MatchAudit

Last reviewed: 8 October 2026. This guide explains the rules in general terms. It is not legal advice; for a specific transaction, speak to a sanctions lawyer.

Quick answer

If your store sells to customers outside your own country, or you are a US, EU or UK business, sanctions law applies to your sales whether or not anyone tells you so. Neither OFAC (US), the EU nor the UK has a "small seller" exemption. The prohibitions are written around who you deal with and where the goods go, not around the size of your business.

No statute says "every web shop must run screening software." What the law does say is that you must not sell to, ship to, or receive money from listed persons and entities, and that you must not supply certain goods to certain places. In the US and the UK, civil penalties can follow even when you did not know. In practice, the only way to know is to check the names and destinations on your orders. That checking is sanctions screening.

The rest of this guide covers who the rules reach, what Shopify does and doesn't do for you, and how to set up a proportionate check without slowing every order down.

Who sanctions rules apply to

Sanctions programs reach businesses through their nationality, their location, and the transaction itself.

United States. OFAC's regulations bind "US persons": US citizens and permanent residents wherever they are, entities organized under US law, and anyone physically in the US. Non-US businesses can be exposed too, for example when a transaction causes a US person (such as a US bank or payment processor) to violate sanctions.
European Union. EU sanctions apply within EU territory, to EU nationals anywhere, to companies incorporated in a member state, and to any business done wholly or partly in the EU. Article 13 of the main Russia regulation, Council Regulation (EU) No 833/2014, is an example of this jurisdiction clause.
United Kingdom. UK financial sanctions apply to conduct in the UK and to UK nationals and UK-incorporated companies anywhere in the world.
United Nations. The UN Security Council designates persons and entities on its Consolidated List. Member states then implement those designations in their own law, which is why UN listings also appear in EU, UK and many national lists.

A German store selling to a buyer in Kazakhstan is therefore covered by EU rules. A US store selling to a buyer in Germany is covered by US rules. A UK store taking payment through a US processor can be exposed to both regimes.

What "sanctions" actually prohibit for an online store

Two different kinds of rule matter to a merchant, and they are easy to confuse.

Rule type	What it targets	Typical online-store risk
List-based (targeted) sanctions	Named people, companies, vessels and organizations, plus, under the US, EU and UK ownership rules, entities they own or control	Selling to, shipping to, or taking payment from someone on a list such as OFAC's SDN List, the EU Consolidated Financial Sanctions List or the UK Sanctions List
Country and sector sanctions	Whole jurisdictions or regions, or categories of goods to a country	Shipping to an embargoed region (for example Crimea) or exporting restricted goods (for example certain luxury goods or electronics to Russia)

A list match concerns the person. A country restriction concerns the destination and the product. A store needs a way to check both. A buyer can be on a list and live in an unremarkable country. A buyer can also be on no list at all but ask you to ship restricted goods to a restricted place.

Doesn't Shopify already handle this?

Partly, and only at the edges. Shopify publishes a list of unsupported countries and regions: Cuba, Iran, North Korea, Syria, and the Crimea, so-called Donetsk People's Republic and so-called Luhansk People's Republic regions of Ukraine. Shopify says it prohibits account creation from those places, storefront and account access from them, products originating from them, and orders shipping to them.

That is a geographic block. It doesn't check whether the person on an order appears on a sanctions list. It doesn't cover Russia or Belarus, which are subject to extensive EU, UK and US restrictions but are not on Shopify's unsupported list. And it doesn't produce a record you can show anyone afterwards.

Shopify's fraud analysis is a different tool with a different purpose. According to Shopify's help center, it looks at fraud indicators such as AVS and CVV results, whether the customer's location matches the payment method, unusual device or network activity, and repeated card attempts. A "low risk" fraud score means the payment looks genuine. It doesn't mean the buyer is not sanctioned. We cover this in detail in Does Shopify screen your customers for sanctions?

Why "I didn't know" is a weak defense

Both the US and the UK impose civil penalties on a strict liability basis:

OFAC can bring a civil penalty even without intent. Under the International Emergency Economic Powers Act (IEEPA), the maximum civil penalty is currently the greater of $377,700 per violation or twice the transaction value, as restated in OFAC's new Sanctions Penalties Regulations (31 CFR Part 505, effective 25 September 2026). Since April 2024 the statute of limitations is 10 years, and since March 2025 OFAC requires transaction records to be kept for 10 years.
The UK's OFSI has been able to impose civil monetary penalties on a strict liability basis since 15 June 2022. The maximum is the greater of £1 million or 50% of the value of the breach. The UK's trade sanctions enforcer, OTSI, has had similar strict-liability civil powers for trade sanctions breaches since 10 October 2024.
The EU leaves penalties to member states. Directive (EU) 2024/1226 requires every member state to criminalize sanctions violations, including some committed with serious negligence. For companies, the maximum fine must be at least 5% of worldwide turnover or €40 million, depending on the offense. The transposition deadline was 20 May 2025.

Penalty size depends heavily on the facts. OFAC's published enforcement guidelines weigh whether the conduct was egregious, whether you self-disclosed, and whether you had a compliance program. That last factor is the one a small merchant controls.

The cases also show that online sellers are not ignored. In July 2020, Amazon paid OFAC $134,523 to settle apparent violations that included orders from Crimea, Iran and Syria. OFAC said Amazon's automated screening failed to catch alternative spellings of sanctioned places and, in several hundred instances, correctly spelled names and addresses on the SDN List. In February 2021, the payment processor BitPay paid $507,375 because it held its merchants' buyers' IP addresses and location data but did not use them to stop buyers in sanctioned jurisdictions.

What a proportionate program looks like for a Shopify store

OFAC's Framework for OFAC Compliance Commitments (May 2019) is not a regulation, but it describes what OFAC looks for when it evaluates a company after something goes wrong. It names five components: management commitment, risk assessment, internal controls, testing and auditing, and training. It is explicitly risk-based. A small store doesn't need a bank's compliance department; it needs a program that fits its actual risk.

For most international Shopify merchants, that means:

Know your exposure. Which countries do you ship to? Which payment providers do you use? Do you sell anything that is export-controlled, such as drones, optics, radios or certain electronics? (See Selling electronics, drones or optics internationally?.)
Screen the parties on every order against the lists that apply to you: OFAC for US businesses or US-dollar flows, the EU list for EU businesses, the UK Sanctions List for UK businesses, and the UN list, which most regimes implement. Screen the billing name, the shipping name, the customer account and any company name.
Check the destination. Block or hold orders to embargoed regions, and pay particular attention to Russia, Belarus and known transshipment routes. (See Freight forwarders and reshipping red flags.)
Stop fulfillment while a possible match is open. A possible match is not a confirmed match, but goods that have shipped can't be un-shipped.
Have a named person decide and write down why.
Keep the evidence. Record what was screened, against which list version, what was found and who decided what. Remember OFAC's 10-year recordkeeping rule.
Re-screen. Lists change constantly. A customer who was clear in March can be designated in June.

Where MatchAudit fits

MatchAudit is a Shopify app built for exactly this list. It is listed on the Shopify App Store and runs inside your Shopify admin:

Automatic screening from Shopify events. New orders are screened from Shopify's order-created webhook. MatchAudit screens the billing name, the shipping name, the customer and every company name on the order, including Shopify B2B company and location names. Customers are also screened when they are created or updated.
The lists you choose. In Settings you pick sources per store, including OFAC SDN and Consolidated, the EU Consolidated Financial Sanctions List, the UN Security Council Consolidated List, the UK Sanctions List, Switzerland's SECO list and the US Consolidated Screening List, plus optional national lists.
Country risk for billing and shipping countries, with your own stricter country rules on top.
A fulfillment hold and a human decision. A possible match, a high-risk country or a list that could not be checked places a hold on open fulfillment orders. A staff member reviews the case in Shopify admin and chooses to allow it or keep it blocked. MatchAudit never cancels, refunds or edits the order itself.
Evidence you can export. Each decision records the list version, the exact matched entry, the matching algorithm version, the threshold, the country assessment, the time and the reviewer taken from the verified Shopify session. Paid plans export PDF and JSONL evidence.

The Free plan includes 20 screenings a month, and paid plans start at $23 a month. A free one-time check of your recent order history is also included, so you can find out whether anything already shipped deserves a second look.

Try it on your own orders. Install MatchAudit from the Shopify App Store and run the free check of your past orders. Shopify makes the most recent 60 days available by default. You'll see what a screening and an evidence record look like before you change anything about how you fulfill.

A short checklist before your next international order

I know which sanctions regimes apply to my business (US, EU, UK, others).
My store doesn't ship to embargoed regions, and Russia and Belarus orders get a deliberate check.
Every order's billing, shipping, customer and company names are screened against current lists.
A possible match holds fulfillment until a named person decides.
Each decision is recorded with the list version and the reason.
Records are retained long enough. For US exposure, that means 10 years.
Existing customers are re-screened when lists change.

Frequently asked questions

Is sanctions screening legally required for a small online shop? The law prohibits dealing with sanctioned parties and destinations. It doesn't usually prescribe a specific screening method. Because US and UK civil penalties apply on a strict liability basis, screening is the practical way to meet the prohibition and to show you took reasonable care.

My store is outside the US. Does OFAC matter to me? It can. OFAC rules bind US persons, and transactions that pass through US banks, US processors or US dollars can create exposure. Your own country's regime (EU, UK, Swiss, Canadian, Australian or another) applies in any case.

Isn't checking the shipping country enough? No. Country blocks don't detect a listed person living in a non-sanctioned country, and they don't cover Russia-related restrictions, which depend on the goods and the parties.

What should I tell a customer whose order is on hold? Keep it neutral, for example "your order is being reviewed." Telling the person concerned that you suspect a sanctions match can amount to tipping off in some jurisdictions.

Official sources

Shopify Help Center, Unsupported countries and regions: help.shopify.com
Shopify Help Center, Fraud analysis: help.shopify.com
OFAC, Sanctions Penalties Regulations, 31 CFR Part 505 (Federal Register, 25 September 2026): federalregister.gov
OFAC, Economic Sanctions Enforcement Guidelines, Appendix A to 31 CFR Part 501: ecfr.gov
OFAC, A Framework for OFAC Compliance Commitments: ofac.treasury.gov
OFAC, Settlement with Amazon.com, Inc. (8 July 2020): ofac.treasury.gov
OFAC, Settlement with BitPay, Inc. (18 February 2021): ofac.treasury.gov
Directive (EU) 2024/1226 on criminal offences and penalties for the violation of Union restrictive measures: eur-lex.europa.eu
UK OFSI, Enforcement of financial sanctions: gov.uk

Do Shopify Stores Need Sanctions Screening? What Every Merchant Shipping Internationally Should Know