Data Points

🚫 Sanction / Watchlist Entry

🔧 Native workbench

🔗 Analyst pivots

🔌 Sources that yield Sanction / Watchlist Entry (9)

🧭 Disciplines

🎯 Mission Domains

🔍 Lookup

🔄 Live Datasets & APIs (8 key-free · ingestible)

📜 Playbook — Sanction / Watchlist Entry exploitation

1. Direction — frame the requirement for Sanction / Watchlist Entry: what decision does this support, by when?
2. Collection — pull the 9 mapped sources (8 free) and the native workbench (open); capture provenance and observe OPSEC.
3. Processing — normalize, de-duplicate and enrich the collected data.
4. Analysis — correlate against local holdings; apply ACH; assign confidence.
5. Dissemination — open a case, draft a report, share via STIX/MISP.
6. Feedback — set an alert rule / watchlist to monitor for change.

⚡ AI Skills & Automation

Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).

🗃 Data Management

🧩 Advanced Capabilities

✨ Enrichment pathways

🎫 Sanction / Watchlist Entry

A sanction or watchlist entry is a named individual, entity, vessel, aircraft, or address designated by a government or multilateral body as restricted from trade, finance, or travel. It matters because a positive match halts transactions, exposes counterparty risk, and often anchors an entire illicit-finance network worth mapping.

Format: Structured record: legal name + aliases, program code (e.g. SDGT, IRAN-EO13846), listing ID (OFAC SDN Unique ID, EU logical/regulation ref, UN permanent reference number QDi.xxxx), listing date, and identifiers (DOB, passport, tax ID, crypto/BIC).

📡 How it is collected

• Screening a name/entity against consolidated designation lists
• Bulk ingest of OFAC SDN, EU, UN, HMT/OFSI, DFAT files
• Adverse-media and enforcement-action monitoring
• Corporate registry and UBO cross-referencing
• Transaction/payment filter alerts from screening engines
• Regulatory press releases and Federal Register notices

📚 Enrichment & validation sources

🔗 Pivot to

🧩 Analysis & hunting techniques

• Fuzzy name matching (Jaro-Winkler, Levenshtein, phonetic/Soundex)
• Alias and transliteration normalization
• Entity resolution across multiple lists
• 50% Rule ownership aggregation for indirect exposure
• Network expansion to co-designated entities
• False-positive tuning with DOB/ID disambiguation
• Delta monitoring for new/updated designations
• Secondary-sanctions exposure modeling

🔧 Tools

• OpenSanctions yente
• OpenSanctions FollowTheMoney
• Elasticsearch
• OpenRefine
• Neo4j
• sanctions-search CLI
• Maltego
• Aleph

⚡ Workbench actions

• Screen against sanctions lists
• Aggregate 50% ownership exposure
• Resolve aliases and transliterations
• Expand co-designated network
• Diff against previous list version
• Score match confidence
• Export SAR-ready evidence pack
• Pivot to linked accounts and addresses

📊 Dashboard KPIs

📂 Open