Shipped a Shopify Order to a Possible Sanctioned Party? What to Do First
A screening hit on an order that already shipped: confirm the match, stop further supply, preserve records, don't refund on autopilot, and get advice.
4 min read
You run a list update or a history scan, and an order that already shipped comes back as a possible sanctions match. The order is gone, but most of what matters now is still in your control: what you check, what you stop, what you keep and who you ask. This guide covers the first steps. It isn't legal advice. If the match looks real, speak to a sanctions lawyer before you contact authorities or the customer.
Step 1: Find out whether it is really a match
Most possible matches are a different person or company with a similar name. Before anything else, compare the order with the list entry:
- full name, aliases and spelling;
- date of birth, nationality or registration details, where the entry has them;
- addresses and countries;
- the date the entry was added to the list, compared with the order date.
Write down what matched, what didn't and who checked. If the facts show a different party, record the false positive and close the case. The false positives guide shows how to document it.
If the match holds up, or you can't rule it out, carry on with the steps below.
Step 2: Stop anything still open
- Hold open orders and fulfillments from the same customer, recipient or company.
- Pause repeat orders, subscriptions, store credit and account access you control.
- Don't let staff release holds while the case is open.
In MatchAudit, a reviewer who confirms the match marks the party restricted in the Directory. Future orders involving that party are then held for review, even if a later list comparison comes back clear.
Step 3: Don't refund on autopilot
A refund feels like the clean fix. It may not be. If the customer is a listed person, the money you hold may be property that has to be frozen or blocked:
- In the US, property of a blocked person has to be blocked, and a report filed with OFAC within 10 business days under 31 CFR 501.603.
- In the EU, people and companies must give information on frozen funds to the national competent authority under Article 8 of Regulation (EU) No 269/2014 for the Russia-related regime, and other EU regimes carry similar duties.
