US restricted-party workflow for Shopify

A useful Shopify restricted-party screening process starts before the name search. It defines the business risk, the parties and orders in scope, the source versions, the review standard, the person who can decide, and the evidence that must remain after fulfillment.

Start with a risk-based scope

OFAC encourages organizations subject to US jurisdiction, and certain foreign organizations with US touchpoints, to use a risk-based sanctions compliance program. Its framework identifies five essential components: management commitment, risk assessment, internal controls, testing and auditing, and training.

For an online seller, a scope exercise can identify:

• jurisdictions and sanctions programs that may apply;
• customers, counterparties, intermediaries, ship-to parties, consignees, and end users;
• products, services, supply-chain touchpoints, and geographic exposure;
• the order events where facts become available or materially change; and
• the role authorized to review, escalate, hold, release, report, or seek counsel.

This is a governance decision. Software should apply the approved policy and preserve the policy used for each order.

Acquire and version the source

OFAC’s Sanctions List Service provides public list files and an API. A screening system should record the source identity, retrieval time, integrity check, parser version, and publication or dataset version used for each run.

When a required source is unavailable, stale, or fails validation, the workflow should mark the check for attention and follow the merchant’s failure policy.

Screen the right parties at the right time

The policy may call for screening at account creation, order creation, payment, a material order or address change, or before fulfillment. The right point depends on the merchant’s facts and where an effective operational control exists.

Normalize names and relevant attributes without erasing the original input. Evaluate aliases, identifiers, addresses, countries, dates, and other available corroborating facts. Preserve both agreeing and conflicting evidence.

Treat a match as a candidate

A matching score signals a possible match for human review. The reviewer should be able to see:

• which source record produced the candidate;
• the names, aliases, and attributes that agreed;
• missing or conflicting facts;
• the applicable policy and threshold version; and
• earlier decisions or approved exceptions that are valid for the current context.

Escalation may be necessary when ownership, identity, end use, product controls, licensing, or legal interpretation cannot be resolved from the available evidence.

Understand ownership limits

OFAC’s 50 Percent Rule can treat an entity as blocked based on direct or indirect aggregate ownership by blocked persons even when that entity is not separately named on a list. A basic name match against published list records does not establish the ownership chain.

The workflow should explain this limit and provide an escalation path for ownership questions.

Record the decision and observed action

The evidence record should identify the order revision, parties screened, source snapshot, policy, matching inputs, candidates, reviewer, rationale, timestamps, requested action, and action the commerce system confirms.

The record should show what RuleNorth recommended, what the merchant requested, and what Shopify confirmed. If an update fails, the system should retry it and preserve the earlier screening result.

Test the whole workflow

OFAC’s framework includes testing and auditing because a screening tool operates inside a larger control environment. Test duplicate events, missing fields, source outages, common names, aliases, order revisions, reviewer access, failed holds, external releases, evidence exports, and retention.

The goal is a risk-based process whose scope, decisions, interruptions, and changes can be understood and reviewed.

Primary sources

Official references used in this guide.

• A Framework for OFAC Compliance CommitmentsUS Treasury OFAC
• OFAC FAQ 445US Treasury OFAC
• OFAC FAQ 401 and the 50 Percent RuleUS Treasury OFAC
• Export Compliance ToolkitUS Commerce BIS
• OFAC Sanctions List Service and additional listsUS Treasury OFAC