Names rarely match exactly. The same person is Müller on one list, Mueller on another and Muller on a third. Krino flattens the differences first, then compares.

​
Using it in a rule

The sanctionsmatch operator applies to a name field; its value is the similarity threshold.
The threshold runs from 0 to 1. 1 means an exact match; in practice around 0.85 catches spelling differences while keeping false matches reasonable.
Start high, look at how many matches come out on the Analytics screen, then lower it in steps. Starting low fills the review queue on day one.

​
What is tolerated

Characters like é ü ø ß æ ı ğ ş are reduced to their base forms. Cases standard decomposition does not solve — Turkish dotless ı among them — are handled explicitly.
Given-name order, middle names, titles and punctuation do not break a match; the comparison works over name parts.
Spellings carried over from other alphabets are caught by the similarity score.

​
Coverage

  • Sanctions lists — consolidated lists from the major regimes, people and organisations
  • PEP — people requiring heightened scrutiny because of public office
  • Your own lists — internal watchlists, through the watchlistmatch operator

​
Your own watchlists

Published lists catch the parties a regulator publishes. They say nothing about the customer you have taken four chargebacks from, the payee your own investigators flagged, or the person a correspondent bank warned you about. Marking a list as holding names of people or companies changes two things: in a rule it is matched with watchlistmatch, using the same normalisation and the same similarity measure sanctions screening uses, and the screening screen searches it alongside the published list.
Comparing a list of names with in catches only the entries somebody happened to type identically in both places. A name reaches you spelled however the customer’s system stored it; a watchlist that demands exact equality never fires in practice and looks like it is working.
The two searches fail differently, and that is deliberate. An empty published list means the host could not load one, and answering “not listed” would be a clearance nobody performed — so that path refuses. Nobody being on your own watchlist is an ordinary state; that path answers no.

​
How long a list entry applies

A list entry can carry an expiry and a reason. The expiry is for entries added in response to something happening now: once it passes, the entry stops applying on its own. Left empty, the entry applies until somebody removes it. An expired entry stays visible in the list, marked — so that somebody asking why a party is no longer blocked can find the answer. The reason is what makes an entry removable later. Who added it and when are already recorded; what is missing is why, and without that the safe answer to “can this go?” is always no.
List changes reach decisions after the cache duration, not instantly. That applies to every change to a list.
A PEP match is usually a reason to review, not a reason to decline. Handle the two with separate rules and separate scores.

​
Scheduled re-screening

Lists change; a customer who was clear yesterday may be listed today. A scheduled run re-screens your existing customer base at an interval you choose and opens cases for new matches. The run itself uses a scenario — so what a match leads to is decided by your rules, as everywhere else.

​
Screening by hand

The engine screens every party a rule points it at. But plenty of names never become a decision: a customer being onboarded, a payee somebody wants to check before releasing a held case, a name that arrived on a phone call. The Screening screen puts one name past the list: a name, a threshold, and scored matches. It uses the same matcher the rule path uses, so what this screen says about a name is what the engine would say about it. Where it differs is that it answers a person rather than a rule: every party above the threshold comes back rather than only the best — the second-best match is often the one that turns out to be right — and one row per party, or an entry with six aliases fills the page with itself.
The threshold is adjustable here and fixed in rules. A rule firing at a threshold nobody chose is a false positive in production; a person widening the net for one search is doing the job, and can read the scores to judge what came back.
A host whose list has not loaded refuses the search rather than reporting no matches. For the same reason, an error clears the previous result: a stale “clear” sitting under a red banner is the one thing this screen must never show.
Every search is recorded with who ran it, on what name, and when. Screening by hand is a compliance act that leaves no other trace — no decision, no case.

​
Sanctioned crypto addresses

A sanctions list carries more than names. The designated parties’ own crypto addresses are screened as well, through their own operator: cryptoaddresssanctioned fires when the value of a String field is an address on the list, and matches exactly on a canonical form of it rather than by similarity — more in Scenarios and rules. The source is OFAC’s SDN list, and only that. It is a work of the US federal government, so it is in the public domain and carries no licensing restriction — which is why it is the one shipped. Broader sources exist; they are licensed differently, and taking one on is a separate decision. That comes to roughly a thousand addresses across about a hundred designated parties, spanning around twenty asset codes. Bitcoin and TRON dominate, which is what the illicit flows actually use. A worker refreshes the list daily. A download that arrives empty, too small or unparseable is refused rather than applied, and the list already in use stays in use — a broken publish upstream must not silently switch screening off. A refreshed list reaches a running host without a restart: the file is polled and the index rebuilt when it actually changes.
The comparison is made on a canonical form of the address, so the same address written in different letter case still matches. Which form is canonical depends on the chain: an Ethereum-style 0x address is folded to lower case, while a Bitcoin or TRON base58 address keeps its case exactly, because lower-casing that one produces a string that is not a valid address at all.

​
A match is not a decision

A name matching does not automatically decline the transaction. The match enters your rules as a signal and you decide the outcome. The decision response carries which list, which record and at what similarity it matched, so the review team can judge it.