Entity List Check: Beyond Name Matching

BIS added 29 entities to the Entity List on October 8, 2025, targeting companies in China, Turkey, and the UAE for supplying Iran with drone components and aviation parts (Federal Register, October 2025). Three of those entries were addresses only—no company names attached. Most screening tools missed them entirely. Hard to match a name when there isn't one.

Key Takeaways

• BIS added address-only entries to the Entity List in 2025, requiring geolocation screening independent of entity names (Federal Register, 2025)
• The September 2025 Affiliates Rule extends Entity List restrictions to unlisted subsidiaries with 50%+ ownership—implementation suspended until November 2026 (Federal Register, November 12, 2025)
• Chinese name transliteration generates 3,000+ spelling variations per name; standard fuzzy algorithms miss most of them (Sanctions.io, 2025)
• False positive rates reach 90-95% in high-volume screening environments using name-only approaches (Visual Compliance, 2025)

Why Name Matching Breaks Down

We've watched name matching catch roughly 60% of true matches against export control lists in our client implementations. The remaining 40% slip through transliteration gaps, alias structures, and naming conventions that string-distance algorithms simply cannot parse.

Take the Arabic name دیشرلا دبع. Transliterated into Latin script, this single name produces over 3,000 valid spellings: Abdal-Rashid, Ar-Rashid, Abd-errchide, Abd-errcheed, and thousands more (Sanctions.io, 2025). Levenshtein distance treats each spelling as a distinct entity. Jaro-Winkler scores them as partial matches, maybe. Neither algorithm grasps they're the same person.

Chinese names make this worse. The surname "Yang" renders as Y-A-N-G in Mandarin Pinyin or Y-O-N-G in certain Cantonese romanizations. Cantonese lacks a distinct "R" sound—the closest equivalent is "L"—so "Li" and "Lee" and "Ri" might all represent the same character depending on dialect and transcription system. The screening tool sees three different surnames. BIS sees one restricted party.

One logistics firm we spoke with reported reviewing 50,000 denied party screening alerts daily before implementing contextual matching (Visual Compliance, 2025). At that volume, false positive rates of 90-95% mean analysts spend their days investigating legitimate customers named "Global Holdings" because it resembles "Global Holdings Ltd." on the Entity List. Meanwhile, the actual restricted party—operating under a transliteration the algorithm missed—clears screening without anyone noticing.

What BIS Actually Expects

BIS published specific guidance on near-match scenarios. When an entity name or address approximates an Entity List entry, that's a "red flag" requiring investigation of additional factors: company address, corporate officers, business activities, contact information (BIS Entity List FAQs, 2025). Not supplementary guidance. The screening expectation.

Address-only listings appeared on the Entity List in early 2025. BIS added high-diversion-risk addresses without linking them to specific entity names—going after shell companies that cycle through corporate identities while operating from the same physical location. When an address carries a High Diversion Risk designation, license requirements apply to any party at that address regardless of entity name (BIS Address Screening FAQs, 2025).

The co-location scenario gets explicit treatment in BIS guidance. If a customer operates at the same address as a listed entity—different suite number, same building—that's a red flag requiring due diligence. The exporter must verify the customer isn't the listed entity and doesn't intend to transfer items to that entity. Name screening alone cannot answer either question.

Corporate officer overlap creates yet another dimension we've seen clients miss. Shell companies used for diversion frequently share directors with listed entities. A company might carry a completely different registered name and address while its beneficial owner sits on the Entity List. The name match returns zero hits. The ownership connection triggers the restriction.

The Affiliates Rule Changes the Game

September 29, 2025: BIS published the Affiliates Rule extending Entity List restrictions to entities 50% or more owned by listed parties—directly or indirectly, individually or in aggregate (Federal Register, September 30, 2025). November 10, 2025: BIS suspended implementation for one year. November 2026: the rule activates.

The suspension buys time. It doesn't eliminate the compliance requirement. And it certainly doesn't eliminate the expectation that companies use the intervening twelve months to build ownership verification into their screening programs.

Under the Affiliates Rule, the Consolidated Screening List stops being an exhaustive inventory of restricted parties. Unlisted subsidiaries won't appear on any downloadable list. A company 30% owned by an Entity List party and 20% owned by a Military End User List party triggers restrictions through aggregation—no name match required, no list entry published.

BIS introduced Red Flag 29 alongside the Affiliates Rule. When an exporter knows a foreign entity has listed owners but cannot determine exact ownership percentages, they must resolve the red flag or obtain a license before proceeding. Uncertainty about ownership structure isn't a defense. It's an obligation to investigate.

The practical impact hits hardest on companies trading with China and Russia. Opaque corporate registries, nominee shareholder structures, and layered holding companies make beneficial ownership determination genuinely difficult. The rule creates an affirmative duty to trace ownership—not merely run a name against a government database.

Building Multi-Dimensional Screening

Effective Entity List screening layers data points beyond the name field. Address verification, ownership tracing, and linguistic analysis each catch matches that name-only approaches miss.

Address screening should compare submitted shipping addresses against Entity List entries independent of company names. Several screening platforms now offer geolocation analysis flagging addresses within proximity of listed locations. The shared-office-building scenario—different company, same floor—gets caught before shipment.

Ownership data needs continuous maintenance. Subsidiaries get created between screening cycles. Corporate structures change through acquisition. Quarterly beneficial ownership review of existing counterparties catches entities that became restricted through investment rather than direct BIS designation. Annual reviews miss too much.

Fuzzy matching algorithms need linguistic customization by region. Phonetic matching for Chinese names must handle Pinyin romanization, tonal variations, and dialect-specific pronunciation differences. Arabic name matching must account for transliteration standards that vary by country of origin. Generic fuzzy thresholds produce either excessive false positives or dangerous false negatives. What works for European names fails on Middle Eastern ones.

Contextual enrichment from external sources—corporate registries, beneficial ownership databases, adverse media feeds—fills in the sparse data on government lists. A hit on a common entity name becomes actionable when corporate registry data confirms matching addresses or overlapping officers.

The Approaches That No Longer Work

Batch screening once daily against downloaded list files stopped being adequate when BIS started updating the Entity List multiple times monthly. Friday afternoon designations—23 in Q1 2025 alone—create weekend gaps when Monday shipments clear against Thursday's list (Treasury.gov designation archives).

The Consolidated Screening List alone doesn't cut it anymore. The Affiliates Rule's ownership-based restrictions won't appear on the CSL until specific entities receive individual designation. The entire category of 50%-owned subsidiaries falls outside list-based screening.

Tight fuzzy match thresholds reduce false positive volume, sure. They also miss true matches. We've seen it repeatedly—the false negative generates the enforcement action. The false positive that got cleared doesn't.

Running Entity List screening separately from OFAC sanctions screening wastes resources. The Affiliates Rule deliberately aligns with OFAC's 50% ownership standard. Companies maintaining parallel workflows have redundant systems that should share ownership data and investigation findings.

FAQ

What identifiers beyond names require screening against the Entity List?

BIS guidance specifies addresses, corporate officers, business activities, and contact information as factors requiring verification when near-matches occur. Address-only listings added in 2025 require standalone geolocation screening. Ownership structures require tracing to identify 50%-owned subsidiaries that may not appear on any published list.

How does the Affiliates Rule affect companies with Chinese trading partners?

Entities 50% or more owned by Entity List parties face the same restrictions as listed entities, regardless of appearing on any published list. Given the opacity of Chinese corporate ownership structures, compliance requires beneficial ownership verification for counterparties—not merely name screening. Implementation is suspended until November 2026.

What false positive rate should I expect from Entity List screening?

Industry benchmarks indicate 90-95% false positive rates for name-only screening in high-volume transaction environments. Adding address verification, ownership tracing, and contextual enrichment can reduce false positives by 20-60% while maintaining detection rates (Descartes, 2025).

The Affiliates Rule suspension gives companies twelve months to implement beneficial ownership verification before restrictions activate. That window closes November 2026. At Lenzo, we've built multi-dimensional screening—address verification, ownership analysis, transliteration-aware matching—specifically because name matching alone stopped being enough years ago. The selection criteria that matters when evaluating any screening platform: coverage of address-only designations and beneficial ownership data integration, not marginal improvements in fuzzy match thresholds for names already getting caught.