How to check Xero contacts against sanctions lists

A Xero sanctions check has four parts. Export your contacts from Xero. Search each name on the UK Sanctions List. Write down what you searched and what came back. Act on anything that looks like a real match.

Which lists a UK Xero user checks

The UK Sanctions List

The Foreign, Commonwealth & Development Office (FCDO) publishes the UK Sanctions List. It covers people, entities and ships designated or specified under regulations made under the Sanctions and Anti-Money Laundering Act 2018. For background on how lists like this work, see what is a sanctions list.

The FCDO page says:

You may have used the OFSI Consolidated List of Asset Freeze Targets in the past. It closed on Wednesday 28 January 2026 and is no longer updated. If an old checklist points to it, update the link.

What OFSI does

The Office of Financial Sanctions Implementation (OFSI) is part of HM Treasury. OFSI's general guidance describes HM Treasury as the authority for the implementation of financial sanctions in the UK. OFSI investigates and enforces civil breaches of financial sanctions, and it is the body you report to.

UK financial sanctions apply to everyone within the UK and its territorial sea. They also apply to all UK persons wherever they are in the world. UK nationals and legal entities established under UK law, including their branches, must comply.

When US OFAC lists matter

The US Office of Foreign Assets Control (OFAC) runs its own lists, including the Specially Designated Nationals and Blocked Persons list (the SDN list). OFAC's FAQs say that all US persons must comply with OFAC sanctions. That includes US citizens and permanent residents, anyone within the United States, and US-incorporated entities and their foreign branches. Under certain programmes, foreign subsidiaries owned or controlled by US persons must comply too.

A UK company with no US persons involved is not a US person. OFAC's FAQs still say that non-US persons are prohibited from causing or conspiring to cause US persons to violate US sanctions. They also prohibit conduct that evades US sanctions.

In practice, check OFAC as well if you have a US parent or US staff, or if your payments or deals involve US persons. OFAC's regulations define "US person" programme by programme.

Export your contacts from Xero

Xero lets you export all contacts, or one contact group, to a CSV file. These steps follow the Xero Central article "Export contacts from Xero".

1. Open the Contacts menu.
2. Select the group of contacts you want to export. For example, select Customers to export the contacts you have raised sales invoices and sales credit notes for. Pick the view that shows all contacts if you want everyone in one file.
3. At the top right of the screen, click the menu icon, then select Export.
4. The contacts download to your computer as a CSV file.

Xero Central says the exported file holds the same information as the template used to import contacts into Xero. For screening, the columns you care about are the contact name, the names of any additional people on the contact, and the address.

One gap to know about: Xero does not export the employees group. If you click Export while viewing that group, you get every contact except employees.

Before you start searching, tidy the file in a spreadsheet:

• Keep the contact name, the additional people's first and last names, and the address and country.
• Add three columns of your own: date checked, result, and checked by.

Check suppliers and customers. You can be on either side of a prohibited payment.

Search the UK Sanctions List by hand

Use the FCDO search service

The FCDO runs a free search at search-uk-sanctions-list.service.gov.uk. You can enter names, addresses or other identifiers.

For each row in your spreadsheet:

1. Enter the contact name and run the search.
2. Turn on Fuzzy Search and run it again. The service says fuzzy search includes similar words of a similar length, which helps when you are unsure of a spelling or the name has been transliterated.
3. Repeat for each additional person named on the contact.
4. If you get results, compare them with what you know about the contact: full name, date of birth for individuals, address, country, and company registration details.
5. Fill in your date, result and checked-by columns before moving to the next row.

The search page states that relying on its results "does not limit any criminal or civil liability or reduce the obligation to undertake due diligence". It also says prohibitions apply to unlisted entities owned or controlled by a designated person. A clean search on a company name does not tell you who owns it.

If you have hundreds of contacts, the FCDO also publishes the whole list as a download from the UK Sanctions List page on GOV.UK. Formats include CSV, ODS, XML, HTML, plain text and PDF. You can load the CSV next to your Xero export. Exact-match formulas will miss spelling variants and aliases, so use the search service for anything close.

Check OFAC if US exposure applies

OFAC runs its own free tool, Sanctions List Search. It covers the SDN list and OFAC's other lists, with a dropdown to choose all lists, SDN only or non-SDN only. A Minimum Name Score slider sets how loose the fuzzy matching is. OFAC does not recommend a particular setting. The QuickBooks vendor screening guide walks through the OFAC search settings step by step.

OFAC gives two warnings on the page. Pay close attention to the programme codes on each returned record. Using the search does not replace appropriate due diligence.

Record the check

Save the spreadsheet with the date in its name. For each contact you want to be able to show:

• the name and other details you searched
• the list or tool you used
• the date of the search
• the result, including any near matches and why you ruled them out
• who did the check

The reason to keep this goes back to how OFSI enforces. The Economic Crime (Transparency and Enforcement) Act 2022 removed the requirement for OFSI to show that a person knew, or had reasonable cause to suspect, they were breaching sanctions. For breaches on or after 15 June 2022, OFSI can impose a civil monetary penalty without that proof. Knowledge is now one factor in the case.

Where the value of the funds can be estimated, the maximum penalty is the greater of £1 million or 50% of the estimated value. Where it cannot, the maximum is £1 million.

OFSI's enforcement guidance says it assesses the sanctions risk controls, systems and processes a person or business had in place. It treats appropriate due diligence on ownership and control as a mitigating factor where the conclusion was reasonable and made in good faith. Failing to do appropriate due diligence can count against you. A dated record of each check is how you show what you did.

Reporting obligations and what to do with a match

Relevant firms must report

Some businesses are "relevant firms". OFSI's general guidance says relevant firms must inform OFSI as soon as practicable if they know or reasonably suspect a person is a designated person. The list of relevant firms includes:

• statutory auditors and local auditors, whether a firm or a sole practitioner
• firms and sole practitioners that provide accountancy services by way of business
• firms and sole practitioners that provide legal or notarial services, advice about tax affairs, or certain trust or company services
• firms with permission under Part 4A of the Financial Services and Markets Act 2000
• estate agents, letting agents and casino operators, among others

If you are a bookkeeper or accountant providing services by way of business, read section 5.1.2 of the general guidance and check whether you are in scope. Sanctions compliance for accountants covers this in more detail. A relevant firm's report must include the information the suspicion is based on and details that identify the person. If the person is a customer, it must also give the nature and amount of any funds or economic resources held for them. OFSI takes reports through online forms on its "Reporting information to OFSI" page, including a "Report a suspected designated person" form.

Everyone else can report voluntarily

If you are not a relevant firm, you can still make a confidential report to OFSI about a suspected breach. OFSI accepts these where there is no statutory or professional obligation to report.

If you find a likely match

A name match alone is not proof. OFSI's general guidance says a name match "does not necessarily mean" the person you deal with is the one on the list. If the contact matches all the information on the list, that is likely to be a target match.

If you know or have reasonable cause to suspect you hold or deal with a designated person's funds or economic resources, the general guidance says you must:

1. Freeze them.
2. Not deal with them, or make them available to or for the benefit of the designated person.
3. Report them to OFSI.

If you are unsure whether it is a target match, OFSI says you can contact it for help. For a potential target match, OFSI says to contact it immediately.

Keep the check current

A check is only good for the day you ran it. The FCDO updates the UK Sanctions List whenever designations change, and the GOV.UK page keeps a dated log of those changes. OFSI's general guidance says the FCDO aims to update the list within one working day for new UN and UK listings.

Rescreen in three situations:

• When you add a contact. Search the name before you raise the first invoice or pay the first bill.
• When the list changes. Sign up to the UK sanctions email alerts linked from the UK Sanctions List page. When an alert arrives, rerun your search for the names it affects, or rescreen the full contact list.
• On a fixed cycle. Pick a cadence you can keep, such as monthly, and export a fresh contact file from Xero each time so new contacts are included.

Keep each dated record. Old ones show what the list said on the day you paid.

Doing this by hand works for a short contact list. It gets slow once you have hundreds of contacts and a list that keeps changing. Sanctions Clear, opening to Xero and QuickBooks Online users at the same time, will screen every active Xero contact against the UK Sanctions List and seven other sources, add each result to the contact's History and notes, and keep a dated record of every check.