Hi everyone!
Here are this month’s highlights for upcoming changes, allowing you to adjust your integration in advance. Please take a minute to review and plan any updates.
PSA: Also use eu_journal_sanctions if you’re using eu_fsf
The EU FSF file hasn’t been in sync since July, and none of the nearly 1,600 entities and individuals at the core of Russia’s military-industrial complex from the landmark October sanctions package had been included yet by Friday 30 October. Nearly two years since we blogged about the publication delays, it would seem that progress has not yet been made on this front.
Our eu_journal_sanctions dataset, however, included all the newly sanctioned entities within a few hours of publication in the EU Journal on 12 October.
For anyone screening against the eu_fsf dataset, we strongly recommend making use of our eu_journal_sanctions dataset as well, to ensure you’re using the latest available data:
/match/default?include_dataset=eu_fsf&include_dataset=eu_journal_sanctions
Read our docs for more on why you should use both datasets and how we collect and review new publications from the Journal.
How we’re mitigating the PHP2Shell vulnerabilities
We conducted an internal scan to confirm that our technology stack includes no PHP-based services, which was the case.
We also put in place additional monitoring for our data crawler fleet to alert us if we identify irregular patterns in source data updates indicative of government website compromise. So far, that doesn’t seem to have happened.
Changes to come into effect November 16th
Improvements to parsing in gb_fcdo_sanctions
Effective date: 2026-11-16
About 2300 entities will be modified when their birthPlace value becomes the combined “Town, Country” form, where until now the Town and Country were separate values in this field.
A number of effectively empty Passport entities without a passport number – only a holder – will be removed.
Properties affected: Passport:id, Passport:holder, Person:birthPlace
Datasets affected: gb_fcdo_sanctions
Moving designation metadata off designated entities and onto their related Sanctions
Effective date: 2026-11-16
Every designated entity in ch_seco_sanctions will show as modified once, mostly in properties not used for matching. To avoid re-alerting, ignore createdAt, modifiedAt and notes in your change detection for this update.
- Designated people, companies and vessels lose
createdAt,modifiedAtand the designation reason innotes. The same information is on the linkedSanction(listingDate,startDate,modifiedAt,reason). - About 120 people lose a
nationalitythat was inferred from their passport’s issuing country, which can change match scores. The passport records keep that country. - Combined entities that also appear on other lists are affected too.
- No entities are added or removed, and entity IDs stay the same.
Properties affected: createdAt, modifiedAt, and notes on designated entities (Persons, Companys, Vessels); listingDate, startDate, modifiedAt, reason on the linked Sanction; Person:nationality, Person:name, Person:alias
Datasets affected: ch_seco_sanctions
Upcoming changes
Prepaid credit bundles for the OpenSanctions API (changelog)
We’re introducing credit bundles, a prepaid billing model for the OpenSanctions API. Credit bundles provide lower per-query prices for high-volume use (up to a discount of 70% on a 500,000 credit bundle!) and improved cost control. The bundles are one of a batch of updates we have made to the customer portal. Our API general Terms & Conditions have been updated to reflect the new billing model.
All customers can now switch over from subscription-based billing to credit bundles by logging into the customer portal.
Breaking change (on-premise yente): Upgrade to Elasticsearch 9 (changelog)
Effective date (end of life for 8): 2027-01-15
Elasticsearch 9 was released in April 2025, and the end of maintenance for version 8 is January 15, 2027. On-premise customers who are using Elasticsearch need to upgrade their Elastic server to version 9 before January 15, 2027. Current versions of yente are already compatible with both version 8 and 9 of the Elastic server, but yente 5.4.0 released in May 2026 is the last version compatible with Elastic server 8. You can find information on how to upgrade a standard single-node setup of Elastic in our documentation. For more advanced setups, please refer to the official Elastic documentation.
We recommend that on-premise customers perform this upgrade together with one of their upcoming upgrades of yente.
Retiring name-based and name-qualified matching algorithms (changelog)
Effective date: 2027-01-18
From January 2027, any /match calls using name-based or name-qualified will automatically start using the new ofac name matcher instead, since it does what name-based originally set out to do.
Removing the origin field on entities (changelog)
Effective date: 2027-02-15
We have been using the origin field at the statement level to describe the origin of a given statement about an entity.
However, we haven’t found aggregating these at the entity level to be useful or particularly meaningful, and will therefore remove this field from FollowTheMoney JSON data published by OpenSanctions on February 15th, 2027.
Specifically, that means entities.ftm.json files, entities.delta.json files, and targets.nested.json files.
Yente installations are compatible with the field removal. Integrations specifically accessing this field will need to support the format without this field.
The field will remain at the statement level, helping provide granular provenance for each statement made about an entity in our database.
Recent changes
New yente 5.5.1 (changelog)
Released: 2026-10-30
This is a security and maintenance release.
- eMudhra CA compromise. The 5.5.1 container image ships with updated CA trust stores: Debian
ca-certificates20250419+deb13u1and Pythoncertifi2026.10.23. These no longer trust the compromised eMudhra intermediate CAs (Mozilla bug 2083709). yente uses these trust stores when it downloads data and when it connects to the index. All users of the 5.5.0 image should upgrade.
More details in the release notes, and here’s the announcement on the discussion forum in case you have any questions.
Updates to our Privacy Policy and Data Processing Agreement
We have updated our Privacy Policy and Data Processing Agreement to reflect the retention periods of logging and usage information (three years).
Dataset removals and deprecations
Palestine Monetary Authority Local Freezing List (ps_local_freezing) to be removed November 16th (changelog). Its successor, Palestine National Terrorist Designations (UNSCR 1373) (ps_national_terrorism_list), is live.
Bulgaria National Terrorism Financing List: Direct sourcing (bg_mft_national) replaces OMNIO import (bg_omnio_poi) from November 16th (changelog).
Papua New Guinea Members of Parliament (pg_parliament) to be removed November 16th (changelog).
New datasets
India NIA Most Wanted (in_nia_wanted)
Palestine National Terrorist Designations (UNSCR 1373) (ps_national_terrorism_list)
And many more!
Quick reference
- Newsletter signup — To get these updates in your inbox
- Data dictionary — Full property and schema documentation
- Crawler planning — See what’s in progress and vote on priorities. Submit new data source requests via the request form or email support@opensanctions.org.
- Changelog — A record of significant data and API changes; see also yente release notes
- Community forum — Questions, discussion, and announcements
- Status page — Live service status and incident history