and aliases. Where real similarities remain, OFAC points to its compliance hotline, and a probable match is the moment to involve counsel.
Notice that almost every step depends on information a person has to assemble and weigh. Software should make that fast: surface the comparison, show the identifiers side by side, and capture the outcome in a form that survives. The determination belongs to qualified people at the institution, and a system that quietly clears or quietly blocks without leaving a reviewer and a rationale behind has removed the most valuable part of the record.
Five questions to ask before the semester gets busy
If a trustee asked these at the next finance committee meeting, could you answer them today?
- 1Who did we screen at onboarding?
- 2Who was left outside the process?
- 3When will those records be screened again?
- 4Who owns possible-match review?
- 5Can we produce evidence of the screening and the decision months later?
The fifth question is the one that tends to land hardest, because it is the one with a legal shape. 31 CFR 501.601 requires a full and accurate record of each transaction subject to those regulations, available for examination for at least five years after the transaction date. A screening PDF in a folder named after a school year is not obviously that. A record that carries the source list, the date, the result, the reviewer, and the reason is.
Compliance as a process, not a ceremony
The goal is not to screen everybody constantly. Constant screening of an unexamined population is just a more expensive way to have the same coverage gap. The goal is a reasonable, documented process that keeps pace with the relationships and transactions the school actually has, and that produces a record someone can still read in three years.
Review your screening cadence before the school year gets fully underway. Know who is covered, know who reviews a potential match, and know what evidence your school can produce. If the honest answer to any of those is a shrug, that is the work, and August is a better time to find it than February.
School screening and rescreening: FAQ
Primary sources
- OFAC Recent Actions (the running log of designations, removals, and general licenses)
- A Framework for OFAC Compliance Commitments (May 2019)
- OFAC FAQ 5: How do I determine if I have a valid OFAC match?
- 31 CFR 501.601: records and recordkeeping requirements (eCFR)
- OFAC Sanctions Programs and Country Information
Sanctions list status, OFAC guidance, and general licenses change frequently. The August 2026 action counts above were read from OFAC Recent Actions on August 29, 2026; verify current status against the agency before relying on any of it. This article is educational and is not legal advice.
Know who is covered, and what you can prove
SecurePoint Education screens the parties a school actually deals with, imports your roster, re-checks parties automatically on a 30-day or 90-day interval, routes possible matches into a review workflow where a person records the decision and the reason, and assembles evidence packs from those records. Your program stays yours. This is one control inside it.
