And the strings from this list have to be matched indiscriminately against everything? Names of account holders, text in the reference field of a transaction (if such a thing exists in the US), whatever?
Yep. I bought a used copy of Yakuza 0 online once and foolishly included the name of the game in the notes of the transaction. PayPal blocked the transfer of funds for over a week.
I haven't read the actual guidelines / rules / etc put out by OFAC in over a year but that was the gist of it from the legal team.
Yes, all text in a message scanned, matches made are for manual review. In the world of financial compliance false positives are in the majority. No company can afford to skip a true match for the sake of scalability based on current audit practices.
In finance, compliance is taken very seriously. Better to block 1000 transactions than miss 1.