Ask a compliance officer at an Indian bank or NBFC which sanctions lists they screen against, and the answer is almost always “all of them” — UN, OFAC, EU, and usually a handful of others besides. Ask the same officer which of those lists they are legally obligated to screen against under Indian law, and the answer gets noticeably less confident.
This is not a small distinction. Conflating a statutory obligation with a risk-based best practice changes how a programme is designed, how exceptions get handled, and — critically — how a regulator evaluates a gap when one is found. India has exactly one sanctions list with binding domestic legal force. Everything else that regulated entities screen against, however important operationally, sits in a different category entirely.
The Only Mandatory List: UNSC Sanctions Under UAPA Section 51A
The legal foundation is Section 51A of the Unlawful Activities (Prevention) Act, 1967, operationalised through the UAPA Order dated 2 February 2021 (as amended) and reiterated in paragraph 51 of RBI’s KYC Directions, 2025 (the successor to the 2016 Master Direction). The obligation is unambiguous: regulated entities shall not maintain any account in the name of an individual or entity appearing on the sanctions lists maintained by the United Nations Security Council.
In practice, this means three consolidated UNSC lists:
- The ISIL (Da’esh) and Al-Qaida Sanctions List, maintained under Resolutions 1267 (1999), 1989 (2011) and 2253 (2015) — by far the most frequently updated, with RBI issuing implementation circulars nearly every time an entry is added, amended, or delisted.
- The Taliban Sanctions List, maintained under the 1988 Committee.
- Related consolidated designations issued under subsequent UNSC resolutions addressing terrorism financing and proliferation.
What makes this list categorically different from every other sanctions source is enforcement mechanics. When the UNSC adds or removes an entry, the Ministry of External Affairs notifies RBI, which then issues a circular instructing all regulated entities — commercial banks, small finance banks, payment banks, cooperative banks, NBFCs, asset reconstruction companies, and All India Financial Institutions — to update screening databases immediately. SEBI issues parallel circulars for stock exchanges, depositories, KRAs, and registered intermediaries under its own AML/CFT Master Circular. This is not guidance. It is a statutory freeze obligation, and failure to act on it is a compliance breach, not a risk judgment call.
A few operational details are easy to miss but matter considerably:
- The list changes far more often than most calendars assume. RBI issued multiple UAPA implementation updates through 2025 and 2026 alone — additions, amendments, and delistings arriving as frequently as monthly, sometimes with only a single entry changed. A screening programme calibrated to a quarterly or even monthly refresh cycle is, by definition, out of compliance for stretches of time between updates.
- The obligation covers more than new account opening. Section 51A requires that no account be maintained in a listed name — meaning existing customer bases must be re-screened against every list update, not just new applicants at onboarding. A programme that only screens at CIP stage and never rescans the back book has a structural gap regulators specifically look for.
- Delisting has a formal, two-track channel. Individuals or entities seeking removal must route requests through the Joint Secretary (CTCR) at the Ministry of Home Affairs, or directly to the UN Ombudsperson. Regulated entities that receive a delisting request are themselves obligated to forward it electronically — a procedural detail many compliance manuals omit, leaving frontline staff unsure what to do when a customer disputes a match.
- Freeze precedes proof. The obligation is to act on appearance on the list, not to independently verify the underlying allegation. This is a deliberately low-friction, high-speed control, and treating it with the same evidentiary caution as an internal fraud investigation slows down a response that is supposed to be immediate.
OFAC: Not Law in India, But Rarely Optional in Practice
The U.S. Office of Foreign Assets Control’s Specially Designated Nationals (SDN) list, along with its country- and sector-based sanctions programmes, carries no direct legal force under Indian statute. No Indian law requires an NBFC in Pune to screen a domestic retail customer against the SDN list.
Yet OFAC screening is close to universal across Indian banks and increasingly common across NBFCs and fintechs. The reason is not legal obligation — it’s exposure. Several mechanisms create de facto compulsion:
- Correspondent banking and USD clearing. Almost every cross-border USD transaction routes through a U.S. correspondent bank at some point, and that correspondent is bound by U.S. law regardless of where the underlying transaction originates. An Indian bank that fails to screen against OFAC risks having its correspondent relationships suspended or terminated — a much faster and more painful consequence than any Indian regulatory action, since it can effectively cut off dollar-clearing capability overnight.
- Secondary sanctions risk. OFAC’s authority extends extraterritorially in specific circumstances, particularly around dealings with sanctioned jurisdictions, sectors, or designated entities. An Indian institution with no U.S. presence can still face reputational and access consequences if it is seen to be facilitating transactions OFAC has designated as sanctionable.
- The 50% ownership rule. OFAC’s SDN prohibitions extend not just to a designated individual or entity but to any entity that a designated party owns 50% or more of, even where that downstream entity does not itself appear by name on any published list. This makes name-only screening insufficient for institutions with meaningful corporate or trade finance exposure — beneficial ownership mapping becomes part of the sanctions control, not just the KYC control.
- Sectoral sanctions are a separate list from the SDN list. OFAC maintains distinct sectoral sanctions identifications for specific industries and transaction types, which many screening vendors do not check by default unless separately configured. A programme that believes it is “OFAC compliant” because it screens against the SDN list may still be blind to sectoral designations entirely.
- Group and correspondent contractual requirements. Many Indian financial institutions operate under group compliance policies (where a parent or affiliate has U.S. exposure) or under correspondent banking agreements that contractually require OFAC screening as a condition of the relationship, independent of what Indian law demands.
The practical upshot: OFAC screening in India is best understood as a commercially mandatory, legally voluntary control — voluntary in the sense that no Indian statute compels it, mandatory in the sense that almost no institution with meaningful cross-border or dollar-denominated activity can safely operate without it.
EU Sanctions: Narrower Relevance, Same Logic
European Union sanctions lists — covering EU-designated individuals, entities, and country-specific restrictive measures — follow the same non-binding-but-often-necessary logic as OFAC, at a smaller scale of relevance for most Indian REs. It is also worth distinguishing two categories within the EU framework itself: measures that simply implement UNSC designations (already captured if UN screening is done properly) and the EU’s own autonomous sanctions regimes, which go beyond UN designations and apply only if an institution chooses, or is required by a European counterparty, to adopt them.
EU sanctions matter primarily where an institution has:
- Correspondent relationships with European banks, which are themselves bound by EU sanctions law and will expect counterparties to screen consistently.
- Customers or transactions with EU nexus — European subsidiaries, EU-domiciled beneficial owners, or trade finance involving EU counterparties.
- Group compliance obligations, where an Indian entity’s European parent or affiliate extends its own sanctions programme across the group.
For a purely domestic-facing NBFC or a payment aggregator with no cross-border rails, EU sanctions screening adds limited practical value. For a bank with meaningful European correspondent banking or trade finance exposure, skipping it is a genuine gap — just not a statutory one.
The List India Adds That Foreign Frameworks Don’t
Beyond the UNSC lists incorporated via Section 51A, India maintains its own domestic terrorist designation mechanism under the UAPA — organisations banned under Section 35 and individuals designated as terrorists under the Fourth Schedule. These sit alongside, not instead of, the UNSC obligation, and are frequently underweighted in screening programmes that focus heavily on the internationally recognisable UN and OFAC lists while treating the domestic schedule as an afterthought. A compliance programme built entirely around international list feeds, without a dedicated domestic designation check, has a structural blind spot precisely where an Indian examiner is most likely to probe.
Where Screening Programmes Actually Break
Screening against the right lists is a necessary but not sufficient condition for an effective programme. Several matching and design realities complicate execution regardless of which lists are in scope:
- Transliteration variance. A significant share of UNSC and OFAC designations involve names originally rendered in Arabic, Cyrillic, or other non-Latin scripts, transliterated into English with multiple accepted spellings. A name-matching engine tuned only for exact or near-exact string matches will systematically miss legitimate hits that differ by a single transliterated vowel.
- The false-positive/false-negative tradeoff. Loosening match thresholds to catch transliteration variance increases false positives dramatically, particularly against common South Asian names, creating alert fatigue that pushes analysts toward faster, shallower reviews — which in turn increases the odds of missing an actual true positive buried in the noise.
- List consolidation isn’t the same as list currency. Many institutions buy a “consolidated sanctions list” product from a vendor and assume this discharges the obligation to track UNSC updates in real time. Vendor refresh cycles vary, and paragraph 51 doesn’t grant a grace period for a vendor’s update lag — the regulatory clock starts when the UNSC publishes, not when a third-party feed catches up.
What Happens When It Goes Wrong
The consequences of a sanctions screening gap differ sharply depending on which list failed, and compliance teams often underestimate how disproportionate the downside can be relative to the size of the miss:
- A UAPA/UNSC miss is a direct statutory violation, exposing the institution to RBI enforcement action under the Banking Regulation Act, personal accountability for the designated Principal Officer under PMLA reporting obligations, and — in aggregate, across the sector — contributes to how FATF assesses India’s own terrorist-financing controls at the national level.
- An OFAC miss rarely triggers Indian regulatory action directly, but can trigger correspondent bank de-risking: a foreign correspondent unilaterally deciding the relationship carries too much sanctions risk and terminating USD-clearing access, sometimes with limited notice and very little room to negotiate.
- Reputational contagion moves faster than either. A publicised sanctions-screening failure — even one confined to a single missed OFAC match — tends to trigger enhanced scrutiny from every correspondent and insurer the institution deals with, not just the one relationship directly affected.
Getting the Hierarchy Right
For an Indian regulated entity building or auditing a screening programme, the practical hierarchy looks like this:
- Non-negotiable, statutory, and covering the full back book: UNSC 1267/1988/1989 lists via UAPA Section 51A, plus the domestic UAPA Schedule designations — updated on receipt of every RBI or SEBI circular, not on a fixed calendar.
- Commercially essential for cross-border or USD-exposed institutions: OFAC SDN and sectoral sanctions lists, including beneficial-ownership screening under the 50% rule.
- Relevant based on specific exposure: EU sanctions lists, screened where correspondent, group, or customer nexus with Europe exists.
- Contextual and risk-based: other national lists (UK OFSI, Australia DFAT, and similar) adopted based on an institution’s specific footprint rather than universal application.
The mistake most compliance programmes make is not screening against too few lists — it is treating all of them as equally mandatory, which obscures the one list where a gap is a straightforward legal violation, versus the others where a gap is a risk decision that should be made deliberately, documented, and defensible on its own terms.