In banking, OFAC stands for the Office of Foreign Assets Control, a unit of the U.S. Department of the Treasury that administers and enforces economic and trade sanctions against foreign countries, regimes, terrorist organizations, and named individuals. For a bank, that translates into a concrete set of duties: screen customers and payments against OFAC’s lists, freeze or reject transactions that hit, report them, and keep a written compliance program that can hold up under review. Getting it wrong is expensive. Civil penalties can exceed $377,000 per violation, and willful violations carry criminal fines up to $1,000,000 and prison sentences of up to 20 years.
What OFAC Does
OFAC sits inside Treasury’s Office of Terrorism and Financial Intelligence, and sanctions enforcement is its only job. That narrow focus separates it from the other regulators banks deal with. FinCEN handles anti-money laundering and Bank Secrecy Act compliance. The Federal Reserve and OCC look at safety and soundness. OFAC cares about one question: are U.S. financial channels being used by sanctioned parties or for prohibited transactions.
The agency’s main enforcement authority comes from the International Emergency Economic Powers Act, which lets the President block transactions and freeze assets when there is an unusual or extraordinary threat originating substantially from outside the United States.1Office of the Law Revision Counsel. 50 USC 1705 – Penalties OFAC also enforces sanctions under the Trading with the Enemy Act and country-specific executive orders, but IEEPA is the backbone of most current programs.
Who Is Bound by OFAC Rules
OFAC’s regulations apply to every “U.S. Person,” and the definition is broader than most people assume. It covers all U.S. citizens and permanent residents wherever they live, anyone physically present in the United States, and every entity organized under U.S. law, including the foreign branches of U.S. companies.2eCFR. 31 CFR 560.314 – United States Person; U.S. Person A U.S. bank’s branch in London or Singapore has to follow every OFAC prohibition as though it were in New York.
Some programs reach further through secondary sanctions that target non-U.S. entities. Executive Order 14024, for instance, lets OFAC impose blocking sanctions on foreign banks or cut off their access to U.S. correspondent accounts if they facilitate significant dealings with Russia’s military-industrial base.3Office of Foreign Assets Control. Updated Guidance for Foreign Financial Institutions on OFAC Sanctions Authorities Targeting Support to Russia’s Military-Industrial Base The practical result is that many foreign banks with U.S. dollar exposure screen against OFAC lists even when they have no other U.S. connection.
The Lists Banks Screen Against
SDN List and the 50 Percent Rule
The Specially Designated Nationals and Blocked Persons List, universally called the SDN List, is OFAC’s primary tool. It names individuals, companies, terrorist organizations, and entities tied to targeted regimes whose property must be frozen immediately when it touches U.S. jurisdiction.4Office of Foreign Assets Control. Office of Foreign Assets Control – FAQ 18 U.S. persons are broadly prohibited from any dealings with anyone on it. The list holds tens of thousands of entries and is updated frequently, sometimes several times a week.
A key extension is the 50 Percent Rule. Any entity owned 50 percent or more, in the aggregate, by one or more blocked persons is itself treated as blocked property even if it is not named on the SDN List.5Office of Foreign Assets Control. Entities Owned by Blocked Persons (50% Rule) Ownership is calculated cumulatively, so two SDNs each holding 25 percent triggers the rule. Working out those ownership chains falls on the financial institution, which is why beneficial ownership due diligence sits at the center of sanctions compliance.
Other OFAC Lists
OFAC also publishes narrower lists that carry different restrictions. The Sectoral Sanctions Identifications List targets specific sectors of a country’s economy with narrower prohibitions, such as limits on certain debt and equity transactions rather than a full asset freeze.6U.S. Department of the Treasury. Sectoral Sanctions Identifications List The Foreign Sanctions Evaders List identifies foreign persons who have violated U.S. sanctions or helped others do so; transactions by U.S. persons involving FSEs are prohibited.7Office of Foreign Assets Control. Additional Sanctions Lists – Foreign Sanctions Evaders (FSE) List Screening software usually rolls these into a single run, but the required response varies by list, so compliance staff need to know which one produced the hit.
What Happens When Screening Flags a Match
When a hit comes up, the bank has to decide whether to block or reject the transaction. The difference turns on whether a sanctioned party has a property interest at stake.
Blocking applies when the transaction involves property in which an SDN or other blocked person has an interest. The bank must freeze the funds immediately and place them in an interest-bearing account on its books. Those funds stay frozen until OFAC authorizes their release.8Office of Foreign Assets Control. Blocking and Rejecting Transactions
Rejecting applies when the transaction is prohibited but no blocked person holds a property interest. A wire between two non-sanctioned parties tied to an export to a comprehensively sanctioned country like Cuba, Iran, or North Korea is a common example. The destination makes it prohibited, but there is no SDN property to freeze, so the bank declines and returns the funds.
Both blocked and rejected transactions must be reported to OFAC within 10 business days through the OFAC Reporting System.8Office of Foreign Assets Control. Blocking and Rejecting Transactions9eCFR. 31 CFR 501.603 – Reports of Blocked, Unblocked, or Transferred Blocked Property If a hit turns out to be a false positive, the bank unblocks the property and files an unblocking report.
What OFAC Expects from a Bank’s Compliance Program
OFAC published “A Framework for OFAC Compliance Commitments” identifying five essential components of a sanctions compliance program: management commitment, risk assessment, internal controls, testing and auditing, and training.10U.S. Department of the Treasury. A Framework for OFAC Compliance Commitments The framework is not optional. When OFAC evaluates a violation, the quality of the compliance program is an explicit factor in setting the penalty.
Automated screening carries most of the day-to-day load. Sanctioned parties rarely present themselves under their listed names, so screening software uses fuzzy-logic techniques, including character matching, string matching, and phonetic matching, to catch variations and transliterations. OFAC deliberately does not prescribe a match-score threshold; each institution sets its own based on its risk assessment and compliance practices.11Office of Foreign Assets Control. How to Search OFAC’s Sanctions Lists Set the threshold too high and real matches slip through. Set it too low and the alert queue balloons until analysts start clearing hits without a hard look.
Where Licenses Fit
Not every transaction touching a sanctioned country or party is permanently off limits. OFAC authorizes otherwise-prohibited activity through two kinds of licenses.12Office of Foreign Assets Control. What is a License? A general license authorizes a defined category of transactions for a whole class of persons without an application, covering things like certain humanitarian trade, informational materials, and personal remittances. A specific license is written authorization issued to a particular applicant after a formal request through OFAC’s licensing portal.13eCFR. 31 CFR Part 501 Subpart E – Procedures Relying on a general license that does not actually apply, or missing one of its conditions, creates the same exposure as processing a prohibited transaction with no license at all.
Penalties and Voluntary Self-Disclosure
Civil penalties under IEEPA can reach the greater of $250,000 per violation or twice the value of the underlying transaction.1Office of the Law Revision Counsel. 50 USC 1705 – Penalties The statutory floor is adjusted annually for inflation, and as of the January 2025 adjustment the cap stood at $377,700 per violation.14Federal Register. Inflation Adjustment of Civil Monetary Penalties Each prohibited transaction counts separately, so a busy payment operation can pile up exposure quickly. Willful violations carry criminal fines up to $1,000,000 and prison sentences of up to 20 years for individuals. The statute of limitations for both civil and criminal actions is 10 years from the date of the violation.
OFAC weighs aggravating and mitigating factors when setting a penalty. Aggravators include willful or reckless conduct, management awareness, concealment, and harm to sanctions program objectives. Mitigators include the quality of the compliance program, the speed and completeness of remediation, and cooperation with the investigation.15eCFR. Appendix A to Part 501 – Economic Sanctions Enforcement Guidelines A first-time violation with substantial cooperation can see the penalty reduced by 25 to 40 percent even without a voluntary self-disclosure.
A qualifying voluntary self-disclosure can cut the base penalty amount by 50 percent.16Department of the Treasury. Department of the Treasury’s Office of Foreign Assets Control’s Voluntary Self-Disclosure Policy The disclosure has to happen before OFAC or any other government agency discovers the violation or a substantially similar one, it must be self-initiated rather than prompted by an agency, and it must include enough detail for OFAC to understand what happened.15eCFR. Appendix A to Part 501 – Economic Sanctions Enforcement Guidelines Vague notification followed by delay does not qualify. Institutions with strong monitoring and escalation procedures tend to catch problems early, which is what preserves the window to disclose; banks without those systems often learn about violations only when OFAC calls, and by then the discount is gone.