| Date | 30 Sep 2026 |
|---|---|
| Region | U.S. & Allies |
Treasury’s Office of Foreign Assets Control published SHA-256, SHA-384 and SHA-512 digests for human-readable sanctions PDFs, including the Specially Designated Nationals list dated Sept. 30, 2026.
The Treasury Department’s Office of Foreign Assets Control posted fresh hash values Wednesday for its human-readable sanctions list files, including the Specially Designated Nationals and Blocked Persons list carrying a publish date of Sept. 30, 2026.
The hashes are not a new sanctions program. They are checksums. OFAC puts them out so compliance teams, banks and developers can test whether a downloaded PDF still matches the file Treasury published.
“OFAC publishes hash values or message digests for its sanctions list files in order to provide a level of list content assurance,” the office says on the hash-values page. “These values are provided to give list file users the ability to confirm that OFAC files have not been altered since they were initially created and published.”
Most machine-readable list files no longer live on that page. OFAC says they now come out of its Sanctions List Service application, and the hashes travel with them.
“Important Notice: the majority of OFAC’s sanctions list data files are now being generated by its Sanctions List Service (SLS) application. The hash values or “file signatures” are now also being generated by SLS and are available next to each list file name on the SLS user interface. OFAC will continue to provide the hash values for files not yet generated by SLS on this page. This will include the human-readable versions of all OFAC sanctions lists.”
SLS is the download and search front end. Users can pull the SDN list, the consolidated non-SDN files, a custom dataset, or archived delta files. The hash page is the holdover for PDFs that SLS does not yet sign in the same interface.
The algorithms are fixed. “OFAC is using the SHA-256, SHA-384, and SHA-512 algorithms to provide the hash values listed below,” the office says. It points readers to Federal Information Processing Standards Publication 180-4 for the NIST specification.
Verification is on the user. “List users may compare the hash values with their associated files by utilizing publicly available tools to confirm that the files’ content remains unaltered since it was released,” OFAC says. “New hash values will be provided below whenever the SDN list or the Consolidated Non-SDN list are updated.”
One operational catch sits on the page. “Please note: the SHA-512 hash values listed below are wrapping due to the border constraints of this web page. Please make sure to select/import the complete string of SHA-512 characters when using this value.”
That warning matters in pipelines. A truncated SHA-512 string will fail a check even when the PDF is genuine.
For the SDN list dated Sept. 30, 2026, OFAC lists two PDFs. For sdnlist.pdf, the SHA-256 value is b5c4515871270d94ba70ec066640c9d1925ee9c1cff13271b74106a620a4f593. The SHA-384 value is 66a4d0b0101e78e7cdedb4898cfe66ef6794e5314db1b59d4dda1d136f4d21027c46e2870f3c5ace460df354e44d8191. The SHA-512 value is c7e15c8299a2fc3805e78cebe954d93636d9f807713077d02bd5173c5595133cd9c6aa4b7cb86afafb365a66d6011fb1eab795209141d3a1e5c84e60c1c086cd.
The change file is sdnnew26.pdf. Its SHA-256 value is ea667b4b86103889c2ef0b498bd5d2f3fb4515cf41afce291e3148fb7d41af1d. SHA-384 is 5d0111e89dc34666d765ee1924b0903c37a7dd545c94d2e964c3ba54799f23323ed0e2b108be94427518f19e5d7261d9. SHA-512 is ee5301985705645c0e6fff86f97ff948ccf36186e567d9c9ec8157135bdc65d4e76c9e8f67d0054187ea85a09f753f238ebb5a5ecf213e5d2cbd0cf52ab76345.
The same date appears on OFAC’s recent-actions log. The Sept. 30, 2026, entry is titled “Counter Terrorism and Transnational Criminal Organizations Designations; Belarus, Counter Narcotics, and Libya Designations Removals.” A linked Treasury release is headed “Treasury Sanctions Financial Network of Foreign Terrorist Organization, Tren de Aragua, After Theft of Millions from U.S. Banks.” The hash page does not itself describe those designations. It only republishes the file signatures after the SDN PDFs change.
Other human-readable lists remain on the hash page with older publish dates. The Sectoral Sanctions Identifications list is dated Sept. 14, 2026, for ssilist.pdf and ssinew26.pdf. The Non-SDN Menu-Based Sanctions list is dated July 17, 2026, for mbslist.pdf and mbsnew26.pdf. The Foreign Sanctions Evaders file fsenew25.pdf is dated Dec. 18, 2025. The Non-SDN Chinese Military-Industrial Complex Companies list is dated Dec. 16, 2021, for nscmiclist.pdf and nscmicnew21.pdf. The Non-SDN Palestinian Legislative Council list is posted with a publish date of July 27, 2027, for plclist.pdf and plcnew26.pdf. Full SHA-256, SHA-384 and SHA-512 strings for each of those files are on the same Treasury page.
For screening systems, the split is the story. CSV, XML and advanced-schema files belong in SLS, where OFAC says the file signatures sit beside each filename. The PDF editions still need an out-of-band check against the hash page. Miss one character on SHA-512 and the match fails. Use yesterday’s SDN digest on today’s sdnlist.pdf and it fails too.
OFAC does not tell users which open-source or commercial tool to run. It only says the comparison should show the file is unaltered since release. Executives who sign off on sanctions controls, and the engineers who wire the nightly pull, are the audience for that sentence.
The SDN list itself remains the primary blocked-persons file: individuals, entities, groups, vessels and aircraft designated by OFAC. Non-SDN lists stay separate. Some names can appear on both. The hash values do not interpret those entries. They only lock the bytes Treasury published on the stated dates.