Does Shopify Screen Your Customers for Sanctions? Why Fraud Analysis Isn't Sanctions Compliance

Last reviewed: 8 October 2026. This describes publicly documented behavior of Shopify and payment providers as of the review date. It is not legal advice.

Quick answer

Shopify blocks a short list of countries and regions, and payment providers run sanctions checks for their own compliance. Neither of those is a sanctions screening program for your business. Shopify's order fraud analysis looks for signs of payment fraud, not for names on sanctions lists. If Shopify Payments approves an order, all you know is that the payment went through. You don't know that the buyer, the recipient or the destination is one you may lawfully deal with.

Under US and UK law, civil sanctions liability can arise without intent, so the gap between "the payment was approved" and "the sale was lawful" is yours to close.

What Shopify does

1. It blocks unsupported regions. Shopify's help center lists unsupported countries and regions: Cuba, Iran, North Korea, Syria, and the Crimea, so-called Donetsk and so-called Luhansk regions of Ukraine. Shopify says it prohibits accounts, storefront access, products originating from these places and orders shipping to them.

2. It analyzes orders for fraud. According to Shopify's fraud analysis documentation, the indicators include:

• Address Verification System (AVS) and card security code (CVV) results;
• whether the customer's location matches the payment method;
• unusual device or network activity;
• multiple card attempts.

Orders get a low, medium or high risk level with guidance such as "You can fulfill this order" or "Consider canceling this order." Shopify notes that some orders, including test orders, free orders, gift card purchases, POS orders, B2B orders and subscription renewals, don't receive a recommendation at all.

3. It holds its own accounts for sanctions reasons. Shopify's page on Shopify Payments account holds lists "sanctions based on business location" among the reasons it may place a hold on a merchant's account. That check is about you, the merchant, not your customers.

What Shopify fraud analysis doesn't do

None of the fraud indicators asks whether the person on the order appears on OFAC's SDN List, the EU Consolidated Financial Sanctions List, the UK Sanctions List or the UN Security Council Consolidated List. A designated person paying with their own valid card, from a matching location, on a normal device, would look like an ideal low-risk customer.

Question	Fraud analysis	Sanctions screening
Is this card being used by its owner?	Yes, this is its purpose	No
Will this order be charged back?	Estimates the risk	No
Is the buyer or recipient a listed person?	No	Yes, this is its purpose
Is the destination embargoed or restricted?	No (Shopify's region block is a separate, partial control)	Yes, with a country check
Does it leave a record of what was checked and decided?	Risk level only	Should record list version, match, decision and reviewer

What payment providers do, and why it's not your screening

Payment providers are regulated businesses with their own sanctions obligations, so they screen.

• Stripe lists as prohibited, on its restricted businesses page, persons in Cuba, Iran, North Korea, Syria and the Crimea, Donetsk and Luhansk regions, and persons on US, UK, EU or UN restricted-party lists, including OFAC sanctions and the US Commerce Department's Denied Persons and Entity Lists.
• PayPal and its Venmo service say they screen payment activity and flag payments that may violate OFAC sanctions. A flagged payment is paused "in review." PayPal itself settled with OFAC in March 2015 for $7,658,300 over 486 apparent violations, partly because its automated filter didn't correctly identify potential SDN matches.

Three reasons this doesn't cover you:

1. They screen their customer relationship, not your sale. A provider decides whether it can process the payment. It doesn't tell you it has cleared the shipping recipient, the company on the invoice, or the goods for export.
2. They don't tell you why. When a provider stops a payment for sanctions reasons, it usually doesn't share the match. You don't get a decision record you could show anyone. See Why was my payout frozen?
3. Not every order goes through them. Manual payments, bank transfers, cash on delivery, B2B payment terms and some alternative payment methods bypass card-network screening entirely.

Where the merchant's responsibility starts

Sanctions prohibitions apply to the person making the sale. US OFAC rules bind US persons; EU rules bind EU companies and business done in the EU; UK rules bind UK persons and conduct in the UK. Nothing in those regimes lets you hand the obligation to a platform or a processor.

Two points from enforcement history are worth knowing:

• In the BitPay settlement (February 2021, $507,375), OFAC faulted a payment processor for not using the location data, including IP addresses, that it already held about its merchants' buyers. OFAC expects data you already hold to be used.
• In the Amazon settlement (July 2020, $134,523), OFAC described screening that missed alternative spellings of sanctioned places and correctly spelled SDN names and addresses. A screen that exists is not enough; it has to work.

A practical split of responsibilities

Control	Who provides it
Blocking Cuba, Iran, North Korea, Syria, Crimea, DNR, LNR	Shopify (backstop) and your shipping-zone settings
Card fraud risk	Shopify fraud analysis and your payment provider
Provider's own sanctions compliance	Your payment provider, for its own purposes
Screening your buyers, recipients and companies against the lists that apply to you	You, usually with a screening tool
Russia, Belarus and export-control decisions about your products	You
A record of what you checked and decided	You

Closing the gap with MatchAudit

MatchAudit is a Shopify app that adds the sanctions layer Shopify's fraud analysis doesn't have. Install it from the Shopify App Store and it works alongside Shopify's own tools:

• Screens every party on the order: billing name, shipping name, customer and every company name, including Shopify B2B company and location names. It checks them against the sanctions and denied-party lists you select, with spelling-, word-order- and transliteration-tolerant matching.
• Checks billing and shipping countries separately for embargoed or restricted status, so a Sevastopol address entered as "Ukraine" is evaluated on its city and region detail, not just the dropdown.
• Holds fulfillment on open fulfillment orders when there's a possible match, a high-risk country, or a selected list that could not be checked. It never treats missing data as a clear result.
• Can feed Shopify's own order risk analysis if you switch that on in Settings: Pending while screening, Low when clear, High when a review is needed. Check any existing Flow that acts on order risk, for example one that cancels high-risk orders, before you turn it on.
• Works with manual capture. With Hold every new order until it is screened switched on and Shopify Flow's Capture payment action triggered by MatchAudit's Order screening cleared trigger, nothing is captured or shipped before the order is clear. MatchAudit holds fulfillment only; it never captures, voids or refunds a payment.
• Records the decision. The list versions, the exact matched entry, the algorithm version, the threshold, the country assessment and the reviewer, taken from the verified Shopify session, are stored as evidence.

Frequently asked questions

Does Shopify automatically screen orders against sanctions lists? Shopify publicly documents a region block for Cuba, Iran, North Korea, Syria, Crimea, DNR and LNR, and a fraud analysis based on payment and device signals. It doesn't document screening of your customers' names against sanctions lists for you.

If Shopify Payments approves an order, am I compliant? Not necessarily. Approval means the payment was processed. It doesn't establish that the buyer, recipient or destination is lawful for your business, or that your goods may be exported there.

Does Stripe or PayPal screen my customers? They screen for their own obligations and can block or pause payments. They don't give you a cleared-party decision or a record of it, and they don't see orders paid by other methods.

Can I rely on Shopify Flow to block risky orders? Flow can automate actions, but it needs a sanctions signal to act on. MatchAudit provides Flow triggers, Order flagged for sanctions review and Order screening cleared, so your workflows can respond to a real screening result.

Related reading

• Why was my payout frozen? PayPal, Stripe and Shopify Payments sanctions holds
• How to screen Shopify orders against sanctions lists and keep proof
• Best sanctions screening apps for Shopify (2026)

Official sources

• Shopify Help Center, Fraud analysis: help.shopify.com
• Shopify Help Center, Unsupported countries and regions: help.shopify.com
• Shopify Help Center, Shopify Payments account holds: help.shopify.com
• Stripe, Restricted and prohibited businesses: stripe.com
• PayPal Newsroom, Keeping the Venmo Community Secure: The Company's Approach to OFAC Compliance: newsroom.paypal-corp.com
• OFAC, Settlement with PayPal, Inc. (25 March 2015): ofac.treasury.gov
• OFAC, Settlement with BitPay, Inc. (18 February 2021): ofac.treasury.gov