TransUnion won Ramirez, and name-only matching still lost

The week

On June 25, 2021, the Supreme Court decided TransUnion LLC v. Ramirez, a case that began at a car dealership. In 2011 the lead plaintiff went to a Nissan dealership in Dublin, California, to buy a car. According to the Court’s opinion, the dealer ran a credit check and told him his report flagged him as a possible match to someone on a US government list of terrorists and drug traffickers. The dealer refused to sell him the car.

TransUnion, one of the three big US credit bureaus, had offered an add-on product called OFAC Name Screen Alert. It flagged consumers on credit reports as potential matches to people on the Treasury Department’s list of Specially Designated Nationals. That list is kept by Treasury’s Office of Foreign Assets Control, or OFAC. It names individuals and companies that Americans are generally barred from doing business with, because of sanctions related to terrorism, narcotics trafficking and similar concerns. A business that deals with someone on it can face serious penalties.

The problem was how TransUnion decided who was a possible match. According to the majority opinion, it compared first and last names and no other data. Justice Thomas’s dissent added that TransUnion did not compare birth dates, middle initials or Social Security numbers. If your first and last names matched a name on the list, your file could carry the flag, regardless of anything else about you.

The practice had been challenged before. Justice Thomas’s dissent described an earlier suit in which a jury found for a consumer wrongly flagged by an OFAC alert, and the Third Circuit affirmed a reduced punitive award. In the dissent’s account, TransUnion made few changes afterward.

The legal backdrop had been set five years earlier. In Spokeo, Inc. v. Robins, decided in 2016, the Supreme Court held that a bare procedural violation of the Fair Credit Reporting Act, without a concrete harm, does not give a plaintiff standing to sue in federal court. That case also involved a company that reported inaccurate information about a consumer, there a people-search website. It left lower courts to work out which inaccuracies were concrete enough. Ramirez was the Court’s chance to say more, in a case with a large class and a large verdict.

A class of 8,185 people sued under the Fair Credit Reporting Act, the federal law that governs credit bureaus. The class covered consumers who requested their files or had the alert on their reports between January and July 2011. They brought three claims. The first was that TransUnion failed to follow reasonable procedures to assure the accuracy of its reports. The other two concerned how TransUnion told consumers about the alert. It sent each consumer’s credit file in one mailing and a separate letter about the OFAC match in another, without the summary of rights the law requires.

A jury awarded each class member about $984 in statutory damages and about $6,353 in punitive damages, more than $60 million in total. The Ninth Circuit upheld standing for the whole class but cut the punitive award to about $3,937 per person, roughly $40 million in all.

The Supreme Court split 5-4. Justice Kavanaugh wrote the majority opinion, joined by the Chief Justice and Justices Alito, Gorsuch and Barrett. It held that only the 1,853 class members whose misleading reports had been disseminated to third parties, such as lenders or businesses, had suffered a concrete injury. Only they had what lawyers call “standing,” the constitutional right to bring a claim for damages in federal court, on the accuracy claim. The other 6,332, whose flagged files sat in TransUnion’s database unshared, did not. On the two mailing claims, only the lead plaintiff had standing.

Justice Thomas wrote the principal dissent, joined by Justices Breyer, Sotomayor and Kagan. Justice Kagan also wrote a separate dissent. The Court sent the case back to the Ninth Circuit. It also expressly left open a related question: whether every member of a class must show standing before a court certifies the class at all.

So the headline was a legal victory for TransUnion. But the facts of the case describe something more useful for executives to understand: a basic data problem, matching people to records, that every bank, credit union and fintech wrestles with every day.

Ramirez is taught mainly as a case about constitutional standing, and its effect on class actions is real. But the facts describe a data problem every bank, credit union and fintech will recognize. A system compared names, found superficial matches to a sanctions list, and attached a damaging flag to real people who had nothing to do with sanctioned parties. According to the Court’s opinion, a car dealer refused to sell the lead plaintiff a car because of such a flag.

TransUnion largely won on standing. The practice lost on every other measure. Three things govern a matching process like this, and the ruling changed none of them: the matching logic that creates the error, the moment of disclosure where the Court located the harm, and the enforcement channels that do not depend on private lawsuits.

The underlying technology comes first, followed by the matching logic and a walk through the screening process that turns logic into action. The moment of disclosure and the enforcement channels follow. We close with what a well-run matching process has in common and a short set of questions for checking one.

What “entity resolution” means, and why it is hard

Entity resolution is the technical name for answering a deceptively simple question: are these two records about the same person, or company, or not? It sounds trivial, but it is one of the hardest routine problems in data.

A large hospital mailroom faces the same problem with a letter addressed to “J. Garcia, 4th floor.” There may be a dozen J. Garcias in the building. A careful clerk checks the department, the full first name, the employee number. A careless one delivers it to the first J. Garcia they find. Both are doing entity resolution; only one is doing it well.

Financial institutions do this constantly. They match new applicants to existing customers, match payments to accounts, match customers to fraud watch lists, and, critically, match customers and payment counterparties to sanctions lists such as OFAC’s. This last process is called sanctions screening. Every time a bank opens an account or sends certain payments, software compares the names involved against the list and raises an alert if something looks similar.

The output of that software is a potential match, sometimes called a “hit.” A potential match is a question, not an answer. The mistake at the heart of Ramirez was treating the question as though it were the answer and then telling other businesses about it.

Two families of technique

Matching methods fall into two broad families. Deterministic matching applies fixed rules: two records match if the names are identical, or if the name and date of birth both agree. It is easy to explain and audit, and it is brittle. A single typo or a different spelling defeats it, and a rule that is too loose catches everyone with a common name.

Probabilistic matching weighs the evidence. Statistical record-linkage methods dating to the late 1960s assign each agreeing or disagreeing field a weight. A shared rare surname counts for more than a shared common one. A matching date of birth adds weight, and a conflicting one subtracts it. The total becomes a score, and the institution decides what score triggers which action.

Most commercial screening tools blend the two. They use fuzzy name comparison, such as phonetic codes that treat names that sound alike as similar, and edit-distance measures that count how many characters differ. They then apply rules on top. The settings are configurable, which means someone at the institution, or at its vendor, has chosen them.

Companies are harder than people

Matching companies adds a layer people do not have: ownership. Under OFAC’s 50 Percent Rule, an entity owned 50 percent or more by one or more blocked persons is itself blocked, even if it does not appear on the list by name. A screening tool that compares names alone cannot see that. Resolving it requires ownership data, which is often incomplete, out of date or held by a third-party provider with its own matching errors.

Many lists, many purposes

Sanctions lists are only one input. Institutions also screen against internal watch lists of former customers and known fraudsters, and against lists of politically exposed persons. Banks also answer requests from FinCEN under section 314(a) of the USA PATRIOT Act, which ask them to search their records for subjects of law enforcement investigations. Each list has a different purpose, a different legal consequence for a match and a different tolerance for error. Running them all through one engine with one threshold treats unlike things alike.

The identifiers the institution already holds

Banks and credit unions usually hold more than a name. Under the customer identification program rules that apply to banks, an institution opening an account generally collects a name, a date of birth for individuals, an address and an identification number. Broker-dealers and other covered institutions have similar rules. The identifiers needed to resolve most sanctions alerts are therefore already in the institution’s systems.

The gap is often in the plumbing. A screening tool may receive only the name field from the account-opening system, because that was all the original integration passed. Dates of birth may sit in a different format, or be missing for accounts migrated from an older core. Names may have changed after marriage, or be stored with nicknames. Each of these turns a solvable alert into an unsolvable one, and pushes analysts toward guesswork. Fixing the feed is often cheaper than hiring more analysts.

The matching logic: names are not identities

Name-only matching is cheap and fast, and it produces false positives at scale. A false positive is when the system says “match” and it is wrong: an innocent person is flagged. A false negative is the reverse: a genuine match is missed.

Several things guarantee that a list of sanctioned individuals will appear to match many innocent people. Common names are shared by thousands or millions of people. Transliteration, the conversion of names from other scripts such as Arabic, Cyrillic or Chinese into English letters, produces several valid spellings for the same name. And naming conventions in many cultures order or combine family and given names differently, so a simple “first name, last name” comparison misfires. Many Hispanic names, for example, carry two surnames, and records may hold either or both.

Why the base rate matters

A further reason is arithmetic. The number of listed individuals is tiny compared with the number of customers a large institution screens. When the thing you are looking for is that rare, even a matcher that is wrong only occasionally produces far more false alarms than true hits. Most alerts in a healthy sanctions screening program are false positives, and that is expected. The design question is what the institution does with them.

This also explains why TransUnion’s approach was so damaging. An exact match on first and last name is a reasonable trigger for a question. Among the millions of people on a credit bureau’s files, it will flag many people for every listed person who shares their name. Treating that trigger as a conclusion guaranteed that most flags would be wrong.

Who bears the false positives

False positives do not fall evenly. Sanctions programs target particular countries and regions, so listed names cluster in particular languages. Name-only matching therefore concentrates its errors on customers whose names come from those languages or share common surnames with listed people. The same customers are flagged again at every bank, every payment and every account opening.

That pattern carries its own risks. Customers who are repeatedly delayed or declined for the same reason tend to complain, and they may raise fairness concerns with regulators. Measuring false positives by name origin is difficult and sensitive. Measuring repeat alerts on the same cleared customer is easy, and a good list of previously cleared customers, with the identifiers that cleared them, reduces the burden on both sides.

What OFAC itself says

Sanctions screening teams deal with this daily. Standard practice treats a name match as an alert to be resolved with other identifiers, such as date of birth, address, nationality or identification numbers, and never as a conclusion. OFAC’s own published guidance on evaluating a potential hit makes the same point. It walks users through comparing the full list entry, including dates of birth, identification numbers, nationality and addresses, before treating a match as valid. It notes that if few details line up, the hit may not be a valid match. It also says OFAC does not confirm potential matches or false positives for users; the determination is theirs.

Incentives in screening push toward over-matching. OFAC civil penalties can apply on a strict liability basis, so a missed true match can be costly even without intent, while a false positive costs only review time. As an internal posture, that is reasonable. A bank would rather have an analyst spend ten minutes clearing an innocent customer than miss a sanctioned one.

Ramirez shows where that posture becomes dangerous. The danger arrives when an unresolved potential match leaks into a customer-facing outcome, such as a frozen account, a declined payment, or a notice telling someone they appear on a list. At that point the cost of a false positive is no longer an analyst’s ten minutes. It is a person’s reputation, their ability to transact, and the institution’s exposure.

Tiering: matching confidence should depend on where the answer goes

Any entity resolution process has an error rate, and the design question is what happens to its outputs. A useful practice is to tier them.

• Internal review tier. Matches that only prompt internal review can tolerate low confidence. Casting a wide net is fine when the only consequence is that a trained analyst takes a look.
• Decision and disclosure tier. Matches shown to customers, used in decisions or sent to third parties need high confidence and a human or secondary check.

The thresholds, the identifiers required at each tier, and the measured false positive rate should be documented and reviewed, the same way a credit model’s cut-offs are. Most banks already have rigorous governance for credit models: someone validates them, someone monitors their performance, and changes are approved. Many banks bring screening tools under the same model risk management framework, built on the 2011 supervisory guidance known as SR 11-7. Matching rules deserve that treatment, because they make decisions about people just as surely.

Consider a fintech that offers instant account opening. To keep sign-up fast, it screens applicants by name only and automatically declines anyone who produces a sanctions hit. The decline message tells the applicant they “matched a government watch list.” Every week, some number of innocent people with common names are turned away and told something alarming about themselves. The fintech has turned an internal alert into an external accusation. The fix is to keep screening but route name-only hits to review, ask for or check additional identifiers, and only take adverse action when the match is confirmed.

The counter-argument from friction and privacy

The strongest objection to “use more identifiers” is cost to the customer. Asking for a date of birth, an address history or an identification number adds friction, and some applicants abandon sign-up. Collecting more personal data also enlarges what a breach could expose. A credit union serving a small community may reasonably feel that name screening plus local knowledge is enough.

The objection is real, and tiering answers most of it. Extra identifiers are needed only for the small share of applicants who produce a hit, so step-up checks can be confined to them. Data already held for identity verification can be reused for match resolution. The objection does not support taking adverse action on a name alone. It supports asking for more only when a name raises a question.

How screening works in practice inside an institution

The risk lives in the handoffs, which shows when you follow a single alert through a typical organization.

A customer applies for an account, or a payment is about to be sent. Screening software compares the names involved against the sanctions list and any internal watch lists. Most comparisons produce nothing. Some produce a potential match, usually with a similarity score: a number expressing how closely the names resemble each other. The organization decides in advance what score is high enough to raise an alert. Set the bar low and analysts drown in alerts about innocent people. Set it high and genuine matches slip through. There is no setting that eliminates both kinds of error. There is only a choice about which mix to accept, and that choice should be made deliberately by people who understand the trade-off.

The alert lands in a queue. An analyst, often in a compliance operations team, opens it and compares what the institution knows about its customer with what the list says about the listed person. Different birth year, different country, different middle name: the analyst clears the alert and notes the reason. If the details line up, the analyst escalates, and the institution may block or reject the transaction and report it as the rules require.

Block, reject, report

OFAC’s guidance separates two outcomes for a valid match. Property of a blocked person is blocked, meaning frozen and held. A transaction that sanctions prohibit, but that involves no blocked property, is rejected. Either way, the institution reports it to OFAC, generally within ten business days, and keeps records. These are serious steps with legal consequences, which is why they should rest on a confirmed match rather than a name.

Where the flow breaks

Three things commonly go wrong in this flow. First, the queue is too large, so analysts are rushed, and clearing decisions become inconsistent. Second, the system takes an action automatically, such as holding funds or declining an application, before an analyst has looked. Third, the record of the alert, cleared or not, flows somewhere else: into a customer profile, a report, a data feed to a partner. When the third happens without the analyst’s conclusion attached, a question that was answered internally reappears elsewhere looking like a finding.

That third failure is, in essence, the Ramirez pattern. A name-based possible match was attached to a person’s file and then shared with businesses making decisions about that person. The individual alert may have been cheap to generate. The consequences of letting it travel were not.

A well-designed process makes each of these handoffs explicit. It sizes analyst teams to the alert volume the thresholds produce, rather than the other way around. It keeps automatic actions to cases where the evidence is strong. And it ensures that any alert data leaving the screening system carries its status, so that “possible match, cleared” never travels as “match.”

Tuning, testing and evidence

Thresholds should be tested, not assumed. A common technique is above-and-below-the-line testing. Analysts review a sample of results just above the alert threshold, to see how many are false positives, and a sample just below it, to see whether real matches are being missed. The results justify the setting, or show it needs to move.

Quality assurance samples cleared alerts to check that analysts applied the procedure consistently. Each cleared alert should record which identifiers were compared and why the analyst concluded there was no match. An examiner reviewing the program will ask for the threshold rationale, the testing results, the alert volumes and staffing, and a sample of dispositions. Institutions that keep those records answer in days. Those that do not spend weeks rebuilding them.

How it differs by institution

The legal frame is the same and the operating reality differs. OFAC’s prohibitions apply to US persons broadly, so a credit union, a regional bank, a broker-dealer and a fintech all screen. A credit union may run a vendor tool with default settings and a small team. A large bank screening millions of payments a day runs dedicated tuning and testing functions. Institutions regulated by the New York State Department of Financial Services are subject to its Part 504 rule, which sets specific expectations for transaction monitoring and filtering programs and requires an annual compliance certification.

Fintechs that rely on partner banks add another layer. The bank remains responsible for its sanctions compliance, and the fintech often runs the customer-facing flow. Who sets thresholds, who clears alerts and who writes the decline message should be set out in the partnership agreement. When it is not, the Ramirez pattern can appear in the gap between the two companies.

The moment of disclosure: where harm becomes concrete

The Court drew its line at dissemination. People whose inaccurate flags were sent to businesses suffered harm with a close relationship to the reputational harm of defamation, the legal wrong of spreading false statements that damage someone’s reputation. People whose flags stayed in a database did not, in the Court’s view, suffer a concrete injury, even though the risk of future disclosure existed.

What the Court said about risk

The opinion was careful about risk. A risk of future harm, it said, can support a claim for an injunction to stop the harm if the risk is sufficiently imminent and substantial. For damages, the mere risk of future harm, standing alone, is not enough. The plaintiffs whose files were never shared had not shown that the risk materialized or that it caused them some other concrete harm.

The Court applied similar reasoning to the mailing claims. The class members had received information in a confusing format and without a second copy of their rights. Without evidence that the format caused them harm, they lacked standing. A procedural error in a disclosure, by itself, did not support a federal damages claim for the class.

Controls at the boundary

That line has an operational corollary. Legal and reputational exposure peaks when data leaves the organization or drives a decision about a person. Controls are therefore worth most at those boundaries: before a report is furnished, before an adverse action is taken, before a flag reaches a counterparty or a customer screen. Concentrating quality checks at outbound interfaces gives the most risk reduction per hour of effort.

An outbound interface is simply any point where data leaves one system for another, or for a person. It might be a file sent nightly to a credit bureau, a screen a call center agent reads to a customer, or an API. An API, short for application programming interface, is a defined doorway through which one company’s software can request data from another’s automatically, with no human in between. Each of these doorways is where a wrong record turns into a real-world consequence.

Internal uses count as decisions too. A flag copied into a data warehouse can feed a marketing exclusion, a credit line review or a fraud model. A machine learning model trained on historical flags will learn whatever errors those flags contain. These uses keep data inside the company, and each can still change how a person is treated.

Adverse action notices are disclosures too

Notices to customers are a boundary of their own. When an institution takes adverse action based on a consumer report, the FCRA generally requires it to tell the consumer. The notice names the reporting agency and explains the right to a free copy and to dispute. When it denies credit, Regulation B under the Equal Credit Opportunity Act generally requires specific reasons. A notice must be accurate. A notice that cites a sanctions match the institution never confirmed repeats the Ramirez pattern in the institution’s own name.

The practical step is to map each reason code in a decline or account-closure notice back to the evidence behind it. Codes tied to screening results should be usable only after a match is confirmed. Compliance and legal teams should agree the wording, because what a notice says about a list carries weight with the customer and anyone they show it to.

Why “we never shared it” is fragile

The ruling also invites complacency that the facts do not support. An inaccurate flag in a database is one query from disclosure. For a lender, that query may be its own underwriting system, the software that decides whether to approve a loan. For a fintech, it may be an API partner. Data that is wrong and stored is a liability waiting for a trigger, and the cheapest time to fix it is before the trigger arrives.

“We never shared it” is a fragile defense. Organizations integrate new partners, launch new products and build new reports all the time. Each of those can open a doorway to data that has been sitting, wrongly, in storage. A practical control is to make the status of every screening result a required field wherever it is stored, and to block the export of any result still marked unresolved.

The enforcement channels: regulators need no standing

Article III standing, the constitutional requirement the Court applied, limits private plaintiffs in federal court. It does not limit the Consumer Financial Protection Bureau (CFPB), the Federal Trade Commission (FTC) or state attorneys general enforcing the Fair Credit Reporting Act (FCRA) and state laws, nor bank examiners reviewing practices. State courts may apply different standing rules. A narrower path for federal class actions does not reduce the regulatory exposure of poor matching.

This matters for how leaders read the headline. “TransUnion won” could be heard as “the risk went down.” For private federal class actions over undisclosed data, it did narrow. For everything else, from supervisory findings to state enforcement, the question remains whether the institution’s procedures are reasonable and accurate.

Who owes which duty

The duties differ by role. Consumer reporting agencies, the credit bureaus and similar firms, face the FCRA’s accuracy requirement directly. Banks and fintechs that furnish data to bureaus, meaning they send in information about their customers’ accounts and payment histories, have their own accuracy and dispute obligations. Institutions using screening, fraud and identity verification outputs to make decisions about consumers may face adverse action notice duties, the obligation to tell people when and why they were turned down. Organizations should confirm with counsel which of these apply to them.

Furnishers carry a specific set of expectations. Regulation V, which implements the FCRA’s furnisher provisions, requires furnishers to have written policies and procedures on the accuracy and integrity of the information they report. It also gives consumers a right in many cases to dispute information directly with the furnisher. A bank that sends wrong data to a bureau cannot rely on the bureau to catch it.

Supervision as a channel

Examiners reach matching through more than one door. Sanctions screening is reviewed as part of Bank Secrecy Act and anti-money laundering examinations, using the federal examiners’ manual. Consumer compliance examinations review furnishing, disputes and adverse action notices. A matching weakness can surface in either, and examiners in one area can refer findings to the other.

Disputes as an early warning system

Disputes are an enforcement channel too, and an early warning system. Consumers who discover a wrong flag complain to the institution, to the bureau and increasingly to regulators’ complaint portals, where patterns are visible to supervisors. A consumer reporting agency generally has thirty days to reinvestigate a dispute, and a furnisher that receives notice of it must investigate as well.

Some institutions track disputes by root cause and route matching-related disputes back to the team that tunes the matching rules. They learn about false positives from the people they harm before an examiner or journalist assembles the same picture. Many organizations handle disputes one at a time, fixing each record and closing the ticket. The more valuable practice is to ask, every month, what the disputes have in common, and to treat a cluster as a signal that a rule needs to change.

State law and state courts

Federal standing doctrine binds federal courts. State courts apply their own standing rules, and several states have their own credit reporting statutes, such as California’s Consumer Credit Reporting Agencies Act. Plaintiffs whose claims fail the Ramirez test in federal court can sometimes bring state-law claims in state court. For a bank or fintech operating in many states, the practical exposure from poor matching therefore depends partly on where its customers live. Counsel can map that exposure; the operational response is the same everywhere.

The counter-argument from deregulation

A reasonable objection is that enforcement priorities change with administrations, and that guidance can be withdrawn. That is true, and later events confirmed it. The statutory duty to follow reasonable procedures for accuracy does not depend on guidance, and state enforcers and private plaintiffs with concrete injuries remain. A program designed for the most lenient year will be wrong in the next strict one.

Matching is judgment written into software

Across all three areas, matching is a judgment encoded in software. The identifiers available, the thresholds chosen and the controls placed on outputs decide its quality. A ruling that narrows who can sue changes none of those engineering choices, and it should not lower the standard they are held to.

A well-run matching process tends to share a few features:

• It never treats a name alone as proof of identity.
• It distinguishes alerts for internal review from conclusions that affect people, and requires more evidence for the second.
• It measures its own false positive rate and reports it to someone senior enough to care.
• It puts its strongest checks at the doorways where data leaves the organization or drives a decision.
• It feeds customer disputes back into the rules, so the same mistake is not made a thousand times.

The failures are just as recognizable:

• Optimizing screening only to avoid missed matches, with no one accountable for the harm of false ones.
• Letting a raw screening hit flow directly into an automated decline or a customer message.
• Assuming a vendor’s matching product is accurate without asking how it matches and what its error rates are.
• Reading a favorable court ruling as a reduction in regulatory expectations.

Metrics worth reporting

A short set of measures tells a senior owner whether matching is under control. The false positive rate for each list and each tier shows whether thresholds are sensible. Alert aging shows whether analysts keep up. The share of alerts closed automatically, and the rules that close them, shows how much judgment has been delegated to software. Disputes traced to matching, and adverse actions reversed after review, show the harm that reached customers. Trends matter more than any single month.

Who owns the number

Each of these features needs an owner. Sanctions compliance usually owns thresholds and alert handling. Data management or the business owns the identifiers collected at onboarding. Consumer compliance owns disputes and adverse action notices. Technology owns the interfaces where data leaves. The false positive rate for decisions that affect customers needs one senior owner who can convene all four, because no single team controls every input.

What to ask a vendor

Many institutions buy matching from vendors, in screening tools, identity verification services and data feeds. The useful questions are concrete. They cover which fields the product compares and how they are weighted, and what the default thresholds are. They ask which settings the institution has changed and what testing results the vendor can share. And they ask whether the institution can see why a specific alert fired. A vendor that cannot answer these is asking the institution to accept its error rate on faith.

Where our own matching stands

1. Where in our business do we match people or companies to lists, including sanctions, fraud and identity checks, and which of those use names alone?
2. Can any unconfirmed potential match reach a customer, a decision or an outside party without a human or secondary check?
3. What is our false positive rate for each screening process, and who sees that number?
4. Which of our vendors make matching decisions on our behalf, and do we know how they do it?
5. Do we analyze disputes by root cause, and does anyone change a rule as a result?

The answers suggest an order of work. The first step is to map where matching happens and where its results go. The second is to stop any unconfirmed result from reaching a customer, a decision or a partner, which is usually a configuration change. Measurement comes next, so that the institution knows its error rates. Tuning comes last, because tuning without measurement is guesswork.

Asking them takes no technical expertise. Answered honestly, they tell a leader whether the organization is closer to the careful mailroom clerk or the careless one.

With hindsight

Courts went on to apply Ramirez’s concrete-injury test across privacy and data cases, including data breach suits, and the effect on litigation has lasted. Plaintiffs who claim their data was mishandled now routinely have to show a real-world harm, beyond a technical violation, before a federal court will hear them. That has shaped how many privacy and breach cases are brought and how they end. Defendants in breach class actions routinely cite Ramirez to challenge class members whose data was exposed but, they argue, never misused. Lower courts did not all draw the line in the same place, particularly on when a risk of misuse after a breach, combined with other effects, amounts to concrete harm.

The question Ramirez left open also stayed open. In Laboratory Corp. of America v. Davis, the Court agreed to decide whether a federal court may certify a damages class that includes both injured and uninjured members. On June 5, 2025, it dismissed the case as improvidently granted, without deciding the question. Justice Kavanaugh dissented and would have held that such a class may not be certified. Class certification fights over uninjured members therefore continued in the lower courts.

On the substance, regulation swung both ways. On November 4, 2021, the CFPB issued an advisory opinion stating that consumer reporting agencies using name-only matching were not using reasonable procedures to assure maximum possible accuracy. For a time, then, the federal consumer regulator said plainly what the facts of Ramirez suggested: matching on names alone is not good enough.

Enforcement on accuracy continued in the following years. In October 2023, the CFPB and the FTC jointly sued TransUnion’s rental screening business and its parent, alleging failures to follow reasonable procedures to assure the accuracy of eviction records, among other violations. The stipulated order required $11 million in consumer redress and a $4 million penalty. That case concerned tenant screening rather than sanctions, but it turned on the same duty.

In May 2025, the CFPB withdrew the name-only matching advisory opinion among 67 guidance documents. Read in isolation, that might suggest the bar had dropped. But state regulators and attorneys general stayed active. The underlying law requiring reasonable procedures to ensure accuracy did not change with the withdrawal of a guidance document.

OFAC’s own position did not move. Its published guidance still tells users to compare the full list entry against their own data before treating a hit as valid, and still says OFAC does not confirm matches for them. Institutions remain responsible for their own determinations, under a sanctions regime that can impose civil penalties without proof of intent.

The tools changed more than the rules. Screening vendors increasingly offered machine learning to score and prioritize alerts, which can reduce the time analysts spend on obvious false positives. Those tools changed how alerts are triaged. They did not remove the need to confirm a match with identifiers before acting on it, and they added a model that itself needs validation and monitoring. A model trained on past analyst decisions also inherits the consistency, or inconsistency, of those decisions.

The engineering point held regardless of the policy cycle: name-only matching produces false positives at scale, and outputs that reach other parties need stronger identifiers and review. That is a statement about how data behaves, not about which agency is in charge or what its priorities are this year.

The durable takeaway is to anchor data quality standards to what is true about the data rather than to the current enforcement climate. Policy swings in both directions, sometimes within a few years. A matching process built to be accurate, measured and reviewed is defensible under any of those swings. One built to the minimum of the moment has to be rebuilt every time the moment changes, and in the meantime it keeps telling innocent customers something false about themselves.