A payment account can be restricted because a name resembles a name on a sanctions list. Not matches it — resembles it. This is one of the least intuitive reasons an account can be held, and it accounts for a meaningful share of the cases where a customer with no connection to anything untoward finds a payment stopped and no explanation forthcoming.
A Blackcat account blocked with no reason given, like the same outcome at any other EU-licensed provider, can have this among its possible causes. Screening is not something a provider opts into, and a name match is not something a customer can avoid by behaving differently.
The mechanism is worth understanding, because it is the one restriction cause where the customer has done nothing at all, and where knowing how the process works changes what you should send.
What providers are required to screen, and how often
EU sanctions are binding on payment providers directly. Where a person or entity is designated under a targeted financial restrictive measure, their assets must be frozen and no funds may be made available to them. There is no discretion in this and no risk-based softening; a designated party is a designated party.
The obligation attaches to the licence rather than to the size of the firm. It covers electronic money institutions on the same terms as banks, so it applies to Papaya Ltd, the Maltese issuer of Blackcat. (Papaya, Ltd. is licensed by the MFSA as an Electronic Money Institution, registration No. C55146.)
The frequency changed recently, and in a way most customers never heard about. Under Article 5d of the SEPA Regulation as amended by the Instant Payments Regulation, from 9 January 2025 payment providers across the EU must verify at least daily whether their own customers are subject to targeted financial restrictive measures, and must re-screen immediately whenever the EU designates a new party or amends an existing designation. The same provision prohibits providers from running transaction-by-transaction sanctions screening for in-scope euro credit transfers.
That reversal is the key to understanding the customer experience. The old model screened payments, which slowed them down and generated alerts at the moment of payment. The new model screens people continuously, which is what allows a euro transfer to settle within ten seconds.
The consequence is that when an alert does fire, it fires against you as a customer rather than against a single transaction, and the effect is account-level rather than payment-level. Because the alert is attached to the customer relationship, it can also affect access to a crypto card while the review is open.
Why a false match happens to ordinary people
Screening systems do not look for exact string equality. They cannot, because a system that only caught exact matches would be defeated by a single changed letter. So they use fuzzy matching across transliterations, name orders, common spelling variants and phonetic similarity, then apply a threshold.
The threshold is where the trade-off lives. Set it tight and designated parties slip through under a variant spelling. Set it loose and ordinary customers generate alerts. Providers set it loose, because the cost of missing a designated party is a regulatory breach and the cost of a false positive is an inconvenience to customers and some review work.
The categories of people most affected are predictable. Names transliterated from Cyrillic, Arabic, Persian or Chinese scripts, where multiple valid Latin spellings exist for the same name. Common surnames in regions with designated individuals.
Patronymic naming systems that a matching engine reads as a middle name. A shared date of birth alongside a partially matching name. None of these is a fault on the customer’s part, and none of them can be prevented in advance.
A concrete case of how this looks in practice. A software engineer in Berlin, a German citizen born in Kazakhstan, has a surname with three accepted Latin transliterations. One of those spellings is close to a name on the EU consolidated list. Every time the list is amended, her record is re-screened, and periodically it produces an alert that a human has to look at before her account resumes normal operation.
How a false match is cleared
Resolution is a discounting exercise. The reviewer is not trying to prove you are innocent; they are trying to establish that you are a different person from the designated party. That is done on identifiers rather than on assurances.
- Full name exactly as it appears on your identity document, including any middle names.
- Date and place of birth, which is usually the single most effective discriminator.
- Nationality and the number of the identity document relied on.
- Where relevant, evidence of residence over the period concerned.
What does not help is an explanation of why the match must be wrong. A statement that you have never been to a particular country cannot be verified and does not discount anything. A date of birth that differs from the designated party’s by eleven years can be checked against a document and closes the question.
A restriction arising from a sanctions alert is also the type least likely to come with a detailed explanation while it is open. Providers are generally reluctant to say which list produced an alert or what the matching criteria were, partly because that information would help someone deliberately evade screening. This reticence is frustrating and it is not evidence that something worse is going on.
Where the limits of the system sit
Two structural points are worth knowing. First, the daily screening obligation applies to EU designations. Providers operating internationally may also screen against other regimes, which can produce alerts with a different basis and a different resolution path.
Second, because in-scope euro credit transfers are no longer screened transaction by transaction, providers depend on each other. Your provider ensures you are not a designated party; the receiving provider does the same for the payee.
A payment can therefore still be stopped at the other end, by an institution you have no relationship with, for reasons your own provider cannot see or explain.
| Transaction screening | Customer screening | |
| What is checked | Each payment’s payer and payee | The provider’s own customer base |
| When | At the moment of payment | At least daily, plus on every list change |
| Effect of an alert | That payment is held | The account relationship is reviewed |
| Status for in-scope euro transfers | Prohibited | Required |
Two models of sanctions screening for Euro credit transfers, before and after Article 5d of the amended SEPA Regulation.
Source: Regulation (EU) 2024/886 amending Regulation (EU) No 260/2012; obligations applying from 9 January 2025.
Frequently asked questions
Why would my account be blocked over a sanctions list if I have done nothing?
Screening systems use fuzzy name matching rather than exact matching, so a name resembling a designated party’s name can generate an alert. Resolution turns on identifiers such as date and place of birth that distinguish you from that party.
How often are payment customers screened against sanctions lists?
Since 9 January 2025, EU payment providers must verify at least daily whether their customers are subject to targeted financial restrictive measures, and must re-screen immediately after any new or amended designation.
Why will my provider not tell me which list flagged me?
Providers generally limit what they disclose about screening criteria, in part because detailed information would assist deliberate evasion. The absence of an explanation is not in itself an indication of a more serious problem.
This article describes sanctions screening obligations applying to payment service providers in the European Union and the false-positive matches those systems can produce. It is general information and not legal advice. Sanctions law is complex, changes frequently, and its application to an individual case depends on facts that this article cannot address. Anyone whose account has been restricted in connection with a sanctions alert should follow their provider’s stated process and consider independent legal advice where the matter is not resolved.
