What's the Dilly-o with sanctions screening: a buyer's guide for credit unions

The Dilly-o

Start with what you already own, because your core or wire platform may already screen for you. Then test any vendor on the four questions below: payment coverage, record retention, list freshness and alert handling.

How we'd size up a vendor

1. Payment coverage - does it screen wires, ACH and instant payments before the money leaves? NCUA Letter 05-CU-09 says each credit union has a responsibility to check the Specially Designated Nationals (SDN) list before completing a transaction and transmitting funds.³
2. List freshness - how fast do OFAC list changes reach your screening, and does it rescreen your whole member base when they do?
3. Alert handling - how does it cut false positives, and can you see why each alert was cleared? If a vendor says it cuts false positives, ask to see the reasoning behind each cleared alert.

What changed this year

The April 24, 2024 law extended the statute of limitations for most sanctions violations from five to 10 years.² OFAC's matching 10-year recordkeeping rule took effect March 21, 2025.¹² Then, on April 10, 2026, NCUA, the OCC and the FDIC proposed new anti-money laundering (AML) program rules for banks and credit unions.⁴ Under that proposal, the agencies would consult FinCEN before certain enforcement or significant supervisory actions.⁴ Comments on the related AML proposal closed June 9, 2026.⁵ Institutions would get about 12 months after a final rule to comply.⁵

Will it work with your systems?

Start by checking what your core and wire platform already do. Fiserv includes sanctions screening in its financial crime suite for credit unions on Fiserv cores.⁶ On Fiserv DNA, the OFAC Monitoring Interface is a DNAapp that extracts all persons or organizations in DNA for OFAC monitoring.⁷ Jack Henry Wires uses Jack Henry's Sanction Screening service for OFAC checks.⁸ If your screening provider is not supported, your staff must key OFAC results into Jack Henry Wires by hand.⁹ We haven't yet verified core fit for any vendor in this category.^C Ask your provider which payment channels it screens automatically and which still need manual entry.

What your examiner will ask

NCUA Letter 05-CU-09 says credit unions carry both BSA and OFAC duties, including regular OFAC training.¹⁰¹¹ For ACH, the originating institution checks the originator and the receiving institution checks the receiver.¹² Have ready your OFAC risk assessment, training records, list update logs, a sample of cleared alerts and your vendor contract.

What it costs

Some vendors post their prices and others sell only on private quotes.¹³¹⁴ One 2026 comparison puts OpenSanctions at €0.10 per API call plus subscription plans.¹⁵ The same comparison says Sanctions.io quotes by annual screening volume.¹⁶ World-Check, LexisNexis and Dow Jones sell multi-year enterprise contracts with no public pricing.¹³ NCUA notes that some credit unions signed steep buyout or termination penalties, and that early termination and default terms are often negotiable.¹⁷ Implementation times are not public, so ask for them in writing.

Food for thought

We'd want to know whether you could explain each automated decision to an examiner. So before you sign, we'd ask each vendor to show you a cleared alert and the record behind it.