Skip to content
ParamergeParamerge
Stephen Lieberman
Through Paramerge
Contact

PAN Lab example

TransUnion OFAC Name Screen

Two fields, and the file that held the rest

TransUnion sold a credit report add-on that checked only a consumer's name against a Treasury sanctions list. An appeals court described thousands of false matches.

See more

The OFAC Name Screen was an add-on to TransUnion's credit reports, run on software from another company, Accuity. It compared a consumer's first and last name with a Treasury sanctions list, and put an alert on the report's front page when they matched. Until 2013 it compared names alone.

How the name check worked

The OFAC Name Screen was an add-on that TransUnion sold with its credit reports from 2002. It also went by OFAC Advisor and, in TransUnion's filings with the Securities and Exchange Commission, the OFAC Alert service.

For each report ordered with the add-on, TransUnion sent the consumer's first and last name to another company, Accuity, Inc., which held the software and data. Accuity's software compared that name with the names on a Treasury sanctions list. If they matched, the report's front page carried an alert.

It was a name comparison, not a score. Until 2013 it used the first and last name alone.

Who was involved

TransUnion is one of three nationwide consumer reporting agencies, the companies that compile and sell credit reports.

OFAC is the Treasury Department's Office of Foreign Assets Control. It publishes the Specially Designated Nationals and Blocked Persons list, the list of people barred from transacting business in the United States.

Banks, landlords, and car dealerships bought credit reports with the add-on attached. If the names matched, the front page of the report carried an alert in its special messages section.

What the check compared, and what it left out

Most of what follows comes from court records. The Third Circuit and the Ninth Circuit are federal appeals courts. The district court is the federal trial court that heard Sergio Ramirez's lawsuit.

Before November 2010, the software flagged names that were "either identical or similar," in the Ninth Circuit's words. Its example is that "Cortez" would match "Cortes." From November 2010, the first and last names had to match exactly.

Until 2013, the check used the first and last name alone. It used no date of birth, middle initial, Social Security number, citizenship, or address.

TransUnion held the consumer's date of birth and Social Security number in its own database. The Third Circuit recorded that a business had to give at least a name and an address to pull a file from that database.

The matched OFAC records that TransUnion reprinted in its 2011 letters to consumers carried the listed persons' names, dates of birth, and passport information. The Third Circuit recorded that TransUnion did not check a match from Accuity against anything in its own files or anything the business had supplied.

The Ninth Circuit noted one more contrast. For tax liens and bankruptcy judgments, TransUnion used at least one identifier besides the name. OFAC information was the only report data it collected using the name alone.

The Ninth Circuit summed up more than a decade of name-only searches as "thousands of false positives and not a single known actual match identified." A false positive is an alert on someone who is not the listed person. The Ninth Circuit also found that TransUnion could not confirm that a single alert it sold was accurate.

In the district court, three TransUnion witnesses testified that there was no evidence any consumer with an alert was actually on the list. That describes what the case record shows. It does not prove that the product never flagged a listed person.

What TransUnion believed about the law

The Fair Credit Reporting Act is the federal law that governs credit reports. It requires reporting agencies to follow reasonable procedures for the maximum possible accuracy. TransUnion launched the add-on believing the Act did not cover it, because Accuity, not TransUnion, stored the OFAC data.

On that basis, the Ninth Circuit found, TransUnion "did not follow its normal procedures to ensure accuracy." It also adopted a policy of not disclosing OFAC matches to consumers who asked for their own reports.

Who could see the alert

From 2002 until July 2011, the consumer's own copy of the report left the alert out. TransUnion's own witnesses acknowledged that its reports to consumers did not show alerts from this product. Its call center told both named plaintiffs, the people who sued in their own names, that there was no alert on their report. The version sold to businesses carried one. In July 2011, TransUnion began printing the alerts on the reports it sent consumers.

The Fair Credit Reporting Act gives consumers a way to dispute errors in their reports. The Third Circuit recorded that TransUnion had "a policy of never reinvestigating disputes involving OFAC alerts."

What the lawsuits decided

Sandra Cortez sued TransUnion in 2005 after a Colorado car dealership confronted her with an alert. A jury found for her. In August 2010, the Third Circuit upheld that verdict in Cortez v. Trans Union. It held that these alerts are part of the credit report and fall under the Act. It remains the only final appeals-court ruling that TransUnion was liable for this practice, and it rests on one consumer's facts.

From 1 January to 26 July 2011, a consumer with an alert who asked for their report got two envelopes. The first held the report, with the alert left out. The second, a day later, was a letter naming the possible OFAC match. The letter gave no dispute instructions and left out the summary of consumer rights. It never said the alert appeared on reports sold to businesses.

On 27 February 2011, a salesman at a Dublin, California dealership told Sergio Ramirez that Nissan would not sell him a car. The salesman said his name was on a "terrorist list." In February 2012, Ramirez filed a class action, one lawsuit brought for a whole group. In July 2014, the court defined the group as the 8,185 people who received the OFAC letter between January and July 2011.

The district court found that TransUnion removed the alert of each class member who contacted it after receiving the letter. The court cited that against TransUnion's claim that correcting alerts was technically infeasible. Removing an alert did not change the matching rule that produced it.

In June 2017, a jury found that TransUnion had willfully broken the Act and awarded the class about $60 million. In February 2020 the Ninth Circuit upheld the finding of liability and reduced the punitive damages.

What the Supreme Court decided, and what it did not

In TransUnion LLC v. Ramirez, decided on 25 June 2021, the Supreme Court ruled five to four on who could sue. It held that only class members who had suffered a concrete harm could sue for damages in federal court.

TransUnion had given the reports of 1,853 class members to businesses between January and July 2011. The Court held that those 1,853 had suffered a harm close to defamation, so they could sue over TransUnion's accuracy procedures. The other 6,332 could not. The Court compared their position to a defamatory letter written and then stored in a desk drawer. On the two claims about the letters themselves, the Court held that only Ramirez could sue.

The Court expressly took no position on whether TransUnion broke the law as to those 6,332. It did not decide whether the product was accurate.

The Supreme Court sent the case back to the lower courts, and it settled there. Two thousand people were paid: the 1,853, plus 147 who later proved that their reports had been given to businesses. No court ever ordered TransUnion to stop selling the product or to change its design.

What TransUnion changed after the Cortez ruling

In October 2010, OFAC officials wrote to TransUnion. They warned that a product without "rudimentary checks to avoid false positive reporting" can "cause harm to innocent consumers." The letter carried no enforcement power over TransUnion.

In November 2010, TransUnion changed the alert from "match" to "potential match." It also required an exact match on first and last names. By the Ninth Circuit's account of the trial record, false positives fell from about five percent to about half a percent. No method or denominator was published for those figures.

TransUnion asked Accuity for further software changes, which were not in place until 2013. Until then it kept matching on first and last names alone. Nothing verified in the record says what the check compares today.

What the available tools can and cannot address

A failure pathway is a link between two parts of the network, where a mistake made by one part can be passed on to the other.

This case's budget of 7 units is the cost, in this Lab's tools, of the three changes TransUnion made after the 2010 Cortez ruling. None of the three levels that set targets can be met within that budget. The reason differs by level.

Explore (No Targets) sets no targets. There, and under Service Targets Only, the obstacle is price. No combination of tools costing 7 units or less keeps the mistakes on this network contained. The cheapest combination that does costs 8 and uses three tools.

Under Service and Safety Targets and All Governance Targets, money is not the obstacle. This case offers eleven tools, the ones the parties in this record could actually use. Using all eleven at their highest settings costs 50, and five failure pathways stay open. They are these five.

Accuity's software reading names from the OFAC list.

The name check using the name a business supplied with its request.

TransUnion's product and legal staff setting the matching rule.

TransUnion telling Accuity what software to build.

TransUnion producing the consumer's own copy of the report from the credit file.

Those five pathways are the deployment itself. Four of them come down to a list from the government, a name from a customer, and a company that owns the rule and buys the software. The fifth is each person's right to a copy of their own file. Closing all five would mean no name screen and no credit bureau. This is a finding about the deployment, not a gap in your approach.

Stylized model of a documented deploymentLending & credit collections AI

Open this example in PAN Lab v0.1 to apply pressures and levers and watch what the system does.

What this models

This example runs on the Sanctions-name-screen-class with a supplier-held matcher and a redacted disclosure network: 13 components and 25 pathways between them. Every context in the Lab is a stylized model, never a reconstruction of any actual deployment, and each assumption behind it carries a provenance label.

Evidence base: 2 assumed · 12 published baseline. In the Lab, the shaded evidence band behind each headline readout draws its width from the least-established class below.

Show all 14 assumptions
  • baseline

    This board models the sanctions name screen as three federal courts found it, together with the operator's own account of the product in its Securities and Exchange Commission filings and its standard contract. Where a value comes from a court it comes from the Third Circuit's 2010 Cortez opinion, the Ninth Circuit's 2020 Ramirez opinion, the March 2017 summary-judgment order, the Supreme Court's 2021 opinion or the Illinois Appellate Court's 2025 opinion, and the line says which. Where it comes from the operator it is labelled as the operator's own statement.

  • baseline

    Register discipline, binding on every node and edge: there is no score, no probability, no threshold and no calibration surface anywhere in this deployment. The governed artifact is a string equality test on two fields. Nothing here implies machine learning, training data, model risk or automated scoring, and the absence of a probability is the case rather than a gap in it: there was no dial to turn, which is one reason the only change the operator ever made to the comparison was to require an exact match instead of a similar one.

  • baseline

    The holding is about standing, not accuracy, and every value that touches it is drawn on that basis. The Supreme Court decided which class members could sue for damages in federal court. It did not hold that the screen was accurate, reasonable or lawful, and footnote 5 expressly takes no position on whether the operator violated the accuracy provision as to the 6,332 class members whose reports were never disseminated. In the principal action liability was never finally resolved: the judgment was reversed and remanded and the case then settled. The one final appellate liability holding against this practice is the Third Circuit's 2010 decision, on one individual's facts.

  • baseline

    Two input sources are drawn because the comparison has two sides and neither of them is the operator's own record of the consumer. One is the sanctions list, a government publication whose entries carry names, dates of birth and passport information, held with the matching software on a third party's side. The other is the name typed by the subscriber on the inquiry, which the operator's own master agreement defines as the name screened, expressly not as may be found on TransUnion's databases. The operator's consumer database is drawn as a record store with no pathway into the comparison, and the check that would read a matched record back against it sits at the bottom rung, because the Third Circuit found that the operator sent only a name to the vendor and compared the return against nothing in its own files and nothing the subscriber provided.

  • baseline

    The false-positive figures are litigation-record figures and are treated as order of magnitude. About five per cent before the November 2010 tightening and about half a per cent after appear in the Ninth Circuit's recitation of the trial record; there is no published methodology, no denominator and no independent audit behind them. They are the only published rate figures in the record and they order the direction of two values here, but no baseline is computed from them.

  • baseline

    The statement that no true match was ever confirmed is a statement about the record and not a proven zero. The Ninth Circuit found that the operator presented no data showing that any of its matches were correct and could not confirm that a single alert it sold was accurate, and three of its witnesses so testified in the district court. That is an evidentiary absence in one case over one class window, not a demonstration that the product never once identified a listed person, and nothing here is set as if it were.

  • baseline

    The removal-on-contact rate and the dissemination share are the case in two numbers and must be read together. The district court recorded that the alert was removed for each class member who contacted the operator, so correction conditional on discovery was total; and the Ninth Circuit and the Supreme Court record that from 2002 the alert was removed from the consumer's own copy, so discovery was structurally suppressed. Recording either alone would misdescribe the deployment: the first alone reads as a working safeguard and the second alone reads as a technicality. The removal removed the alert and not the comparison, which is why the pathway from a contact outcome back to the rule is drawn at the bottom rung.

  • baseline

    No independent audit component is drawn, because the record contains none. The only party that ever tested this product's accuracy was a plaintiff in litigation; there is no published evaluation, no supervisory examination of the matcher and no third-party assurance anywhere in this deployment's history. The PAN entry lists an independent auditor with an empty authority set for the same reason. Drawing one would fill a gap the evidence says was there, so the gap is stated here instead.

  • baseline

    No downstream enforcement component and no queue is drawn. The alert is a document, and the adverse action that follows is taken by lending or retail-credit staff employed by a different company, drawn here as the operator class the record describes. The contract told those staff they were solely responsible and must not take adverse action based on the screen, and both the Third Circuit and the district court held that this could not discharge the operator's own statutory duty. No queue, backlog or throughput figure appears anywhere in this record, so nothing here is drawn as one.

  • assumed

    Sixteen edges carry the privacySensitive flag under one stated rule: a pathway is marked where the flow itself carries an identified consumer's name, credit file, sanctions label or matched sanctions record. Pathways that carry authority, a rule change, a complaint volume or a supplier instruction are not marked, and the read of the list into the comparison is not marked because what it carries at that point is public government data about listed persons rather than anything about the consumer. The egress is marked because it takes an identified consumer's name across the boundary on every screened pull.

  • baseline

    Consumers are boundary-only and nothing about any person is computed here. No denial, refused sale, credit outcome or household consequence follows from anything on this diagram; an alert, a letter and a disclosure are institutional signals. The cohort figures are recorded external observations from the litigation record: 8,185 people received the letter in the seven-month window, 1,853 had their reports disseminated inside it, 147 more later proved dissemination through a claims process, and 2,000 were paid under the settlement. The verdict and settlement amounts are payment figures rather than harm rates, and the settlement amount is reported by legal trade press rather than stated in any primary document.

  • baseline

    What changed after 2013 is deliberately left open. The operator's filings state that as a result of the 2010 appellate decision it modified one of its add-on services; the Ninth Circuit found the modifications were the November 2010 wording change and the exact-match tightening, with vendor enhancements landing in 2013 and name-only matching continuing until then. A 2020 pleading alleges that the operator told the trial court it gained the ability to consider dates of birth in 2013 and continued to disregard available birth dates thereafter; that case was voluntarily dismissed with prejudice in March 2022 with no class certified and nothing adjudicated, and no value here is set from it. Nothing verified establishes what the comparison uses today, so this board asserts neither that the operator now compares dates of birth nor that it does not.

  • baseline

    The October 2023 settlement in which a tenant-screening subsidiary and the operator paid $15 million over eviction and criminal-record accuracy is a different product and appears nowhere in this network. It is the only regulatory action against this operator on accuracy in the relevant period, which is exactly why the confusion is worth naming: nothing here is drawn from it, and no regulator has ever taken enforcement action over the sanctions name screen.

  • assumed

    This board draws each documented flow once, at the coarsest drawing that keeps every documented mechanism distinguishable, and narrates on the pathway that carries it any flow the record describes as a route to somewhere the board already reaches. The alert reaches the credit desk on the front page of the report, so the desk's read of the report carries it. The matched records, the trigger and the seven-month run of the 2011 letters are carried by the disclosure operation's line to the letter. The complaint read of the file is carried by the removal it informed, the subscriber typing the inquiry name by the name it supplies, and the vendor's upkeep of its copy of the list by the matching operation. The consumer's file entering the match and a matched record being read back against that file are one documented absence, drawn once. The routes from the credit desk, from the product and from consumer complaints back toward the rule are narrated where the record shows they produced nothing. No documented fact was dropped in the redrawing.

What this example does not show

Show all 10 limitations
  • Litigation and regulatory posture, carried BYTE-EXACT from the dossier's status field of record: "Fully adjudicated and closed as to the operator. TransUnion's FY2022 Form 10-K records final approval and payment as 'a full resolution of this matter', and the FY2025 Form 10-K contains no mention of OFAC or Ramirez at all. The product itself was never enjoined and no court ever ordered a design change: the Supreme Court decided WHO could sue, not whether the product was accurate or lawful. TransUnion continues to offer an OFAC screening append to credit reports (a 2015 TransUnion master agreement filed with the SEC in 2020 contains a standing 'OFAC Name Screen' clause). The population the record shows was labelled - 8,185 people in a seven-month window - is roughly four times the population that ever obtained a remedy (2,000)."
  • The merits outcome, in the dossier's own corrected words and binding on every summary of this case: "Adjudicated on standing; the merits were never finally resolved - reversed and remanded June 25, 2021, then settled, with final approval entered December 2022 and payment in January 2023." A jury found willful violations in June 2017 and the Ninth Circuit affirmed liability in February 2020, but the Supreme Court reversed and remanded and the case then settled, so the 2017 judgment does not stand as a final liability determination. The one final appellate liability holding against this practice is Cortez v. Trans Union (3d Cir. 2010), on the individual facts of one consumer.
  • The holding is about standing, not accuracy, and nothing here should be read as validating the product. Footnote 5 of the Supreme Court's opinion states that the parties assumed the operator violated the statute even as to those whose alerts were never disseminated, and that the Court takes no position on that issue. The class was narrowed to 1,853 for standing; 147 additional members later demonstrated dissemination through a claims process and joined the settlement, so 2,000 of the original 8,185 were paid. On 23 January 2023 the claims of the members held to lack standing were dismissed without prejudice; one of them refiled the same day in an Illinois state court with no concreteness requirement, and the Illinois Appellate Court affirmed dismissal as time-barred on 31 March 2025, declining to apply equitable tolling.
  • The false-positive figures are litigation-record figures, not a published measurement. About five per cent before the November 2010 tightening and about half a per cent after appear in the Ninth Circuit's recitation of the trial record; there is no published methodology, no denominator and no independent audit. Treat as order of magnitude only. Likewise, that no true match was ever confirmed is a statement about an evidentiary absence in one case over one class window — three of the operator's witnesses testified there was no evidence any flagged consumer was on the list, and the operator produced no data showing any match was correct — and not a proof that the product never once identified a listed person.
  • The settlement amount is secondary-sourced. The operator's Form 10-K confirms final approval on 19 December 2022 and payment on 20 January 2023 without stating an amount; the $9 million fund, the $4.2 million fee award, the $75,000 service award and the estimate of more than $2,000 per claimant come from legal trade press. The final-approval date differs by four days across sources (15 December 2022 hearing per trade press, 19 December 2022 order entered per the 10-K) and both are stated here rather than averaged.
  • What changed after 2013 is only partly on the record. Verified: the operator's filings state it modified the service as a result of the 2010 decision; the Ninth Circuit found the modifications were the November 2010 wording change and the exact-match tightening, with vendor enhancements landing in 2013 and name-only matching continuing until then. Alleged only, in a pleading that was voluntarily dismissed with prejudice on 7 March 2022 with no class certified and no findings: that the operator represented it gained the ability to consider dates of birth in 2013 and continued to disregard available birth dates afterwards. Not established by anything verified: what the comparison uses today. This board asserts neither that the operator now compares dates of birth nor that it does not.
  • The operator's precision-and-recall framing is its litigation position, not the record's account of why the product worked this way. Its certiorari petition argues that reporting potential matches even where other information could disprove an actual match is part of the trade-off inherent in the credit-check process, and that lenders have a strong interest in a product that casts a wide initial net and then relies on a lender's human judgment. Both the Third Circuit and the district court rejected the related argument that contractual human review discharged the statutory accuracy duty. It is attributed here wherever it appears and never presented as a finding.
  • The October 2023 settlement in which a tenant-screening subsidiary and the operator paid $15 million over eviction and criminal-record accuracy concerns a DIFFERENT product and has nothing to do with sanctions name screening. It is included in the evidence set only as operator context, because it is the one federal regulatory action against this operator on accuracy in the relevant period and therefore the live confusion risk. No regulator has ever taken enforcement action over the name screen itself.
  • Class-size figures vary slightly across documents. 8,185 is the stipulated class figure used by the Supreme Court, the Ninth Circuit and the operator's own Form 10-K, and is the figure used throughout. A 2020 pleading says 8,192 and the operator's earlier filings say approximately 8,000; neither is used here.
  • No volume or staffing figure exists for the product itself: no count of pulls carrying the append, no headcount for the disclosure operation or the third-party matching operation, no complaint volume, no throughput. Demand and capacity on this board are derived from what the record does establish — a nationwide append at an operator reporting data on over one billion consumers, and a human comparison the district court found would have disposed of every class member's flag — and no figure here should be read as a measured volume.

Sources and evidence

What this example rests on, claim by claim. Every entry resolves to the same ledger the Evidence Registry publishes.

  • From 2002 TransUnion LLC, one of three nationwide consumer reporting agencies, sold subscribers an add-on to the ordinary credit report — marketed and litigated variously as 'OFAC Advisor', 'OFAC Name Screen' and, in TransUnion's own filings with the Securities and Exchange Commission, 'the OFAC Alert service'. On a subscriber credit pull carrying the append, TransUnion passed the consumer's first and last name, and nothing else, to third-party software and data held by a vendor, Accuity, Inc., which compared it against the U.S. Treasury Department's Specially Designated Nationals and Blocked Persons list; a match was written into the 'SPECIAL MESSAGES' section on the front page of the report sold to the subscriber. The Ninth Circuit found that TransUnion introduced the product on the belief that it was exempt from the Fair Credit Reporting Act because the data sat in the vendor's file rather than its own database, that on that basis 'TransUnion did not follow its normal procedures to ensure accuracy', and that it adopted a policy of not disclosing OFAC matches to consumers who requested their own reports. It summarised the result as name-only searches 'for more than a decade, resulting in thousands of false positives and not a single known actual match identified' — an evidentiary absence in one case over one class window rather than a proven zero. On 27 February 2011 Sergio Ramirez was refused the sale of a car at a Dublin, California dealership after a credit check returned an OFAC alert and a salesman told him his name was on a 'terrorist list'; his wife bought the car in her own name.

    empirical
    • Government United States Court of Appeals for the Ninth Circuit (2020, February 27). Ramirez v. TransUnion LLC, 951 F.3d 1008 (No. 17-17244) https://cdn.ca9.uscourts.gov/datastore/opinions/2020/02/27/17-17244.pdf
    • Government Supreme Court of the United States (2021, June 25). TransUnion LLC v. Ramirez, 594 U.S. 413 (No. 20-297) (slip opinion) https://www.supremecourt.gov/opinions/20pdf/20-297_4g25.pdf
    • Government United States Court of Appeals for the Third Circuit (2010, August 13). Cortez v. Trans Union, LLC, 617 F.3d 688 (Nos. 08-2465 and 08-2466) https://www2.ca3.uscourts.gov/opinarch/082465p.pdf
    • Vendor TransUnion (2016, February 19). Annual Report on Form 10-K for fiscal year 2015, OFAC Alert Service disclosure https://www.sec.gov/Archives/edgar/data/1552033/000155203316000079/transunion-20151231x10k.htm

  • The comparison used two fields and the disambiguating fields existed on both sides of it. Before November 2010 it fired on names that were 'either identical or similar' — the Ninth Circuit's worked example is that 'Cortez' would match 'Cortes'; from November 2010 an exact first-and-last-name match was required, which the court records as cutting the false-positive rate from about five per cent to about half a per cent (a litigation-record figure with no published methodology, denominator, or independent audit, and order of magnitude only). No date of birth, middle initial, Social Security number, citizenship, or address was compared at any point. Meanwhile TransUnion held the consumer's date of birth and Social Security number in its own CRONUS database and, the Third Circuit found, required a creditor to supply at least a name AND an address to retrieve from it, while sending only a name to Accuity 'even though Trans Union may have more information about the person who is the subject of the inquiry'; it 'neither compares the OFAC information to other information about a given consumer already in its files, nor does it compare it to any information provided by the creditor/subscriber'. The sanctions records themselves carried the listed persons' first, middle, and last names, dates of birth, and passport information, and TransUnion reprinted exactly those fields in the letter it mailed the consumer. The Ninth Circuit recorded that for tax liens and bankruptcy judgments TransUnion used at least one identifier besides the name, and that 'OFAC information was the only consumer-report data that TransUnion collected using name alone'. The Third Circuit called the failure 'to take the utmost care in ensuring the information's accuracy — at the very least, comparing birth dates when they are available' reprehensible; the district court reasoned that with a birth-date comparison 'none of the class members would be even a potential match'.

    empirical
    • Government United States Court of Appeals for the Ninth Circuit (2020, February 27). Ramirez v. TransUnion LLC, 951 F.3d 1008 (No. 17-17244) https://cdn.ca9.uscourts.gov/datastore/opinions/2020/02/27/17-17244.pdf
    • Government United States Court of Appeals for the Third Circuit (2010, August 13). Cortez v. Trans Union, LLC, 617 F.3d 688 (Nos. 08-2465 and 08-2466) https://www2.ca3.uscourts.gov/opinarch/082465p.pdf
    • Government United States District Court for the Northern District of California (2017, March 27). Order Denying Summary Judgment, Ramirez v. Trans Union, LLC, No. 3:12-cv-00632-JSC (Dkt. 233) https://www.uschamber.com/assets/documents/Order20Denying20Summary20Judgment20-20Ramirez20v.20Trans20Union2C20LLC2028USDC20-20Northern20District20of20California29.pdf
    • Government Supreme Court of the United States (2021, June 25). TransUnion LLC v. Ramirez, 594 U.S. 413 (No. 20-297) (slip opinion) https://www.supremecourt.gov/opinions/20pdf/20-297_4g25.pdf

  • The corrective loop was closed at both ends and the two halves must be read together. From 2002 the consumer-facing copy of the report did not show the OFAC alert, and TransUnion's own witnesses acknowledged that the personal credit reports it gives consumers never show any information or alerts from the OFAC product it provides to creditors. The Fair Credit Reporting Act's dispute channel was switched off for this data class by policy: the Third Circuit recorded that 'once Trans Union receives the OFAC information it does not check or confirm its accuracy; in fact, Trans Union has a policy of never reinvestigating disputes involving OFAC alerts', and TransUnion's call centre told both named plaintiffs there was no alert on their report while an alert sat on the version being sold. Against that, the district court found that TransUnion 'removed the OFAC Alert of each class member who contacted Trans Union following receipt of the OFAC letter' — a removal rate of one hundred per cent on the contacting subset — and cited it against TransUnion's own contention that correction was technically infeasible. Between 1 January and 26 July 2011 TransUnion sent two envelopes a day apart: the credit report with the OFAC alert redacted plus the statutory summary of rights, then a separate 'OFAC Letter' that named the potential match, reprinted the matched sanctions records with their dates of birth and passport information, gave no dispute instructions, omitted the summary of rights, and never stated that the alert appeared on the version sold to third parties. TransUnion stopped that practice in July 2011 and began putting the alerts directly on consumer-facing reports. Treasury's OFAC publishes consumer guidance describing the same loop and routing removal back through the Fair Credit Reporting Act dispute process at the bureau — the channel this operator's policy had closed.

    empirical
    • Government United States Court of Appeals for the Ninth Circuit (2020, February 27). Ramirez v. TransUnion LLC, 951 F.3d 1008 (No. 17-17244) https://cdn.ca9.uscourts.gov/datastore/opinions/2020/02/27/17-17244.pdf
    • Government United States Court of Appeals for the Third Circuit (2010, August 13). Cortez v. Trans Union, LLC, 617 F.3d 688 (Nos. 08-2465 and 08-2466) https://www2.ca3.uscourts.gov/opinarch/082465p.pdf
    • Government United States District Court for the Northern District of California (2017, March 27). Order Denying Summary Judgment, Ramirez v. Trans Union, LLC, No. 3:12-cv-00632-JSC (Dkt. 233) https://www.uschamber.com/assets/documents/Order20Denying20Summary20Judgment20-20Ramirez20v.20Trans20Union2C20LLC2028USDC20-20Northern20District20of20California29.pdf
    • Government U.S. Department of the Treasury, Office of Foreign Assets Control. FAQs 70 and 71: What Is This OFAC Information On My Credit Report? and How Can I Get The OFAC Alert Off My Credit Report? https://ofac.treasury.gov/faqs/topic/1516

  • In one seven-month window in 2011 the product labelled 8,185 people, and the law treated them differently according to something none of them could observe. A class of 8,185 was certified in July 2014; on 21 June 2017 a jury awarded $984.22 statutory and $6,353.08 punitive damages per class member, about $60 million in total, and in February 2020 the Ninth Circuit affirmed liability and standing while cutting punitive damages to $3,936.88 per member. On 25 June 2021 the Supreme Court held 5-4 that only the 1,853 class members whose reports were provided to third-party businesses had suffered a concrete harm and had standing on the reasonable-procedures claim, and only the named plaintiff on the two mailing claims: 'the mere existence of inaccurate information, absent dissemination, traditionally has not provided the basis for a lawsuit in American courts', the harm being 'roughly the same, legally speaking, as if someone wrote a defamatory letter and then stored it in her desk drawer.' THE HOLDING IS ABOUT ARTICLE III STANDING AND NOT ABOUT ACCURACY: footnote 5 states that the parties assumed TransUnion violated the statute even as to those whose alerts were never disseminated and that the Court 'take[s] no position on that issue'; the judgment was reversed and remanded and the case then settled, so no merits judgment survives in the principal action. Justice Thomas, dissenting with three colleagues, wrote that 'in a 7-month period, it is undisputed that nearly 25 percent of the class had false OFAC-flags sent to potential creditors... If 25 percent is insufficient, then, pray tell, what percentage is?' TransUnion's Form 10-K states that the ruling left 'only approximately 23% of the class' with concrete harm. Final approval of a class settlement was entered on 19 December 2022 (a 15 December 2022 final-approval hearing date appears in legal trade press) and TransUnion paid on 20 January 2023; the amount is not stated in any primary document located, with a $9 million fund, $4.2 million in class-counsel fees, a $75,000 service award, and an estimated recovery above $2,000 per claimant reported by legal trade press. The Illinois Appellate Court, taking judicial notice of the federal record, recorded that the settlement covered 'the 1,853 class members determined to have standing, as well as an additional 147 class members who demonstrated standing pursuant to a claims process' — 2,000 of the original 8,185. On 23 January 2023 the remaining members' claims were dismissed without prejudice; the same day one of them refiled in the Circuit Court of Cook County, Illinois, a forum with no concreteness requirement, and on 31 March 2025 the Illinois Appellate Court affirmed dismissal as time-barred, declining equitable tolling.

    empirical
    • Government Supreme Court of the United States (2021, June 25). TransUnion LLC v. Ramirez, 594 U.S. 413 (No. 20-297) (slip opinion) https://www.supremecourt.gov/opinions/20pdf/20-297_4g25.pdf
    • Government United States Court of Appeals for the Ninth Circuit (2020, February 27). Ramirez v. TransUnion LLC, 951 F.3d 1008 (No. 17-17244) https://cdn.ca9.uscourts.gov/datastore/opinions/2020/02/27/17-17244.pdf
    • Government Illinois Appellate Court, First District (2025, March 31). Ramirez Arrizon v. TransUnion, LLC, 2025 IL App (1st) 231911 https://ilcourtsaudio.blob.core.windows.net/antilles-resources/resources/3ed129b9-c285-47da-b56c-f86341b5f7ce/Arrizon%20v.%20TransUnion,%20LLC,%202025%20IL%20App%20(1st)%20231911.pdf
    • Vendor TransUnion (2023, February 14). Annual Report on Form 10-K for fiscal year 2022, legal proceedings note https://www.sec.gov/Archives/edgar/data/1552033/000155203323000016/ck0001552033-20221231.htm
    • Vendor TransUnion (2020, February 18). Annual Report on Form 10-K for fiscal year 2019, OFAC Alert Service disclosure https://www.sec.gov/Archives/edgar/data/1552033/000155203320000014/transunion-20191231x10k.htm
    • Trade press Consumer Financial Services Law Monitor, Troutman Pepper (2023). Ramirez Case Reaches Final Approval of Class Settlement https://www.consumerfinancialserviceslawmonitor.com/2023/01/ramirez-case-reaches-final-approval-of-class-settlement/

  • The vendor boundary was the architecture and the legal theory at once, and the contractual export of responsibility was rejected twice. The Third Circuit held in August 2010 that OFAC alerts are part of the consumer report and subject to the maximum-possible-accuracy duty: 'We do not believe that Congress intended to allow credit reporting companies to escape the disclosure requirement... by simply contracting with a third party to store and maintain information that would otherwise clearly be part of the consumer's file.' It also rejected the subscriber addendum as a defence — 'We are not persuaded that Trans Union's private contractual arrangements with its clients can alter the application of federal law' — and the district court likewise rejected the argument that contractual human review discharged the statutory duty. In October 2010 officials at Treasury's own OFAC wrote to TransUnion saying they continued to hear from its customers and from individual consumers adversely affected by false OFAC alerts, warning that a product 'that does not include rudimentary checks to avoid false positive reporting can create more confusion than clarity and cause harm to innocent consumers', and that they were 'particularly worried' by alerts 'disseminated broadly in conjunction with credit reports'; the letter carried no enforcement power. The Ninth Circuit found that TransUnion then 'made surprisingly few changes': the November 2010 wording change and exact-match tightening, with further software enhancements requested from Accuity 'not implemented until 2013', and name-only matching continuing until then. TransUnion's own position on appeal — OPERATOR ADVOCACY, not a finding — is that reporting potential matches 'even though other information (like date of birth) could disprove an actual match, is part of the trade-off inherent in the credit-check process' and that 'lenders have a strong interest in an OFAC product that casts a wide initial net and then relies on a lender's human judgment'. A TransUnion master agreement dated March 2015 and filed with the Securities and Exchange Commission in 2020 carries clause 4.6 'OFAC Name Screen': the name screened is the one 'supplied by Subscriber to TransUnion on input and not as may be found on TransUnion's database(s)', and the subscriber 'shall be solely responsible for taking any action that may be required... and shall not deny or otherwise take any adverse action against any consumer which is based, in whole or in part, on TransUnion's OFAC Name Screen services.' What the matcher compares today is NOT ESTABLISHED by any verified source: a 2020 complaint alleges TransUnion represented it gained the ability to consider dates of birth in 2013 and continued to disregard available birth dates thereafter, but that case was voluntarily dismissed with prejudice on 7 March 2022 with no class certified and nothing adjudicated, and TransUnion's Form 10-K for fiscal year 2025 makes no mention of OFAC or Ramirez. Separately and unrelatedly, an October 2023 Federal Trade Commission and Consumer Financial Protection Bureau settlement required TransUnion Rental Screening Solutions, Inc. and Trans Union LLC to pay $15 million over eviction and criminal-record accuracy in TENANT screening reports; it is a different product, is not about OFAC name screening, and must not be cited as such.

    empirical
    • Government United States Court of Appeals for the Third Circuit (2010, August 13). Cortez v. Trans Union, LLC, 617 F.3d 688 (Nos. 08-2465 and 08-2466) https://www2.ca3.uscourts.gov/opinarch/082465p.pdf
    • Government United States Court of Appeals for the Ninth Circuit (2020, February 27). Ramirez v. TransUnion LLC, 951 F.3d 1008 (No. 17-17244) https://cdn.ca9.uscourts.gov/datastore/opinions/2020/02/27/17-17244.pdf
    • Government United States District Court for the Northern District of California (2017, March 27). Order Denying Summary Judgment, Ramirez v. Trans Union, LLC, No. 3:12-cv-00632-JSC (Dkt. 233) https://www.uschamber.com/assets/documents/Order20Denying20Summary20Judgment20-20Ramirez20v.20Trans20Union2C20LLC2028USDC20-20Northern20District20of20California29.pdf
    • Government TransUnion LLC (2020, September 2). Petition for a Writ of Certiorari, TransUnion LLC v. Ramirez, No. 20-297 (party filing; operator litigation position) https://www.supremecourt.gov/DocketPDF/20/20-297/151906/20200902111013981_TransUnion%20cert%20petition%20Final.pdf
    • Vendor Trans Union LLC and Upstart Network, Inc. (2015, March; filed with the U.S. Securities and Exchange Commission in 2020). TransUnion Master Agreement for Consumer Reporting and Ancillary Services, clause 4.6 OFAC Name Screen (Exhibit 10.16 to Upstart Holdings, Inc. registration statement) https://www.sec.gov/Archives/edgar/data/1647639/000119312520285895/d867925dex1016.htm
    • Advocacy Al-Shaikli v. Trans Union, LLC, No. 5:20-cv-04155 (E.D. Pa., filed August 24, 2020). Class Action Complaint (pleading; allegations only; voluntarily dismissed with prejudice March 7, 2022 with no class certified) https://www.classaction.org/media/al-shaikli-v-trans-union-llc.pdf
    • Vendor TransUnion (2026, February 27). Annual Report on Form 10-K for fiscal year 2025 https://www.sec.gov/Archives/edgar/data/1552033/000155203326000012/tru-20251231.htm
    • Government Federal Trade Commission and Consumer Financial Protection Bureau (2023, October 12). Settlement to Require Trans Union to Pay $15 Million over Charges It Failed to Ensure Accuracy of Tenant Screening Reports (a DIFFERENT product; not about sanctions name screening) https://www.ftc.gov/news-events/news/press-releases/2023/10/ftc-cfpb-settlement-require-trans-union-pay-15-million-over-charges-it-failed-ensure-accuracy-tenant

Where this connects

Institutional pressures in this domain

  • Vendor opacity — The deploying institution cannot inspect the model, data, or update pipeline it is accountable for.
  • Compliance over substance — Paper controls (sign-offs, checklists) satisfy audits while the behavior they describe erodes.
  • Data & policy drift — The world, the intake process, and the rules change under a system trained on how things used to be — two mechanisms with different remedies: the statistical properties of what the system processes move (concept drift), or the mixture of inputs arriving in deployment differs from the mixture it was trained on (covariate shift).
  • Austerity & recovery incentives — Cost-cutting and overpayment-recovery targets tilt the system toward denial and enforcement errors.
  • Reviewer bottleneck — One fixed-capacity checking stage sits between AI output and consequence; everything queues behind it.

All of them in context on the Lending & credit collections AI domain page.

Levers available here and the patterns behind them

Documented case histories