OFAC Match Scores Need Change Control, Not Slider Tuning

Executive Summary: An OFAC threshold is a versioned compliance policy, not a configuration number. Every change redistributes candidates between automated continuation and human review. A team that lowers alert volume without a labeled test corpus, approval record, shadow run, rollback plan, and post-release monitoring cannot explain what the new threshold changed. The score itself is only a name-similarity measure. The customer's policy gives it an operational consequence.

What Does the OFAC Search Score Mean?

OFAC explains that its search score is based on name similarity using phonetic and character-similarity logic. A score of 100 represents an exact match, while lower scores can represent potential matches.^[1]

The score is not a determination that a party is sanctioned or cleared. Review must consider the returned record and available identifiers.

Tune the policy with labeled evidence, not the alert count with intuition.

Why Is Threshold Selection a Policy Decision?

A threshold determines which candidates enter review and which do not. Changing it can alter:

• Review volume.

• Candidate composition.

• False-positive burden.

• Protected known matches retained.

• Cases that continue automatically.

• Reviewer procedures and staffing.

There is no universal safe cutoff for every customer, name population, product, or risk program.

What Should the Test Corpus Contain?

Build a versioned, access-controlled corpus with:

1. Known relevant list candidates that must remain protected.

2. Common legitimate customer names.

3. Transliteration and punctuation variants.

4. Individual and organization cases.

5. Short and long names.

6. Common false-positive patterns.

7. Hard cases resolved by reviewers.

8. Expected disposition and evidence.

Do not use fabricated labels as if they were compliance truth. Resolve uncertain examples through the organization's qualified review process.

Which Metrics Should Be Compared?

For each candidate threshold, compare:

• Protected cases retained.

• Review volume.

• Reviewer-confirmed nonmatches.

• Cases with insufficient identifiers.

• Distribution by matched field and score band.

• Queue age and reviewer capacity.

• Disposition disagreement.

Volume reduction alone is not a success criterion.

How Should Shadow Testing Work?

Run the proposed threshold beside the current policy without changing customer outcomes. Store the old route, proposed route, candidate data, and reviewer disposition.

current policy -> production disposition
proposed policy -> shadow disposition
comparison -> approval or revision

Review every protected case and a representative sample of changed routes. Document limitations in the corpus and expected behavior.

What Must the Release Record Include?

• Policy owner.

• Old and new threshold logic.

• Test-corpus version.

• Before-and-after analysis.

• Shadow-run dates.

• Approval and effective time.

• Reviewer and runbook changes.

• Rollback condition and method.

• Post-release monitoring window.

Cobalt's documented OFAC product returns U.S. Treasury-list candidates, scores, and match-field detail.^[2] It is point-in-time screening. The customer owns thresholds, review, recurring re-screening, and decisions.

What Should Trigger Rollback?

Define triggers before release, such as loss of a protected case, unexplained route change, queue behavior outside the approved range, integration defects, or evidence that the corpus does not represent production names.

Rollback should restore the prior policy version without deleting the new run's evidence.

How Should Ongoing Monitoring Work?

OFAC's Sanctions List Service publishes official list data and updates.^[3] A threshold release does not replace recurring screening or list-update handling.

Monitor:

1. Candidate volume by score band.

2. Reviewer dispositions.

3. Protected-case checks.

4. Insufficient-identifier cases.

5. Queue age.

6. Overrides and disagreements.

7. List and screening-version changes.

8. Re-screen events under customer policy.

What Should Reviewers See?

Show the searched subject, list candidate, matched fields, score, aliases, identifiers, list source, screening time, and policy version. Do not show only `possible hit` without the evidence required to resolve it.

What Is the Practical Change-Control Sequence?

Label a representative corpus, measure the current and proposed rules, protect known cases, shadow the change, approve a versioned release, define rollback, and monitor dispositions after activation.

Cobalt supplies Treasury-list candidates and similarity details. The customer owns the compliance policy, qualified review, list-update response, re-screening, and outcome.

Ready to test a threshold change against protected and common-name cases? Schedule a Cobalt Intelligence demo and bring the score bands and reviewer dispositions your current program records.