OFAC sanctions file integrity and hashing

What can a file digest establish?

A local digest identifies exact bytes. It does not by itself prove official origin, currentness or complete sanctions coverage.

OFAC provides several formats. An official format is not necessarily supported by every parser. Check the tool’s accepted schema before use.

Renaming an unsupported XML or PDF to CSV does not change its schema.

Worked example. A spreadsheet changes the bytes

Fictional example. An analyst records the SHA-256 digest of an official download, then opens and saves a copy in a spreadsheet application.

The saved bytes differ even though displayed rows look similar. Keep the original download as the source input.

Compare an official digest only for the exact filename, version and bytes. A digest published for an OFAC PDF cannot verify a CSV.

If no matching official digest exists, label the value as locally calculated. Do not describe it as official verification.

Use a supported official format

Record the exact OFAC file and schema. Related primary, address, alias and comment files may form one data series and should not be treated as interchangeable.

Verify and retain the digest

Calculate SHA-256 on the retrieved bytes and compare an official value where available. Keep the digest with the retrieval time and source URL.

Make the transformation reproducible

Record the parser version, accepted schema, rejection count, output digest and any manual intervention. Fail closed when the structure is not the supported one.

Working checklist and fictional samples

Use this checklist as an operating aid, not an exhaustive legal assessment. Inspect the samples before entering your own facts.

• Record the official URL, retrieval timestamp and original filename.
• Retain the raw-byte digest and matching published digest evidence, where available.
• Name the list family, schema and parser version.
• Preserve required companion files and their source versions.
• Record rejected rows, warnings, counts and output references.
• Identify the comparable previous input behind a change report.
• Obtain review before handing data to screening.

• Fictional US sanctions change report PDF. Inspect provenance and changes. The sample is not a current sanctions list.