What Is OFAC Compliance? Obligations, Licenses, and Penalties

OFAC compliance is the obligation to follow the economic and trade sanctions administered by the U.S. Treasury’s Office of Foreign Assets Control: screening customers and transactions against government sanctions lists, blocking or rejecting prohibited dealings, reporting them, and keeping records. It applies to every U.S. person, from individuals to global banks, and getting it wrong can bring civil penalties above $377,000 per violation and criminal fines up to $1,000,000 with prison time up to 20 years.1Office of Foreign Assets Control. Civil Penalties and Enforcement Information

Who Has to Comply

OFAC’s regulations apply to all “U.S. persons.” That term covers any U.S. citizen, any lawful permanent resident, any entity organized under U.S. law (including foreign branches of U.S. companies), and any person physically located in the United States.2eCFR. 31 CFR 562.311 – United States Person; U.S. Person A foreign national working temporarily in the U.S. is a U.S. person while here.

The reach doesn’t stop at the border. Some sanctions programs require foreign entities owned or controlled by U.S. persons to comply. Others reach foreign persons who possess U.S.-origin goods or technology.3U.S. Department of Justice. Obligations of Foreign-Based Persons to Comply With US Sanctions A U.S. parent, a U.S.-sourced input, or a U.S. person touching the transaction can pull a foreign-headquartered company into OFAC’s jurisdiction.

OFAC runs two broad categories of programs. Comprehensive sanctions restrict nearly all transactions with entire jurisdictions; as of 2025, that list includes Cuba, Iran, North Korea, Russia, and the Crimea, Donetsk, and Luhansk regions of Ukraine. Targeted sanctions focus on named individuals, entities, or economic sectors regardless of where they sit.

What You’re Screening Against

The core list is the Specially Designated Nationals and Blocked Persons List, usually called the SDN List. Individuals and entities on this list have their property blocked, and U.S. persons generally cannot do business with them at all.1Office of Foreign Assets Control. Civil Penalties and Enforcement Information

OFAC also maintains a Non-SDN Consolidated Sanctions List that bundles several narrower lists. One is the Sectoral Sanctions Identifications (SSI) List, which limits specific kinds of transactions (such as new debt or equity dealings) with named participants in parts of the Russian economy rather than cutting them off entirely.4Office of Foreign Assets Control. Additional Sanctions Lists Other sublists cover foreign sanctions evaders, foreign financial institutions subject to correspondent account restrictions, and entities tied to Chinese military companies.

The 50 Percent Rule

An entity does not have to appear on the SDN List to be treated as blocked. Under OFAC’s 50 Percent Rule, any entity owned 50 percent or more, directly or indirectly, by one or more blocked persons is itself blocked by operation of law. Ownership stakes of different blocked persons are added together, even across different sanctions programs. If two SDNs each hold 25 percent of a company, that company is blocked, though neither owner has a majority stake.5Office of Foreign Assets Control. Entities Owned by Blocked Persons (50% Rule) Searching the SDN List alone is not enough. You need to understand ownership structures behind the parties you deal with.

The Core Obligations

Screen Before You Transact

Every organization subject to OFAC rules has to screen its customers, counterparties, and transactions against the sanctions lists. OFAC offers a free online Sanctions List Search tool that uses fuzzy logic matching against both the SDN and the Non-SDN Consolidated lists.6Office of Foreign Assets Control. Sanctions List Search Tool Fuzzy matching matters because sanctioned parties transliterate names differently and use aliases. Larger institutions typically integrate commercial screening software into onboarding and payment systems, but the principle is unchanged: check before you move value.

Block or Reject

When a hit comes up, the next question is whether the transaction must be blocked or rejected. It turns on whether a blocked person holds an interest in the property or funds. If yes, the funds or property must be frozen in place. If the transaction is prohibited but no blocked person has a direct interest, it must be rejected and returned to the originator.7Office of Foreign Assets Control. Blocking and Rejecting Transactions

A wire heading to a bank wholly owned by a sanctioned government has to be blocked, because that government has a direct interest in the funds. A payment between two non-sanctioned companies for goods destined to a comprehensively sanctioned country has to be rejected, because processing it would facilitate prohibited trade even though no blocked person owns the funds.

Report Within 10 Business Days

Both blocked and rejected transactions must be reported to OFAC within 10 business days. For blocked property, the clock starts the day the property becomes blocked; for rejected transactions, the day of rejection.8eCFR. 31 CFR 501.603 – Reports of Blocked, Unblocked, or Transferred Blocked Property9eCFR. 31 CFR 501.604 – Reports of Rejected Transactions On top of that, any U.S. person holding blocked property has to file an annual report covering property held as of June 30, due by September 30. Reports go through OFAC’s online Reporting System.

Keep the Records

Anyone engaged in a transaction subject to OFAC regulations must retain complete records for at least 10 years from the transaction date. For blocked property, records have to be kept the entire time the property remains blocked, plus at least 10 years after it is unblocked.10eCFR. 31 CFR 501.601 – Records and Recordkeeping Requirements

Building a Compliance Program OFAC Will Credit

OFAC’s Framework for Compliance Commitments identifies five components it expects in a sanctions compliance program:11Office of Foreign Assets Control. A Framework for OFAC Compliance Commitments

  • Management commitment, meaning senior leadership allocates real resources and sets a tone that treats compliance as a priority rather than a paperwork exercise.
  • Risk assessment covering the organization’s specific exposure through its customer base, products, services, and geographic footprint.
  • Internal controls: written policies and procedures for screening, escalation, and handling blocked or rejected transactions.
  • Testing and auditing by an independent function, with scope and frequency scaled to the risk profile of each business area.
  • Training so employees who touch onboarding, payments, or trade operations know their responsibilities and how to escalate.

The framework is not itself a regulation, but OFAC explicitly weighs program adequacy when it decides enforcement actions. A well-documented, working program can be the difference between a cautionary letter and a six-figure penalty.

When You Need a License

Some otherwise-prohibited activity can be authorized. OFAC issues two kinds of licenses.12U.S. Department of the Treasury, Office of Foreign Assets Control. OFAC Licenses

A general license authorizes an entire category of transactions for a class of persons, with no application required. Certain humanitarian dealings with comprehensively sanctioned countries fall under general licenses. If your activity fits squarely inside one, you can proceed, but you have to follow every condition attached to it.

A specific license is a written authorization issued to a particular applicant. You apply through OFAC’s online Licensing Portal, either as a registered user or a guest, and receive a case ID to track status. Processing times vary and no timeline is guaranteed, so if you expect to need one, apply well ahead of any transaction deadline.

If Something Goes Wrong: Voluntary Self-Disclosure

An organization that discovers a possible violation can choose to report itself. OFAC treats a qualifying voluntary self-disclosure as a mitigating factor and, where a civil penalty is warranted, can reduce the base penalty by 50 percent.13U.S. Department of the Treasury, Office of Foreign Assets Control. OFAC Disclosure Form Home

To qualify, the initial disclosure has to be truthful and detailed enough for OFAC to understand what happened, and it must be followed within a reasonable time by a complete report of the circumstances. A disclosure that is materially incomplete or contains misleading information does not qualify and can make matters worse. The organization is also expected to respond to follow-up inquiries.

Even without a self-disclosure, substantial cooperation with the investigation typically cuts the base penalty by 25 to 40 percent, and a first-time violation (no penalty notice or Finding of Violation in the preceding five years) can earn a further reduction of up to 25 percent.14Federal Register. Economic Sanctions Enforcement Guidelines

Penalties

Civil

Maximum civil penalties depend on the underlying statute and are adjusted each year for inflation. As of January 2025:

  • Programs authorized under the International Emergency Economic Powers Act (IEEPA), which cover most sanctions programs: $377,700 per violation or twice the transaction value, whichever is greater.
  • Programs under the Trading with the Enemy Act (Cuba): $111,308 per violation or twice the transaction value, whichever is greater.
  • Foreign Narcotics Kingpin Designation Act: $1,876,699 per violation.
  • Antiterrorism and Effective Death Penalty Act: $99,703 per violation.
  • Clean Diamond Trade Act: $17,062 per violation.

These figures reflect OFAC’s January 2025 inflation adjustment and are subject to further annual increases.15Foreign Assets Control Office. Inflation Adjustment of Civil Monetary Penalties Each prohibited transaction can count as a separate violation, so a pattern stacks up quickly.

Criminal

Willful violations carry criminal exposure. Under IEEPA and TWEA, a person convicted of willfully violating the sanctions faces a fine of up to $1,000,000, and natural persons can be imprisoned for up to 20 years.16Office of the Law Revision Counsel. 50 USC 1705 – Penalties17Office of the Law Revision Counsel. 50 USC 4315 – Offenses; Punishment; Forfeitures “Willfully” carries weight in these statutes. A processing error that slips through a screening system is not the same as deliberately routing payments through shell companies to evade sanctions, and the Department of Justice reserves criminal prosecution for that second category.

How OFAC Sets the Number

OFAC does not mechanically impose the maximum. Its published Enforcement Guidelines identify factors that raise or lower the penalty:14Federal Register. Economic Sanctions Enforcement Guidelines

  • Willfulness or recklessness. Deliberate evasion, concealment, or a pattern of conduct pushes the penalty up sharply.
  • Awareness. Whether the organization had actual knowledge or reason to know about the sanctions issue.
  • Harm to program objectives. How much economic benefit reached the sanctioned party and how much damage was done to U.S. policy goals.
  • Commercial sophistication. A multinational bank is held to a higher standard than a small exporter meeting sanctions for the first time.
  • Quality of the compliance program at the time of the violation. A genuine, resourced program mitigates; a paper program that no one follows does not.
  • Remedial response. Steps taken after discovering the violation, including internal reviews for similar problems, weigh in the organization’s favor.
  • Cooperation and self-disclosure, on the terms described above.
  • Timing. A violation occurring shortly after a new SDN designation or regulatory change may be treated less harshly than one involving a long-standing prohibition.

Monetary penalties are not the whole cost. Banks and counterparties track OFAC enforcement actions closely, and a company that appears on OFAC’s published penalty list often finds its correspondent banking and trade finance options narrowing.