Fuzzy Matching

Definition

Fuzzy matching is a method of comparing two strings, usually names, that returns a measure of how similar they are rather than a simple yes or no. In screening, it lets a system flag a customer as a possible match to a listed person even when the two names are not written identically.

Names vary for many ordinary reasons. They are transliterated from other scripts in more than one way, recorded with or without middle names, written in different orders, abbreviated, misspelt at data entry, or shortened to a nickname. An exact comparison treats every one of those differences as a non-match. A fuzzy comparison treats them as degrees of difference.

Common techniques include edit distance (counting the insertions, deletions and substitutions needed to turn one string into another), phonetic encoding (grouping names that sound alike), token-based comparison (matching words regardless of order), and rules for known name variants. Most screening tools combine several and produce a score that is compared against a threshold.

Why a regulated firm cares

A screening control that only finds exact matches is easy to defeat and easy to miss by accident. A single character difference, a dropped particle or a different romanisation can let a listed person pass unnoticed. That is a compliance failure whether or not the variation was deliberate.

Fuzzy matching closes that gap but introduces a trade-off. The looser the matching, the more genuine matches it catches, and the more unrelated people it flags. Too tight and it misses variants; too loose and analysts drown in alerts, which creates its own risk as reviews become rushed. Choosing and justifying the threshold is a risk decision, not just a technical setting.

How it is evidenced in practice

Because no rule prescribes a particular algorithm, firms show that their fuzzy matching works rather than just asserting it. Typical evidence includes:

• A documented methodology. Which fields are matched, which techniques are used, what threshold applies, and why that threshold fits the firm's risk assessment.
• Test sets. Lists of known name variations (transliterations, reordered names, typos, titles, missing tokens) run through the system to show which are caught and which are not.
• Tuning records. When thresholds or rules change, a record of what changed, why, and what effect it had on alert volumes and missed-match tests.
• Use of secondary identifiers. Dates of birth, nationality and addresses used to discount weak matches, so a low threshold stays workable without silently dropping alerts.
• Independent validation. Periodic review of the screening configuration by someone other than the team that set it up.

Regulatory basis

No major regulator mandates fuzzy matching as a specific technique. The obligation is indirect: firms must screen effectively, and effective screening has to cope with the way names vary.

Under OFAC's regulations in 31 CFR Chapter V, US persons must not deal with blocked persons, and civil liability is generally strict. OFAC's 2019 "A Framework for OFAC Compliance Commitments" expects internal controls, including screening, to be calibrated to the firm's risk profile, and it identifies faults in screening software or filters as a recurring root cause of violations. FATF Recommendations 6 and 7 require targeted financial sanctions to be implemented without delay, which depends on reliably identifying designated persons. In the UK, regulations made under the Sanctions and Anti-Money Laundering Act 2018 set out the asset freeze prohibitions that screening supports. Supervisors and industry guidance commonly expect screening to account for spelling variations, aliases and transliteration.

This is not legal advice. Firms should confirm local expectations for screening effectiveness in their jurisdiction.

Worked example

A hypothetical remittance firm screens a new sender named "Yusuf Abdulrahman Karimov". A fictional sanctions list includes "Yousef Abdul Rahman Kerimov".

An exact comparison finds nothing. The given name is spelt differently, the middle name is split into two words, and one vowel in the surname differs. A fuzzy comparison scores the pair highly: the phonetic codes of the given names agree, the tokens "Abdul" and "Rahman" join to match "Abdulrahman", and the surnames are one substitution apart.

The alert goes to an analyst. The listed person's date of birth differs from the customer's by more than twenty years and the nationalities do not agree. The analyst closes the alert as a false positive, recording the identifiers used. The firm also adds this pattern (split compound names) to its test set so future configuration changes are checked against it.

Related terms

• Watchlist
• False Positive
• Entity Resolution
• OFAC (Office of Foreign Assets Control)
• Sanctions Evasion
• Risk-Based Approach (RBA)