Noble Sight
OFAC listed the filter's defects. Here they are, one request each.
Most enforcement releases describe what a company did. Payoneer's describes what its screening software did not do, in a numbered list: close matches it let through, bank identifier codes it never screened, flagged payments it released during a backlog, and addresses in Crimea it did not read. Four defects in one filter, $1,385,901.40, 2,220 apparent violations. This page takes the list in OFAC's order and gives one request for each, with the response field that shows the control.
Source: ofac.treasury.gov/media/911571/download (PDF, 4 pages, corrected release). Every quotation below is verbatim from that document. Part of Noble's enforcement series.
Payoneer Inc. (“Payoneer”), a publicly traded New York-based online money transmitter and provider of prepaid access, has agreed to remit $1,385,901.40 to settle its potential civil liability for 2,220 apparent violations of multiple sanctions programs.
Enforcement Release, page 1. Aggravating factor 1: Payoneer "failed to exercise a minimal degree of caution or care for its sanctions compliance obligations when it allowed persons on the SDN List and persons in sanctioned locations to open accounts and transact as a result of deficient sanctions compliance processes that persisted for a number of years" (page 2).
KEY to a Noble API key. A free-tier key works; keys are invite-only while Noble is in beta (sales@noblesight.io). The first four requests are self-contained. The two in step 3 read an alert the earlier requests opened; set ALERT_ID from any alert_id in their responses.
| # | OFAC's words | Noble's control | Field that proves it |
|---|---|---|---|
| i | Weak algorithms let close matches through | A misspelling scores against the listed name and alerts at the threshold | summary.verdict · alert_id |
| ii | No screening for BICs, even when the SDN entry had one | A SWIFT/BIC in ids[] is screened like a name | matches[].matched_via |
| iii | Flagged payments auto-released during a backlog | An alert stays open until a person closes it, with a deadline | status · due_at · overdue |
| iv | No flagging of addresses in Crimea | A Crimean city in the address raises the advisory | jurisdiction_nexus.source |
"Weak algorithms that allowed close matches to SDN List entries not to be flagged"
The Apparent Violations, which related to commercial transactions processed by Payoneer on behalf of its corporate customers and card-issuing financial institutions, resulted from multiple sanctions compliance control breakdowns, including (i) weak algorithms that allowed close matches to SDN List entries not to be flagged by its filter, (ii) failure to screen for Business Identifier Codes (BICs) even when SDN List entries contained them, (iii) during backlog periods, allowing flagged and pended payments to be automatically released without review, and (iv) lack of focus on sanctioned locations, especially Crimea, because it was not monitoring IP addresses or flagging addresses in sanctioned locations.
Enforcement Release, page 1, "Description of the Conduct Leading to the Apparent Violations". OFAC's compliance note on page 3 asks for "performing algorithm testing to be sure filters are flagging payments within expected parameters".
What failed
A filter that needs the exact spelling is not a filter. Nineteen of Payoneer's payments were on behalf of persons on the SDN List; the release says the algorithm let close matches through, and that the testing meant to catch that did not.
Noble's control
A name is scored against every listed name and alias on a 0 to 100 scale, with the band in summary.verdict. A score at or above the account's alert threshold opens an alert in the same response. The request below drops one letter from a designated oligarch's surname; it is restricted to OFAC so the score shows the algorithm and not a list that happens to carry the variant.
Run it: a close match, one letter off
curl -s -X POST https://api.noblesight.io/v1/screen -H "X-API-Key: $KEY" -H "Content-Type: application/json" -d '{"name":"Alisher Usmanof","lists":["ofac"]}'
The fields: summary.verdict, matches[0].score, alert_id
"alert_id": 43992, "alert_reason": "score_threshold",
"summary": { "verdict": "strong_match",
"top_match": { "uid": "35283", "name": "USMANOV, Alisher Burhanovich", "score": 86.7, "source": "OFAC SDN" } },
"matches": [ { "uid": "35283", "score": 86.7, "programs": ["RUSSIA-EO14024"], "prohibition_type": "blocking", ... } ]
Captured from production on 2026-10-24, engine 2.4.0. Screened against all nine lists instead of OFAC alone, the same input scores 100: the UK list publishes that spelling as an alias. The OFAC-only run is the honest test of the algorithm. Scores and the threshold are documented in the API reference; a score between the threshold and 100 is the whole reason a verdict band exists.
The SDN entry had the bank's BIC. The filter never looked at it.
Enhancing its screening software to include financial institution alias names and BIC codes and automatically triggering a manual review of payments or accounts that match persons on the SDN List;
Enforcement Release, page 3, Payoneer's remedial measures. The defect itself is clause (ii) on page 1: "failure to screen for Business Identifier Codes (BICs) even when SDN List entries contained them". The compliance note adds: "screening for BIC codes, especially when OFAC includes them in SDN List entries" (page 3).
What failed
OFAC publishes SWIFT/BIC codes on the SDN entries of designated banks. A payment names its bank by that code. Payoneer screened names and not codes, so a designated bank spelled any way at all went through on its own identifier.
Noble's control
Every identifier OFAC publishes on an entry is screened as a first-class input: a SWIFT/BIC, a registration number, a passport, a wallet address, an IMO number. Send it in ids[], alone or beside the name, and a hit names the identifier in matched_via. The same request, one audit row.
Run it: the BIC alone
curl -s -X POST https://api.noblesight.io/v1/screen -H "X-API-Key: $KEY" -H "Content-Type: application/json" -d '{"ids":[{"type":"SWIFT/BIC","number":"VTBRRUMM"}]}'
Run it: the payment as it would arrive, name and BIC together
curl -s -X POST https://api.noblesight.io/v1/screen -H "X-API-Key: $KEY" -H "Content-Type: application/json" -d '{"name":"VTB Bank PJSC","entity_type":"entity","ids":[{"type":"SWIFT/BIC","number":"VTBRRUMM"}]}'
The field: matches[].matched_via
# the BIC alone
"alert_id": 43989, "alert_reason": "score_threshold",
"summary": { "verdict": "confirmed_match",
"top_match": { "uid": "17013", "name": "VTB BANK PUBLIC JOINT STOCK COMPANY", "score": 100, "source": "OFAC SDN" } },
"matches": [ { "uid": "17013", "score": 100,
"matched_via": [ { "number": "VTBRRUMM", "type": "SWIFT/BIC" } ],
"programs": ["RUSSIA-EO14024", "IRAN-EO13902", "UKRAINE-EO13662"], "prohibition_type": "blocking", ... } ]
# name and BIC together
"alert_id": 43991,
"summary": { "verdict": "confirmed_match", "top_match": { "uid": "17013", "score": 100 } },
"matches": [ { "uid": "17013", "score": 100, "matched_via": [ { "number": "VTBRRUMM", "type": "SWIFT/BIC" } ], ... } ]
Captured from production on 2026-10-24. The code is screened as OFAC published it, normalized for case and punctuation, and type may be omitted to search every identifier category. Not every designated bank's entry carries a BIC: OFAC publishes none for Bank Melli Iran, for example, and Noble cannot match an identifier a list does not publish.
A flagged payment that releases itself was never flagged
Pending transactions flagged by its filter instead of allowing them to complete during a backlog; and
Enforcement Release, page 3, Payoneer's remedial measures. The defect is clause (iii) on page 1: "allowing flagged and pended payments to be automatically released without review". The compliance note: "holding flagged payments until they have been reviewed" (page 3).
What failed
The filter worked and then a queue rule undid it: when the review backlog grew, pended payments were released unreviewed. The control existed only when nobody was busy.
Noble's control
A match at the threshold opens an alert in the screening response, and there is no path that closes it except a person calling POST /v1/alerts/{id}/resolve with a reason code. The alert carries due_at from birth, 24 hours at score 90 and above, and GET /v1/alerts/stats counts every alert past it as overdue. A backlog is a number on a dashboard, not a release valve.
Read the alert the BIC request opened
curl -s https://api.noblesight.io/v1/alerts/$ALERT_ID -H "X-API-Key: $KEY"
Count what is waiting
curl -s https://api.noblesight.io/v1/alerts/stats -H "X-API-Key: $KEY"
The fields: status, due_at, overdue
# GET /v1/alerts/43989
"id": 43989, "status": "new", "score": 100, "screened_name": "SWIFT/BIC VTBRRUMM",
"four_eyes_required": true,
"due_at": "2026-10-25T16:04:12Z", "overdue": false, "created_at": "2026-10-24T16:04:12Z"
# GET /v1/alerts/stats
"by_status": { "new": 43540, "under_review": 4, "escalated": 9, "assigned": 1,
"closed_false_positive": 3, "closed_true_match": 8 },
"overdue": 42503, "within_sla": 1051, "no_deadline": 0
Captured from production on 2026-10-24 on Noble's own test account, which opens alerts all day and closes almost none; the overdue count is the proof that nothing released them. A closure needs a reason from a fixed vocabulary, and at score 90 and above a second registered analyst. Every action lands in the alert's append-only activity.
The address said Crimea. Nothing read the address.
Payoneer had reason to know the location of the users it subsequently identified as located in jurisdictions and regions subject to sanctions based on common indicators of location within its possession, including billing, shipping, or IP addresses, or copies of identification issued in jurisdictions and regions subject to sanctions; and
Enforcement Release, page 2, aggravating factor 2. The defect is clause (iv) on page 1: a "lack of focus on sanctioned locations, especially Crimea, because it was not monitoring IP addresses or flagging addresses in sanctioned locations". 2,201 of the 2,220 payments were for parties in sanctioned jurisdictions and regions, not for listed persons.
What failed
Nearly all of Payoneer's violations were about where a customer was, not who they were. The billing and shipping addresses were on file. A name screen cannot see them, and nothing else looked.
Noble's control
The free-text address, location.city and location.region are scanned for a word naming the Crimean peninsula or a town on it, in Latin or Cyrillic, and a hit raises the embargo advisory whatever the country field says. jurisdiction_nexus names the field and the word that decided; under a declared country other than Russia or Ukraine the nexus is reported as possible, with the contradicting field named, rather than as a definitive embargo. The CoinList, Poloniex and Uphold page runs the same control through three virtual-asset releases.
Run it: Russia in the country field, Simferopol in the address
curl -s -X POST https://api.noblesight.io/v1/screen -H "X-API-Key: $KEY" -H "Content-Type: application/json" -d '{"name":"Ivan Petrov","country":"RU","address":"ul. Lenina 12, Simferopol, Crimea"}'
The fields: jurisdiction_risk.jurisdiction, jurisdiction_nexus
"jurisdiction_risk": { "jurisdiction": "UA-43", ... },
"jurisdiction_nexus": { "source": "address", "evaluated": "Simferopol", "status": "embargoed" }
Captured from production on 2026-10-24. The advisory is informational: no score changes and nothing is blocked. The country field said Russia and was outranked by the address, which is the order Payoneer's filter needed.
country or location.country raises as an advisory; the word "Iran" in a free-text address is not parsed today, only the Crimean place names are. Noble does not process payments, hold funds, or decide what a flagged payment does next; it keeps the alert open and counts the hours.
OFAC's compliance note, read as a test plan
Within that framework, this enforcement action emphasizes the importance of effective screening not only for persons on the SDN List but also for sanctioned locations; ensuring that audits of OFAC compliance programs focus not only on persons on the SDN List but also on sanctioned locations; performing algorithm testing to be sure filters are flagging payments within expected parameters; screening for BIC codes, especially when OFAC includes them in SDN List entries; and holding flagged payments until they have been reviewed.
Enforcement Release, page 3, "Compliance Considerations".
Four clauses, four requests above. The algorithm test is a misspelling that still alerts; the BIC test is one identifier with no name; the hold test is an alert that is still open tomorrow; the location test is a Crimean street under a Russian country code. Every one of them is in the probes manifest that Noble's customer zero runs against production every night, and the coverage report tells you from your own records whether your integration sends identifiers and addresses at all.
Run the four against your own key
The requests on this page work on every tier, including free. Keys are invite-only during beta.