OFAC deleted HTS from the SDN List on 24 August. A pipeline that only knows how to add is still blocking it

Two OFAC actions, on 24 August and 3 September 2026, removed names from the SDN List. Both arrived in documents that also added names, which is the normal shape of a list update and the reason the deletions get read last.

The 24 August document is worth reading whole, because it does two opposite things at once. The State Department revoked the Foreign Terrorist Organization designation of al-Nusrah Front and rescinded Syria's State Sponsor of Terrorism designation; the Treasury press release records, in the same breath, the designation of two former HTS-affiliated individuals, Sa'd Bin Sa'd Muhammad Shariyan al-Ka'bi and Jamal Husayn Zayniyah. Relief and designation shipped in one action. A pipeline that reads only the additions gets half of it.

Count what actually has to be deleted. One organisation coming off the list on 24 August meant six alias strings disappearing from the SDN data. One company coming off on 3 September meant four entries, the parent plus three transliterated representative-office variants, which is the kind of string a matcher indexes separately precisely so that it can catch them.

That arithmetic is the whole problem. Matching engines index aliases, transliterations and weak AKAs as their own searchable records, so a deletion applied to the primary name but not to every variant leaves orphans behind: records with nothing to point at, still returning hits. And an ingest that upserts rows from each new list file absorbs every addition and amendment correctly while never removing anything, because nothing in a full list file says "this row is gone". OFAC publishes delta files, archived by year on the Sanctions List Service, for exactly this reason. Reading them is a choice a vendor makes.

A missed designation is the failure everyone models. Over-blocking is the one that happens quietly and bills you anyway.

A stale match stops a payment, holds a shipment, suspends an onboarding or freezes an account for a counterparty no applicable sanction prohibits, and three costs follow, none of which appears in a screening report. The first is the counterparty's: a held payment or an unreleased consignment is a commercial loss for someone who did nothing wrong, and a refusal you may have to explain on the day, with a reason. The second is the review queue's, because every hit on a deleted entry consumes analyst time the real hits need, and a team that spends its week clearing false positives against last month's list is slower on the additions that matter. The third is the file's, and it is the worst of the three: a hit you cannot trace to a current primary source can neither be escalated with confidence nor cleared quickly, because nobody can say which version of the list produced it.

Syria makes the point commercially rather than theoretically. OFAC's own FAQs now say that Syrian financial institutions were removed from the list, that correspondent relationships may be established where no party is on the SDN List, and that food and medicine may be exported without specific OFAC authorisation, while the Department of Commerce retains its own export controls. Every one of those is trade that a stale list blocks.

Four places, in rough order of how often they turn out to be the culprit. The most common is your own copy: an internal denylist, a "known bad" table or a CRM flag populated by a past screening run that nobody re-runs. This is the usual source of a stale block, and it is not the vendor's fault. Next is upsert-only ingest, where the provider reads the full list and merges, and nothing ever issues a delete.

Then come mirrors and edge caches. A list file served from a CDN, or a results cache keyed on the name string, can keep answering with a version that no longer exists upstream; caching a no-match is cheap, and caching a match is how a delisted name keeps hitting for a week. Last, split paths: additions on a fast path, deletions batched into a slower reconciliation job. Both are "daily updates" in the marketing copy.

This takes ten minutes and produces a record you can file as a control.

1. Pick a name deleted on a date you can cite. Today: JABHAT AL-NUSRAH (24 August 2026) and DULAC CAPITAL LTD (3 September 2026).
2. Screen the alias string, not only the primary name. The point is to hit the alias index, which is where partial deletes survive.
3. Repeat with a spelling variant, HAYAT TAHRIR AL-SHAM against HAY'AT TAHRIR AL-SHAM. Apostrophes and spacing are exactly where an incomplete deletion hides.
4. Read the evidence record, not just the verdict. Which list version, with which publication date, did the screening run against? A result that names no list version fails this test whatever it returned, because you cannot trace it to a file.
5. Expect no OFAC SDN match. A hit on a deleted alias means the deletion has not propagated. Ask for the list version and the ingest timestamp.
6. Cross-check upstream. OFAC's Sanctions List Service archives delta files; the delta for the day in question is the authority on what was deleted.
7. File the test. Date, name screened, provider, list version returned, result, who ran it.

One caveat keeps the test honest: a removal by one authority binds no other. A no-match against the OFAC SDN List is not a no-match against UN, EU or UK lists, and this test measures propagation, not exposure.

Step 4 is the one we built for. Every ScreenVeritAI screening is stored as a snapshot that names the list version it ran against, so the result can be reproduced later instead of recalculated against whatever the list says today.

Releasing a counterparty you previously blocked is a decision, and it needs the same file the block did:

• The primary source for the removal: action URL, date, reference.
• The exact entry deleted, verbatim, with its programme tag ([SDGT], [RUSSIA-EO14024]).
• The list version your re-screen ran against, and its publication date.
• The date, time and operator of the re-screen.
• Whether other jurisdictions still list the party, checked separately.
• Any general licence issued or revoked alongside: GL 25 revoked on 24 August, GL 4A issued on 3 September.
• The approver and the basis for the release.
• The original blocking record, kept. The file has to explain both decisions, and deleting the first one makes the second one unexplainable.

This is a report of what the US Treasury and the State Department published on 24 August and 3 September 2026, and nothing else. It takes no position on the merits of any designation, removal or rescission.

Two operational limits follow from the primary sources rather than from opinion. A delisting changes a prohibition from its effective date forward; OFAC has stated that investigations and enforcement actions for apparent violations occurring before the relevant date may still be carried out. And a removal is not a risk rating: your own assessment, your adverse-media findings and your enhanced due diligence stand until you revisit them deliberately, with a date on the revisit.

The through-line is simple enough to put on a wall. A list is a set of changes, not a set of names, and a pipeline that only knows how to add is only half a pipeline.