False Positive Risk in edx/sanctions Tool – No Secondary Identifier Checks

[Xavier-The-Explorer]

I’d like to report a serious flaw in the edx/sanctions screening tool that affects innocent users and disrupts access to educational content.

Suggested labels: bug, compliance, false-positive.

Issue Summary:

The current implementation appears to rely solely on name-based matching against the OFAC SDN list, without validating secondary identifiers such as date of birth, address, or government-issued ID. This creates a high risk of false positives, especially for those international users with common names.

Technical Concerns:

• The POST request payload to api/v1/sdn-check/ includes full_name, country, and optional city, but does not require date of birth, ID number, or address.
• The system returns a hit_count and creates a SanctionsCheckFailure record based on name-only matches.
• There is no documented override mechanism or manual review workflow for false positives.
• Fallback behavior using the Consolidated Screening List may be less precise, increasing risk during API outages.
• No mention of match sensitivity thresholds or fuzzy matching controls.

Real-World Impact:

• My edX account was disabled immediately after payment due to a false SDN match on September 01.
• I submitted passport, ID, and OFAC Sanctions List Search results showing I am not the sanctioned individual.
• OFAC confirmed that institutions (not OFAC) must resolve false positives and may contact their Compliance Hotline.
• Despite this, edX refused to review or escalate the case, citing lack of appeal options. My case has been unsolved for a month.

Why This Matters:

• The tool’s design leads to automated blocks without human review.
• Innocent learners lose access to paid courses and certificates.
• There is no built-in mechanism for institutions to verify identity beyond name matching.

Suggested Improvements:

• Integrate secondary identifier checks (date of birth, address, national ID number) before flagging users.
• Include a manual override or review workflow for suspected false positives.
• Provide clearer documentation for institutions on how to handle edge cases.
• Consider match sensitivity tuning to reduce false positives.

This issue affects not just me, but potentially many learners worldwide. I hope the maintainers can consider improving the tool to reduce harm and uphold educational access.

Thank you for your time and work on this project.