OFAC Sanctions Due Diligence: 50% Rule, Screening, and Penalties

OFAC sanctions due diligence means identifying whether any party, asset, or jurisdiction involved in a transaction is subject to U.S. economic sanctions before the transaction closes, and it is a legal obligation for every U.S. person and every business with U.S. touchpoints. The Office of Foreign Assets Control, part of the Treasury Department, administers sanctions against foreign countries, terrorist organizations, narcotics traffickers, and weapons proliferators.¹ If your screening fails, the money at stake is not just the deal itself; civil penalties reach $377,700 per violation or twice the transaction value, and willful violations carry up to 20 years in prison.

Who Has to Do This

The obligation reaches further than most businesses assume. Federal regulations define a “person subject to U.S. jurisdiction” to include every U.S. citizen and permanent resident anywhere in the world, every entity organized under U.S. law, the foreign branches of U.S. companies, and anyone physically present in the United States regardless of citizenship.²

Banks, credit unions, insurers, and money services businesses draw the heaviest scrutiny because their systems process the transactions OFAC is designed to intercept. The duty is the same for technology companies, exporters, importers, freight forwarders, and small businesses wiring payment to a foreign supplier. Size does not create an exemption.

Which Program You Are Screening Against

OFAC administers dozens of programs, and the type of program controls what your due diligence needs to catch.³

Comprehensive programs cover entire countries or regions, including Iran, Cuba, North Korea, Syria, and certain regions of Ukraine, and prohibit virtually all commercial and financial dealings absent specific authorization. Screening has to catch any connection to the territory itself.
List-based (targeted) programs freeze the assets of named individuals and entities. Business with the country at large may be permissible, but any transaction touching a listed party is prohibited. Screening focuses on matching names and identifiers against the Specially Designated Nationals (SDN) list and related databases.
Sectoral programs restrict specific kinds of financial activity within named industries of a foreign economy, such as long-term debt financing for designated energy firms, while leaving other trade with that country untouched.

The 50 Percent Rule

Screening the name on the invoice is not enough. Under OFAC’s 50 Percent Rule, any entity owned 50 percent or more, in the aggregate, by one or more blocked persons is itself blocked, even if OFAC has never listed it by name.⁴

Aggregation is where compliance breaks down. If Blocked Person A owns 25 percent and Blocked Person B owns another 25 percent, the entity is blocked because the combined stake reaches the threshold, and stakes are aggregated across different sanctions programs.⁵ The rule reaches ownership only, not control. An entity controlled by a sanctioned person but owned less than 50 percent by blocked parties is not automatically blocked, though OFAC warns that dealing with such an entity still carries risk of future designation and enforcement scrutiny.⁴ Meaningful due diligence looks past the list itself and into ownership structures, especially in high-risk jurisdictions.

The Program OFAC Expects You to Have

OFAC publishes a framework identifying the five components of a credible sanctions compliance program, and enforcement actions consistently measure companies against them.⁶

Management commitment. Senior leadership must allocate real resources and give the compliance function genuine authority. A program that gets overruled whenever it slows a deal is worse than useless in OFAC’s eyes.
Risk assessment. A documented review of where the business touches the outside world and where sanctions exposure is likely, covering customers, supply chain, geographic footprint, and product mix. It should be updated regularly.
Internal controls. Written policies and procedures for identifying, stopping, escalating, and reporting prohibited activity, including screening protocols and approval chains.
Testing and auditing. Independent reviews of whether the program actually works. OFAC has found companies that fail to update screening software when the SDN list changes, miss alternative spellings, or neglect to load new identifiers for blocked financial institutions.
Training. Job-specific training for all relevant employees at least annually, not a generic presentation the whole company sits through once.

When enforcement decisions reference “systemic compliance failures,” they almost always point to breakdowns in one or more of these five areas.

What to Collect Before You Screen

Screening is only as good as the identifiers behind it. For individuals, collect the full legal name, known aliases, date of birth, nationality, and government-issued identification numbers. For corporate counterparties, collect the full legal name, any “doing business as” names, jurisdiction of incorporation, physical addresses, and tax identification numbers. The more identifiers you have, the more confidently you can distinguish a real match from a false positive.

OFAC’s Sanctions List Search tool applies fuzzy-logic matching against the SDN List and the Non-SDN Consolidated Sanctions List at the same time.⁷ The “minimum name score” setting controls how strictly the system matches names. A lower threshold catches misspellings and transliteration variants but produces more false positives; in high-risk industries or jurisdictions, a wider net is the safer choice.

When You Get a Hit

Every result comes back with a score. Compare the secondary identifiers you collected against the list entry. If nothing lines up beyond a similar name, you likely have a false positive and may proceed. Document the analysis either way.

A confirmed match forces immediate action. Stop the transaction, freeze any assets involved, and file through the OFAC Reporting System.⁸ Two mandatory filings apply:

Report of blocked property, filed within 10 business days of the block, documenting what you are holding and why.⁹
Report of rejected transaction, filed within 10 business days when you turned away a prohibited transaction but are not holding property.¹⁰

If you hold blocked property on an ongoing basis, you also file an Annual Report of Blocked Property by September 30 each year, covering property held as of June 30. Blocked funds sitting in omnibus accounts must be broken out individually in the annual report.⁹

Licenses That Permit Otherwise-Prohibited Activity

Not every transaction touching a sanctioned country or party is off the table. OFAC authorizes activity through two license types.

A general license authorizes a category of transactions for a class of persons without an application. It is self-executing: if your transaction fits the terms, you may proceed without notifying OFAC.¹¹ Common categories include humanitarian shipments of food and medicine, personal remittances, and informational materials.¹² The terms are strict. A general license for agricultural exports does not cover industrial equipment, even to the same destination.

A specific license is a written authorization for a particular transaction, issued after a formal application. Before you apply, confirm no general license already covers the activity, because OFAC’s policy is to deny specific license applications when a general license exists for the same conduct.¹³ Expect the process to take time and require detailed documentation.

If You Find a Violation: Self-Disclose

OFAC’s enforcement guidelines treat voluntary self-disclosure as a significant mitigating factor. In non-egregious cases with a qualifying self-disclosure, the base civil penalty drops to one-half the transaction value, capped at $188,850 per violation. Without disclosure, that cap doubles to $377,700.¹⁴

To qualify, the notification must be self-initiated. It cannot follow a government inquiry, a subpoena, or a third-party blocking report that already flagged the issue, and it cannot contain false or materially incomplete information.¹⁵ For a corporate entity, senior management must authorize the disclosure. Filing a license application or responding to an OFAC inquiry does not count.¹⁶ The disclosure must include, or be followed within a reasonable time by, a report detailed enough for OFAC to understand what happened, and you must stay responsive to follow-up questions. Companies that disclose and then stonewall lose the benefit.

How Long to Keep the Records

Every transaction subject to OFAC regulations requires a full and accurate record, retained and available for examination for at least 10 years from the date of the transaction, whether the transaction was conducted under a license or not.¹⁷

Blocked property carries a longer clock. Records must be maintained for the entire period the property remains blocked, plus an additional 10 years after it is unblocked.¹⁷ Some sanctions programs have run for decades, so retention policies need to preserve screening results, match analyses, and correspondence for a long horizon.

What Failure Costs

OFAC’s enforcement guidelines weigh several factors: whether the conduct was voluntary or reckless, the existence and quality of a compliance program, cooperation with the investigation, and whether a qualifying self-disclosure was filed.¹⁵

Civil penalties under the International Emergency Economic Powers Act reach the greater of $377,700 per violation (the inflation-adjusted amount carrying into 2026) or twice the value of the underlying transaction.¹⁴ For a single large transaction, the “twice the value” calculation can dwarf the per-violation cap. Penalties under the Trading with the Enemy Act, which governs the Cuba program, carry a lower inflation-adjusted maximum of $111,308 per violation. Other programs administered by OFAC have their own penalty schedules.

Criminal penalties are reserved for willful violations. A person who knowingly violates OFAC sanctions faces a fine of up to $1,000,000 per violation and, for individuals, imprisonment for up to 20 years.¹⁸ The government can also seize property involved in the violation through forfeiture. Both civil and criminal enforcement carry a 10-year statute of limitations, measured from the date of the most recent violation.

1
U.S. Department of the Treasury. About the Office of Foreign Assets Control
2
eCFR. 31 CFR 515.329 – Person Subject to the Jurisdiction of the United States
3
Office of Foreign Assets Control. Sanctions Programs and Country Information
4
Office of Foreign Assets Control. Entities Owned by Blocked Persons (50% Rule)
5
Office of Foreign Assets Control. Entities Owned by Blocked Persons (50% Rule)
6
U.S. Department of the Treasury. A Framework for OFAC Compliance Commitments
7
Office of Foreign Assets Control. Sanctions List Search Tool
8
Office of Foreign Assets Control. OFAC Reporting System
9
eCFR. 31 CFR 501.603 – Reports of Blocked, Unblocked, or Transferred Blocked Property
10
Office of Foreign Assets Control. Filing Reports with OFAC
11
U.S. Department of the Treasury. FAQ 74
12
Office of Foreign Assets Control. Selected General Licenses Issued by OFAC
13
Office of Foreign Assets Control. OFAC License Application Page
14
Federal Register. Inflation Adjustment of Civil Monetary Penalties
15
eCFR. Appendix A to Part 501 – Economic Sanctions Enforcement Guidelines
16
eCFR. 31 CFR Part 501 – Reporting, Procedures and Penalties Regulations
17
eCFR. 31 CFR 501.601 – Records and Recordkeeping Requirements
18
Office of the Law Revision Counsel. 50 USC 1705 – Penalties