The Federal Acquisition Regulation makes exclusion verification non-discretionary for federal contracting officers and for prime contractors awarding subcontracts above the simplified acquisition threshold. The legal authority is clear. The mechanical workflow is straightforward. The compliance gap most teams don't notice is in the documentation and the geographic context, not the lookup itself.
What is federal exclusion verification?
Federal exclusion verification is the process of checking whether a federal contractor or subcontractor appears on the SAM Exclusion List — the federal government's authoritative record of entities and individuals barred from receiving federal contracts, grants, or other federal financial assistance.
The requirement isn't optional. Two FAR provisions make verification mandatory:
- FAR 9.405 prohibits contracting officers from soliciting offers from, awarding contracts to, or consenting to subcontracts with excluded parties.
- FAR 52.209-6 (Protecting the Government's Interest When Subcontracting with Contractors Debarred, Suspended, or Proposed for Debarment) imposes flow-down verification requirements on primes for subcontracts above the simplified acquisition threshold.
Skipping verification has operational consequences. A prime contractor that awards a subcontract to an excluded entity can face contract termination for default. The prime may face False Claims Act liability if it certified compliance with FAR 52.209-6 while knowing (or while having reason to know) the subcontractor was excluded. The prime itself can be suspended for repeated non-compliance with mandatory screening obligations.
This isn't theoretical risk. Federal contracting officers and DCAA auditors review verification documentation during contract performance reviews. A prime that can't produce evidence of having checked SAM.gov before each subcontract award has a documentable compliance gap that creates real audit exposure.
The SAM Exclusion List — formerly EPLS
The SAM Exclusion List is the current name for what used to be called the Excluded Parties List System, or EPLS. GSA maintained EPLS as a standalone database for decades, accessible at epls.gov. In July 2012, GSA consolidated EPLS into the System for Award Management (SAM), along with seven other legacy procurement systems including CCR, ORCA, and FedReg.
The records migrated forward unchanged. The legal authority underlying each exclusion (FAR 9.4, OMB Circular A-129, and agency-specific regulations) is the same. The federal agencies producing exclusion records — HHS, OFAC, OPM, DOJ, HUD, EPA, and dozens of others — operate the same processes. Only the URL and the user interface changed.
The current database contains 167,681 records. The composition skews heavily toward individuals (around 132,000) rather than firms (around 8,300). The remaining records cover Special Entity Designations (OFAC sanctions targets and similar regulatory designations) and Vessel exclusions for maritime federal awards.
Despite the 2012 consolidation, the old terminology persists. Practitioners still search for "gsa exclusion list," "epls list," "us government excluded parties list system," and "excluded parties list system epls website" — all of which point to the same database now living at sam.gov/search/?index=exc. If your internal compliance procedures reference EPLS by name, the workflow remains valid. The URL is the only thing that needs updating.
Step-by-step exclusion verification process
A complete verification check takes 15 to 30 minutes per entity if done by hand. The mechanical workflow:
Step 1: Collect the subcontractor's legal name and UEI. The Unique Entity ID is the 12-character federal identifier that replaced the DUNS number in 2022. Every SAM-registered entity has a UEI. Pull both pieces from the subcontractor's proposal documentation or the SAM.gov entity profile. If the subcontractor doesn't provide a UEI, the entity may not be SAM-registered — which is itself a finding worth documenting.
Step 2: Search SAM.gov exclusions directly. Navigate to sam.gov/search/?index=exc. This is the live, authoritative database. No login is required for read access. Results return classification (Firm, Individual, Special Entity Designation, Vessel), excluding agency, exclusion program (the legal authority), exclusion start date, and termination date if specified.
Step 3: Search by UEI first, then by name. UEI search is exact-match and produces the highest-confidence result. If the UEI returns no exclusion record, run a name search using the legal name exactly as it appears on the SAM registration. Common name collisions are the main reason name searches require careful review — multiple unrelated entities can share variations of a common name like "Smith Construction" or "Global Services LLC." UEI screening eliminates the false-positive problem when UEI is available.
Step 4: Check action date and termination date. Expired exclusions remain visible in the database. An exclusion with a termination date in the past is no longer active and does not bar award. Read both dates carefully. A 3-year debarment imposed in 2021 that terminates in 2024 is a historical record, not a current bar. Some exclusions have no termination date — those are indefinite and remain active until the excluding agency lifts them.
Step 5: Document the search. Compliance file documentation should record the date of the check, the searcher's name, the search terms used (UEI and legal name), the result (no record found, or specific exclusion records reviewed and determined not to apply), and a screenshot or printed copy of the SAM.gov results page. This documentation satisfies FAR 52.209-6's record-keeping expectations and is the evidence DCAA auditors expect to see during contract performance reviews.
That's the basic workflow. It catches the entity the subcontractor proposed. It doesn't catch the other entities sharing the subcontractor's registered address — and that's the gap where geographic context matters.
What basic verification misses — the geographic dimension
Manual verification has one structural limitation: it screens one entity at a time. When a contracting officer or compliance reviewer searches SAM.gov for a specific UEI, the system returns information about that entity in isolation. It does not show:
- How many other federal contractors are registered at the same physical address
- Whether any of those co-located entities is on the exclusion list
- Whether the subcontractor's address sits in a cluster known for exclusion proximity
- Whether the subcontractor shares a registered agent, a common officer, or a parent company with an excluded entity
Most addresses host one federal contractor and present no geographic complexity. But some don't. Across the SAM database of 2,684,826 entity registrations, the analysis identifies 128 federal contractor address clusters nationwide that contain at least one confirmed exclusion match. Virginia and California tie for the most matches at 19 clusters each. Texas follows with 12, then Florida with 10, and New York and Maryland with 9 each.
The 128-cluster figure is small relative to the total cluster base (around 0.19 percent). But the distribution is concentrated. For a compliance team operating in the federal contracting markets that produce most of these matches — the National Capital Region, the Bay Area, Los Angeles County, Houston, the Dallas-Fort Worth metroplex — exclusion-adjacent geography appears in subcontractor screening more often than the national rate suggests.
The pattern doesn't prove the subcontractor is the excluded entity. A virtual-office address hosting 47 unrelated tenants and one excluded entity isn't a finding about the other 46 tenants. But it is a reason to look more carefully at the cluster before completing the responsibility determination. Geographic data answers a question manual SAM.gov verification cannot: "What else is at this address?"
Subcontractor compliance beyond the exclusion check
Exclusion verification is one step in a broader subcontractor responsibility determination. The full FAR 9.104-1 framework covers more ground:
SAM registration status. Active SAM registration is the baseline. An expired registration disqualifies the subcontractor from award until reactivation completes (typically 7 to 14 days for routine renewals). SAM.gov shows current status alongside exclusion search results.
Responsibility determination under FAR 9.104-1. Contracting officers evaluate prospective contractors on adequate financial resources, ability to meet the delivery schedule, satisfactory performance record, integrity and business ethics, organization and skills, and equipment and facilities. The exclusion check addresses one piece of integrity and business ethics. The other factors require separate evaluation, often involving past-performance data from CPARS, financial statements, and capability documentation.
Organizational conflicts of interest. FAR 9.5 requires screening for impaired objectivity, biased ground rules, and unequal access to information. A subcontractor with prior work for the same federal customer in a related capacity can create OCI concerns even when no exclusion record exists. This screening is frequently missed in vendor management workflows focused only on SAM status.
Past performance review. CPARS records, prior contract evaluations, and references from previous primes contextualize what the entity-level SAM record cannot. A subcontractor with a clean SAM record and a pattern of poor performance reviews on prior federal work is a different risk profile from one with both clean SAM and strong past performance.
For compliance teams managing more than a handful of subcontractor relationships, the workflow needs to cover all five layers — SAM status, exclusion check, responsibility determination factors, OCI screening, and past performance — before award. Geographic intelligence adds one more layer: the address-level context that turns single-entity screening into pattern-aware screening. It doesn't replace any of the other layers. It supplements them.
Automating exclusion screening with geographic data
Manual exclusion verification at scale gets expensive. A compliance team screening 50 subcontractors a quarter spends 50 to 100 hours of analyst time on SAM.gov lookups alone, before adding documentation, OCI screening, and past performance reviews. That's roughly a half-FTE just on basic SAM checks.
Convergence Data Analytics produces state-level data products that pre-cross-reference every federal contractor address cluster against the SAM Exclusion List database. The State Risk Landscape Reports include a companion CSV containing every entity in every cluster for a given state, with exclusion-match flags attached. A compliance analyst can search a subcontractor's address in the CSV and immediately see every co-located entity, their SAM status, and which (if any) match an exclusion record. That cuts a 15-minute manual check into a 60-second filter operation when the screen needs to cover geographic context.
The Missouri State Risk Landscape Report is available free as a sample edition — the same methodology and structure as paid editions, with no cost. Practitioners can evaluate the workflow against real data before deciding whether the analysis fits their compliance practice.
For the full per-state breakdown of exclusion-matched address clusters, see State Risk Landscape Reports. For step-by-step lookup instructions on a specific entity, see How to check the SAM exclusion list. For broader context on what exclusions mean for supply chain compliance, see Understanding the SAM exclusion list.