What Is CAATSA? Countries Covered, Sanctions, and Waivers

The Countering America’s Adversaries Through Sanctions Act, known as CAATSA, is a federal law signed on August 2, 2017 that consolidated U.S. sanctions against Russia, Iran, and North Korea into a single statute and expanded the government’s ability to punish foreign actors economically. Public Law 115-44 turned what had been a patchwork of executive orders into binding law, making it far harder for any president to roll back sanctions without congressional approval. It also reaches well beyond U.S. borders: foreign companies, banks, and even allied governments can be penalized for doing significant business with the wrong Russian, Iranian, or North Korean entities.¹

The Three Countries It Covers

CAATSA is organized into three titles, each aimed at a different country.

Title I targets Iran’s ballistic missile and weapons-of-mass-destruction programs. It requires the President to sanction anyone who contributes to those programs, freezing their U.S.-connected property and denying visas. A separate provision applies terrorism-related sanctions to the entire Islamic Revolutionary Guard Corps, extending treatment that had previously applied only to the IRGC’s Quds Force.¹

Title II addresses Russia. It reaches interference in democratic processes, cyberattacks, human rights abuses in occupied territories, corruption, and arms sales to the Assad regime in Syria. Its two most consequential provisions target Russia’s defense and intelligence sectors (Section 231) and Russian energy export pipelines (Section 232). Title II also locked several Ukraine-related executive orders into statute so they cannot be lifted by executive action alone.

Title III focuses on North Korea’s nuclear and missile programs. It targets anyone who helps North Korea acquire weapons-related goods or technology, fuels or bunkers sanctioned vessels, insures or registers North Korean-controlled ships, or facilitates the export of North Korean workers. Section 321 goes further, creating a rebuttable presumption that goods produced anywhere in the world with North Korean labor were made with forced labor and are therefore barred from entering the United States.²

Why It Matters That CAATSA Is a Statute

Before CAATSA, most of the U.S. sanctions architecture against these three countries lived in executive orders that any sitting president could modify or revoke. By writing the sanctions into law, Congress made them durable.

Section 216 makes that durability enforceable. Before terminating, waiving, or making a licensing change that would significantly alter U.S. foreign policy toward Russia, the President must submit a report to Congress explaining the proposed action. That submission triggers a 30-day review period (60 days if the report is filed between July 10 and September 7), during which Congress can pass a joint resolution of disapproval to block the change.¹ The result is that easing pressure on Russia now requires convincing Congress, not just signing an order.

How Foreign Companies Get Caught

CAATSA’s most distinctive feature is its extraterritorial reach. Section 231 requires the President to impose sanctions on any person who knowingly enters into a significant transaction with an entity in Russia’s defense or intelligence sectors. The word “shall” is doing heavy work: unlike many sanctions authorities where the President has discretion, Section 231 makes the penalty mandatory once a significant transaction is identified.³

The State Department publishes a List of Specified Persons identifying which entities fall inside those sectors. On the defense side it includes major Russian arms manufacturers and research institutes. On the intelligence side it names the Federal Security Service (FSB), the Foreign Intelligence Service (SVR), the Main Intelligence Directorate (GRU), and private organizations linked to Russian cyber operations, including the Special Technology Center, Zorsecurity, and the Internet Research Agency.⁴ Any foreign person or government doing significant business with an entity on this list risks triggering U.S. sanctions on itself.

Trade lawyers call these secondary sanctions: penalties aimed not at the target country but at third parties anywhere in the world who continue doing business with it. Because virtually every major global bank and multinational needs access to the U.S. financial system, the practical pressure is enormous.⁵

The Sanctions the Government Can Impose

Section 235 gives the President a menu of twelve categories of penalties. For a Section 231 violation the President must select at least five. The categories cover:

Denial of Export-Import Bank support
Refusal of export licenses for goods and technology
A $10 million cap on U.S. bank lending in any 12-month period, with a carve-out for humanitarian relief
U.S. opposition to loans from the World Bank, IMF, and similar institutions
Restrictions on financial institutions serving as primary dealers in U.S. government debt or as repositories for federal funds
A ban on U.S. government procurement from the sanctioned person
Prohibitions on foreign exchange transactions and banking transfers within U.S. jurisdiction
Freezes on property and interests in property within U.S. jurisdiction
Visa bans and, at the President’s option, extension of any of the above to the entity’s principal officers personally

⁶

A person on OFAC’s Non-SDN Menu-Based Sanctions List faces only the specific combination selected for them, and those non-blocking sanctions do not automatically extend to their subsidiaries unless OFAC lists those subsidiaries separately.⁷

What Counts as a Significant Transaction

CAATSA does not set a dollar figure that automatically makes a transaction “significant.” The Secretary of the Treasury evaluates each case on the totality of the circumstances, weighing the size and frequency of the dealings, the nature and complexity of the goods or services, whether senior management or shareholders knew about the transaction, whether the parties used deception to conceal it, whether it undermines the sanctions program’s objectives, and whether it could escalate a conflict or destabilize a region.⁸ A pattern of smaller deals with the same sanctioned entity can cross the threshold even when no single one would.

The “knowingly” standard is broader than it sounds. Under the implementing regulations it covers both actual knowledge and situations where a person “should have known” about the relevant conduct.⁹ Willful blindness is not a defense. A company cannot protect itself by choosing not to look at whether its counterparties appear on sanctioned lists.

Waivers for Allied Governments

Because Section 231 sanctions are mandatory, the original statute gave the President almost no room to spare allies with longstanding defense relationships with Russia. The FY2019 National Defense Authorization Act added a modified waiver authority at 22 U.S.C. § 9525(d) to address that gap.³

To grant a waiver the President must certify in writing to Congress, at least 30 days in advance, that three conditions are met. The waiver has to serve U.S. national security interests. The transaction cannot involve any of the specifically named Russian intelligence entities and must not endanger a multilateral alliance, harm ongoing U.S. military operations, damage defense cooperation, or increase the risk of compromising American defense systems. And the government seeking the waiver must be reducing its reliance on Russian military equipment over time or cooperating with the United States on other critical security matters.

India’s purchase of the S-400 air defense system has been the most prominent test of the waiver authority; as of early 2026 the situation remains unresolved. Turkey, which bought the same system, did not receive a waiver.

Enforcement in Practice

The most visible use of Section 231 came on December 14, 2020, when the United States sanctioned Turkey’s Presidency of Defense Industries (SSB) for buying the S-400 from Rosoboronexport, Russia’s main arms exporter. The sanctions included a ban on U.S. export licenses to the SSB, an asset freeze on its president and other officers, and visa restrictions on those individuals.¹⁰ Turkey is a NATO ally, which made the designation significant: the mandatory nature of Section 231 overrode alliance considerations when no waiver was granted.

OFAC has continued adding designations under CAATSA authorities, with further Russia-related and cyber-related actions in 2025 and 2026.¹¹

What CAATSA Means for Businesses

For any company with international operations, CAATSA creates compliance obligations that go beyond running a name against a sanctions list. The “should have known” standard means that thin due diligence can be as dangerous as intentional evasion. OFAC has published a framework identifying five essential components of a compliance program: management commitment, risk assessment, internal controls, testing and auditing, and training.¹² The compliance failures OFAC has flagged most often involve companies that did not screen partners against updated lists, ran outdated software, or lacked clear escalation procedures when employees raised concerns.

Not every transaction with a targeted country is prohibited. OFAC maintains guidance permitting the sale of food, agricultural commodities, medicine, and medical devices to Iran by non-U.S. persons, subject to specific authorization for certain medical devices. The $10 million lending cap under Section 235 similarly exempts loans and credits that relieve human suffering.⁶ The core message of the law, though, is straightforward: doing business with Russia’s defense and intelligence sectors, Iran’s weapons programs, or North Korea’s economy now carries U.S. legal consequences that can follow a company regardless of where it is headquartered.

1
Congress.gov. Public Law 115-44 – Countering America’s Adversaries Through Sanctions Act
2
Office of the Law Revision Counsel. 22 USC 9241a – Rebuttable Presumption Applicable to Goods Made With North Korean Labor
3
Office of the Law Revision Counsel. 22 USC 9525 – Imposition of Sanctions With Respect to Persons Engaging in Transactions With the Intelligence or Defense Sectors of the Government of the Russian Federation
4
United States Department of State. CAATSA Section 231(e) Defense and Intelligence Sectors of the Government of the Russian Federation
5
U.S. Department of the Treasury. Russian Harmful Foreign Activities Sanctions
6
Office of the Law Revision Counsel. 22 USC 9529 – Sanctions Described
7
U.S. Department of the Treasury. FAQ 869
8
eCFR. 31 CFR 589.413 – Significant Transaction(s); Significant Financial Transaction(s)
9
U.S. Department of the Treasury. FAQ 545
10
U.S. Department of the Treasury. Introduction of the Non-SDN Menu-Based Sanctions (NS-MBS) List; CAATSA – Russia-related Designations
11
U.S. Department of the Treasury. Countering America’s Adversaries Through Sanctions Act-Related Sanctions
12
U.S. Department of the Treasury. OFAC Issues a Framework for Compliance Commitments