OFAC recordkeeping requirements obligate every U.S. person and entity to keep a full and accurate record of any transaction covered by federal sanctions regulations, retain those records for at least 10 years, and produce them to the Office of Foreign Assets Control on demand.1eCFR. 31 CFR 501.601 – Records and Recordkeeping Requirements The duty applies whether or not a license authorized the underlying activity, and it reaches banks, exporters, importers, and individuals alike. Civil penalties for failures can reach $377,700 per violation under the International Emergency Economic Powers Act, and willful violations carry up to 20 years in prison.2Office of the Law Revision Counsel. 50 USC 1705 – Penalties
What Records You Need to Keep
The rule says “full and accurate.” In practice, that means enough detail that an investigator could reconstruct the transaction years later without having to ask you a single question.
At a minimum, capture the full names and addresses of every party, the nature and purpose of the transaction, the exact date, and any identifying numbers such as wire transfer references, invoice numbers, or contract IDs. Include a description of any goods or services specific enough to show they are not prohibited items. Entries like “consulting services” or “miscellaneous goods” invite the kind of scrutiny that turns a routine audit into an enforcement action.
The requirement applies to transactions carried out under a general or specific license just as it applies to transactions that never required one. If the activity is covered by an OFAC regulation, the record has to exist.1eCFR. 31 CFR 501.601 – Records and Recordkeeping Requirements
The 10-Year Retention Period
Records must be kept for at least 10 years after the date of the transaction. This is a recent change. OFAC previously required five years, and an interim final rule extended the period to align with the 10-year statute of limitations Congress established for sanctions violations in April 2024.3Federal Register. Reporting, Procedures and Penalties The new period took effect on March 12, 2025, and reaches back to any violation that was not already time-barred when the underlying statute was enacted.
The practical impact is significant. Organizations that were destroying records after five years now need to hold them twice as long. If you already purged records under the old rule for transactions less than 10 years old and still within the new limitations window, those gaps could create exposure during an audit. Document destruction policies should be revisited immediately if that has not already happened.
How Records Must Be Stored and Produced
OFAC does not mandate a specific filing system or software platform. What it does demand is production on request. Under the reporting regulations, OFAC can require any person to furnish complete information about any covered transaction, including through subpoena, and can compel the production of books, contracts, correspondence, and any other documents in your custody or control.4eCFR. 31 CFR 501.602 – Reports to Be Furnished on Demand
The definition of “document” is deliberately broad, covering anything that preserves information in any medium: emails, spreadsheets, text messages, metadata, photographs, video recordings, invoices, bills of lading, and more.4eCFR. 31 CFR 501.602 – Reports to Be Furnished on Demand Whether records live on paper, in a cloud database, or spread across systems, you must produce them in a usable format that OFAC accepts. Encrypted files, proprietary formats, and disorganized archives all create problems when an auditor arrives expecting legible documents. If you lose access to your storage, you remain legally responsible for the missing information.
Reports That Sit on Top of Recordkeeping
Certain events trigger separate reporting duties that run alongside your general recordkeeping obligation. All of them must be filed electronically through the OFAC Reporting System (ORS).5U.S. Department of the Treasury. OFAC Reporting System Alternative filing methods carry a presumption of denial and are granted only in unique and extraordinary circumstances.
Initial Blocking Reports
When you come to hold property that becomes blocked under a sanctions program, you must file a report with OFAC within 10 business days of the block. The report has to identify the specific legal authority, such as a particular Executive Order or sanctions program, along with a description of the property and its value. A generic “SDN” reference is not sufficient. You must also keep a copy of every blocking report you file. When property is later released, the unblocking report must include a copy of the original blocking report and any OFAC Reporting System identification numbers.6eCFR. 31 CFR 501.603 – Reports of Blocked, Unblocked, or Transferred Blocked Property
Annual Report of Blocked Property
Anyone holding blocked property as of June 30 must file a comprehensive Annual Report of Blocked Property by September 30, using the TD-F 90-22.50 spreadsheet form submitted through ORS.7U.S. Department of the Treasury. Reminder to File the 2025 Annual Report of Blocked Property If you held no blocked property on June 30, no filing is required.
Rejected Transactions
When you reject a transaction because processing it would violate sanctions, even though the funds are not blocked, you must file a rejected transaction report. It must include the names, addresses, and locations of all parties, a description of the transaction and the property at issue, the date of rejection, the estimated value in U.S. dollars, and the legal authority for the rejection. For rejected trade documents, the value is reported as $0.00 with a narrative description of the shipment value. Foreign currency amounts must be converted to U.S. dollars with the exchange rate noted.8eCFR. 31 CFR 501.604 – Reports of Rejected Transactions
What Noncompliance Costs
Civil penalties under IEEPA can reach $377,700 per violation or twice the transaction amount, whichever is greater.9eCFR. 31 CFR Appendix A to Part 501 – Economic Sanctions Enforcement Guidelines These figures are adjusted for inflation periodically.10Federal Register. Inflation Adjustment of Civil Monetary Penalties Willful violations move into criminal territory: fines up to $1,000,000 and imprisonment for up to 20 years for individuals.2Office of the Law Revision Counsel. 50 USC 1705 – Penalties The line between a civil recordkeeping lapse and a criminal case often comes down to whether OFAC believes the failure was inadvertent or deliberate. Sloppy records that look designed to hide something tend to push cases toward the criminal side.
OFAC classifies every enforcement case as either “egregious” or “non-egregious,” and the classification drives the math. The agency weighs four factors, with particular emphasis on the first two: whether the violation was willful or reckless, whether the organization was aware of the conduct, the harm to sanctions program objectives, and the characteristics of the entity involved. Only the OFAC Director or Deputy Director can designate a case as egregious. In non-egregious cases without a voluntary self-disclosure, the base penalty is capped at the applicable schedule amount. In egregious cases without a self-disclosure, the base jumps to the full statutory maximum. Base amounts move up or down from there based on aggravating and mitigating factors.9eCFR. 31 CFR Appendix A to Part 501 – Economic Sanctions Enforcement Guidelines
Voluntary Self-Disclosure
Finding a compliance gap in your own records is bad. Waiting for OFAC to find it is worse. Voluntary self-disclosure is the single most effective way to reduce a potential penalty.
A qualifying disclosure cuts the base penalty in half. In a non-egregious case, the base drops to half the transaction value, capped at $188,850 per violation instead of the standard schedule amount. In an egregious case, it drops to half the statutory maximum.9eCFR. 31 CFR Appendix A to Part 501 – Economic Sanctions Enforcement Guidelines To qualify, you have to notify OFAC before the agency or any other government body discovers the violation on its own.
Disclosures are submitted through OFAC’s online disclosure form. The initial notification does not need to include every detail, but OFAC expects a sufficiently detailed follow-up report within 180 days that provides a complete picture of what happened.11U.S. Department of the Treasury. OFAC Disclosure Form Cooperation that falls short of a formal self-disclosure can still earn mitigation credit, but the 50 percent reduction is reserved for disclosures that meet the regulatory definition.