--- title: What is Allow list source_page: https://www.sardine.ai/learn/allow-list canonical: https://www.sardine.ai/learn/allow-list format: text/markdown description: The same known-good John Smith generates daily sanctions alerts and queue backlog. Allow lists exempt disambiguated identities and eliminate the repeat work. --- **Quick links:** [Human page](https://www.sardine.ai/learn/allow-list) · [Home](https://www.sardine.ai) · [Customers](https://www.sardine.ai/customers) · [Blog](https://www.sardine.ai/blog) · [Demo](https://www.sardine.ai/demo) --- # What is Allow list **Read time:** 4 The same known-good John Smith generates daily sanctions alerts and queue backlog. Allow lists exempt disambiguated identities and eliminate the repeat work. An allow list is a maintained set of pre-approved parties, values, or already-cleared matches that screening exempts from blocking or repeat alerts. It is the counterpart to a deny list, and its job is to stop the same known-good customer from generating the same false positive over and over. What is an allow list? An allow list, sometimes called a whitelist, is a record of things screening has already decided are acceptable. When a name, account, or match is on it, the system suppresses the alert instead of routing it to an analyst again. The classic use is a real customer who keeps colliding with a common sanctioned name but has been fully investigated and cleared. Screening produces a lot of repeat false positives. The same "John Smith" or the same recurring counterparty triggers the same alert every day, and analysts clear it every day. An allow list captures the disposition so the work happens once, not endlessly. It is a noise-reduction tool, not a way to skip diligence. The critical distinction is that an allow list should exempt a specific, disambiguated identity, not a raw name. Allow-listing the string "John Smith" would wave through every John Smith, including a future sanctioned one. Allow-listing a particular customer with a verified date of birth and account is the safe version. Deny list vs allow list Who touches the allow list What it looks like in practice A long-standing corporate customer shares a name with a listed individual. Every batch rescreen fires the same alert, and analysts clear it each time after confirming the customer is a company with a different jurisdiction and registration number. An analyst proposes an allow-list entry scoped to that exact customer record, with the clearance rationale attached. An approver signs off, and the entry carries a six-month review date. The recurring alert stops, but the underlying name is still screened, so a genuinely new listed party under the same name would still surface. Why governance matters An allow list is powerful precisely because it turns alerts off, which is also what makes it dangerous. A sloppy or over-broad entry can silently suppress a real future hit on the same identifier. An entry added for convenience today could wave through a genuinely sanctioned party tomorrow, and because the alert never fires, no one notices. That is why every entry needs a documented reason, a named owner, a defined scope, and periodic review. Examiners treat the allow list as a control in its own right and test whether suppressed alerts were truly safe to suppress. Treated casually, it becomes the quietest gap in a screening program. What to watch in the data Scope creep. Entries that exempt a bare name rather than a specific verified identity are the top risk. Stale entries. Approvals with no review date, or overdue reviews, mean no one has re-confirmed the party is still safe. Missing justification. Any entry without a documented reason and owner should be treated as unsupported and pulled. Suppression volume. Track how many alerts each entry silences; a single entry killing large volumes deserves a closer look. List changes. When sanctions lists update, re-check allow-list entries against new designations for the same identifier. Quick questions ### Is an allow list the same as a whitelist? Yes, whitelist is the older term for the same concept. Many programs now say allow list. Both mean a governed set of pre-approved parties or cleared matches exempted from blocking or repeat alerting. ### Does allow-listing skip sanctions screening? No. A well-built allow list suppresses a specific, already-investigated match, not the screening itself. The name is still checked against the lists, so a new and different listed party under the same name can still trigger an alert. ### What is the biggest allow-list risk? An over-broad entry that exempts a raw name rather than a disambiguated identity. It can silently clear a future sanctioned party without ever generating an alert, which is why scope, ownership, and review are non-negotiable. ### How often should entries be reviewed? On a defined cycle set by policy, commonly every six to twelve months, plus an ad hoc re-check when the underlying lists change materially. Each review confirms the entry is still justified and correctly scoped. ### Who should be allowed to add an entry? Proposals usually come from analysts, but a separate approver should sign off before anything goes live, with a named owner recorded. Separating the propose and approve steps keeps a single person from quietly turning off a control. Go deeper OFAC, US Treasury ↗ — Administers US sanctions programs, the SDN list, and licensing. European Banking Authority ↗ — EU banking regulator. Strong Customer Authentication under PSD2 and AML guidance.