Fuzzy Matching

Why Exact-Name Searches Are Insufficient

Government watchlists contain names transliterated from Arabic, Chinese, Russian, Persian, and other scripts into the Latin alphabet — a process with no single standard. A single individual may appear on a watchlist under a dozen different spelling variations of their name. An exact-name search that checks only the precise string of characters entered would miss every variation that differs by even a single character.

Beyond transliteration, common compliance challenges include: different name-ordering conventions (family name first vs. last), legal name vs. commonly used name, use of initials, hyphenated names, names that include honorifics or titles, and typographical differences introduced during data entry. A compliance program that relies on exact-name searches is not meeting the regulatory expectation of a thorough screening process.

How Fuzzy Matching Works in Practice

Fuzzy matching algorithms calculate a similarity score between two strings, accounting for character substitutions, insertions, deletions, and transpositions. Common approaches include Levenshtein distance (counting the minimum edit steps between strings), phonetic algorithms like Soundex or Metaphone (matching names that sound alike when spoken), and n-gram comparisons (matching overlapping character sequences).

In commercial screening tools, fuzzy matching is typically expressed as a confidence score or match percentage — a number indicating how closely a screened name matches a watchlist entry. Scores above a threshold (commonly 85% or higher) are flagged for human review, while lower scores are automatically cleared.

Match Scores and Review Thresholds

The appropriate match score threshold for a compliance program involves a trade-off between false positives (legitimate parties flagged as potential matches) and false negatives (restricted parties that escape detection). A very high threshold (e.g., 95%) produces fewer false positives but risks missing real matches. A lower threshold (e.g., 70%) catches more variations but generates more manual review work.

BIS and OFAC have not published a specific numerical threshold requirement. The regulatory expectation is that the screening process be "reasonable and accurate" — which is understood to mean using fuzzy matching at a threshold that would catch the kinds of spelling variations common in international trade, documented with a defensible rationale for the threshold chosen.

False Positives and False Negatives

A false positive is a fuzzy match result where the screened party is flagged as a potential match but is determined upon review to be a different person or entity — not an actual restricted party. False positives are common, particularly with common names, and require documented human review to resolve. The review conclusion and rationale must be retained in your audit trail.

A false negative — where a genuine restricted party passes screening without being flagged — is the more serious compliance failure. False negatives can occur when a screening tool uses an excessively high match threshold, when the watchlist entry contains unusual transliterations, or when the screened name uses a different alias than the one on the watchlist. Using an up-to-date tool with documented fuzzy matching capability is the primary defense against false negatives.

Frequently Asked Questions