Which Services Are Subject to OFAC Regulations?

The services subject to OFAC regulations reach well beyond banking. Financial and payment processing, professional and consulting work, insurance, information technology and software, transportation and logistics, travel and hospitality, and real estate transactions all fall within the Office of Foreign Assets Control’s jurisdiction whenever they touch a sanctioned country, entity, vessel, aircraft, or person. OFAC currently administers more than a dozen active sanctions programs covering countries such as Iran, Russia, Cuba, North Korea, and Venezuela, along with issue-based programs targeting terrorism, narcotics trafficking, cyber threats, and weapons proliferation.¹ All U.S. citizens, permanent residents, and domestically organized entities must comply regardless of where they are located, and certain programs extend to foreign subsidiaries of U.S. companies as well.² Criminal penalties for willful violations reach up to 20 years in prison and a $1,000,000 fine.³

Financial and Payment Services

Banks, credit unions, and every institution that moves money through the U.S. financial system sit at the front of sanctions enforcement. Every transaction must be screened against the Specially Designated Nationals (SDN) list, which names individuals, companies, vessels, and aircraft whose assets must be frozen on contact.⁴ Wire transfers, deposit accounts, credit extensions, securities trading, custodial accounts, and asset management are all covered. Providing brokerage or portfolio services to anyone on the SDN list is flatly prohibited, and property in which a blocked person has an interest must be frozen immediately.⁵

Not every flagged payment gets the same treatment. When a transaction involves someone on the SDN list or a blocked government, the institution must freeze the funds in an interest-bearing account and hold them indefinitely. When a transaction is prohibited but no blocked person has an interest in it, the institution rejects the payment and returns it to the sender. A wire headed for a non-designated entity in Iran, for instance, gets rejected because processing it would violate the Iran embargo, even though the recipient isn’t personally blocked. Both blocking and rejection must be reported to OFAC within ten business days.⁶

Cryptocurrency exchanges, wallet providers, and digital payment processors carry the same obligations as traditional banks. OFAC has added specific digital currency wallet addresses to the SDN list, and providers must screen for those addresses just as a bank screens wires. Because listed addresses will never be exhaustive, providers also need to monitor for indicators that a wallet belongs to a blocked person and freeze the relevant assets if one is identified.⁷

Professional and Consulting Services

Knowledge-based services have become a major focus of recent enforcement, particularly under Executive Order 14071 targeting Russia. That order prohibits U.S. persons from providing an expanding list of services to anyone located in the Russian Federation. The initial prohibitions covered accounting, trust and corporate formation, and management consulting. Subsequent determinations added quantum computing, architecture, engineering, IT consultancy and design, cloud-based enterprise and manufacturing software services, and several categories of maritime services tied to Russian-origin crude oil and petroleum products.⁸

The scope is deliberately broad. A U.S.-based architect reviewing building plans for a Moscow client, or a consultant advising a Russian company on supply chain logistics, is engaged in a prohibited service even if no money passes through a U.S. bank. Firms need to know who the end user of their work is, not just who signed the engagement letter.

Legal Services

Legal work occupies a carve-out that trips up many firms. Certain categories are authorized without a specific license: advising a blocked person on U.S. legal compliance, representing them in U.S. court proceedings, and providing counsel where U.S. law requires access to an attorney at public expense. Routine tasks connected to those authorized services, such as filing court documents or hiring expert witnesses, are also permitted.⁹ Legal work outside those categories requires a specific OFAC license. Even when the services themselves are authorized, collecting payment from blocked funds requires separate authorization.

Insurance Services

Insurers, brokers, and underwriters are subject to OFAC rules in ways that override normal state insurance law. Federal sanctions authority under IEEPA and TWEA preempts state regulations, meaning an insurer cannot rely on state law to justify issuing a policy or paying a claim to a blocked person. If an applicant appears on the SDN list, the insurer cannot issue coverage. If a deposit accompanies the application, those funds must be frozen and reported to OFAC within ten business days.¹⁰

When an existing policyholder or beneficiary becomes blocked, the insurer must freeze the policy, route future premium payments into a blocked interest-bearing account at a U.S. financial institution, and report the action. Any claims payment under a blocked policy needs a specific OFAC license. For group policies such as travel insurance, the insurer may not learn that a covered person is blocked until a claim is filed, but must freeze that individual’s coverage and any associated property once it gains that knowledge.¹⁰

Information Technology and Software Services

Cloud computing platforms, web hosting, data processing, and software-as-a-service subscriptions all qualify as services that cannot be provided to blocked persons or into comprehensively sanctioned jurisdictions without authorization. Software updates and technical support count too. Providers typically use geofencing and identity verification to block access from sanctioned territories, but those controls are a starting point, not a safe harbor.

IT services also sit at the intersection of OFAC sanctions and the Department of Commerce’s Export Administration Regulations. Dual-use software with both commercial and military applications may require a BIS export license under the EAR even if OFAC has not specifically prohibited the transaction. Technology companies often need to clear two separate regulatory frameworks before serving a foreign customer, and the overlap is sharpest for encryption software, cybersecurity tools, and advanced manufacturing or design platforms.

The Russia program shows how quickly the picture shifts. IT consultancy, design services, cloud-based enterprise management software, and manufacturing software services were all added as prohibited categories under EO 14071 after the initial round of sanctions.⁸ A SaaS company that was legally serving Russian clients one month could find itself in violation the next.

Transportation, Shipping, and Logistics

Maritime shipping, air freight, courier services, and aircraft leasing all fall within OFAC’s scope. Every vessel and aircraft must be screened against the SDN list, which includes named ships and planes owned or controlled by sanctioned parties.⁴ Freight forwarders must verify that cargo is not headed to restricted ports, and bunkering companies must confirm that providing fuel or supplies to a vessel will not constitute servicing a blocked party.

OFAC has published detailed guidance identifying red-flag behaviors that logistics companies are expected to watch for. These include vessels that frequently change their flag registration to states known for servicing sanctioned tankers, ships with missing or manipulated automatic identification system data, and multiple ship-to-ship transfers within a single voyage that serve no legitimate commercial purpose. Transfers conducted at night, in unsafe waters, or near sanctioned terminals are also high-risk indicators.¹¹ A growing “shadow fleet” of older, poorly maintained tankers operating outside standard maritime oversight is a particular enforcement focus. Companies that ignore these signals when they were reasonably detectable face asset seizure and loss of export privileges.

Travel and Hospitality Services

Travel-related transactions are most heavily regulated under the Cuba sanctions program in 31 CFR Part 515.¹² General tourism to Cuba remains prohibited for U.S. persons. Travel is permitted only under one of twelve authorized categories, including family visits, journalistic activity, humanitarian projects, religious activities, educational activities, professional research, and support for the Cuban people.¹³ Travel agents and tour operators must confirm that every trip they arrange fits within one of these categories and keep records of the authorization relied upon.

The State Department publishes a Cuba Prohibited Accommodations List identifying specific properties where U.S. persons cannot lodge, pay for lodging, or make reservations. These are properties owned or controlled by the Cuban government or prohibited officials of the Cuban Communist Party.¹⁴ Hotels and hospitality providers serving U.S. customers must screen against this list in addition to standard SDN screening.

Real Estate Transactions

Real estate services are a frequently overlooked area of OFAC exposure. When a property owner is added to the SDN list, all dealings involving their real estate become prohibited, including sales, transfers, leasing, and foreclosure. OFAC has imposed multimillion-dollar penalties on parties who facilitated real estate transactions involving blocked persons. Title companies, escrow agents, real estate brokers, and property managers all bear compliance obligations. If you are involved in closing a transaction and one party has a blockable interest, the deal must stop and the property interest must be reported.

The Rules That Catch Service Providers by Surprise

Two rules pull service providers into OFAC’s reach even when they never deal with a listed name directly.

The first is facilitation. A U.S. person cannot approve, finance, facilitate, or guarantee a transaction by a foreign person if that transaction would be prohibited when performed directly by a U.S. person. You do not need to be a party to a sanctioned transaction to violate the rules. Arranging introductions, providing logistical support, or processing paperwork that lets a foreign company do business with a sanctioned party can all qualify. OFAC applies a counterfactual test: would this transaction be prohibited if a U.S. person were performing it directly? If yes, helping a foreign person do it is also prohibited. These rules are spelled out in IEEPA-based embargo programs such as the Iran sanctions, but OFAC treats them as implicit across all programs.¹⁵ Non-U.S. persons are also prohibited from engaging in conduct that evades U.S. sanctions or causing U.S. persons to violate them.

The second is the 50 percent rule. Any entity owned 50 percent or more by one or more blocked persons is itself treated as blocked, even if that entity does not appear on any published list by name.¹⁶ This catches shell companies and subsidiaries that sanctioned persons use to maintain access to the global economy. Service providers across every industry above need to look through corporate structures, not just screen surface-level client names.

What Is Not Covered: Informational Materials

Not everything is restricted. Under what is commonly called the Berman Amendment, codified at 50 U.S.C. § 1702(b)(3), the president’s sanctions authority does not extend to the import or export of informational materials. This covers publications, films, photographs, artwork, news wire feeds, recordings, and similar media regardless of format.¹⁷ The line runs between transmitting existing informational materials and creating new content as a commercial service for a sanctioned party. Publishing a book by an Iranian author is generally protected. Being hired by a sanctioned government to produce propaganda is not. The exemption also does not cover materials that are separately controlled for export under nonproliferation or antiterrorism rules.

Records, Reports, and Penalties

Full records of every OFAC-related transaction must be kept for at least ten years. OFAC extended this from the previous five-year window in a final rule effective March 21, 2025, aligning recordkeeping with the statute of limitations for sanctions violations.¹⁸ For blocked property, records must be maintained for the entire period the property remains frozen plus ten years after it is unblocked. Both blocked and rejected transactions must be reported to OFAC within ten business days.¹⁹

When a transaction would otherwise be prohibited, OFAC offers two forms of authorization. General licenses authorize broad categories of transactions for anyone who meets the conditions, with no application required. Specific licenses are written authorizations issued to a particular person in response to a formal application.²⁰ Every condition attached to either type of license must be followed exactly.

The statutory civil penalty under IEEPA is the greater of $250,000 or twice the value of the prohibited transaction. After the annual inflation adjustment effective January 2025, the per-violation cap stands at $377,700.²¹ For large transactions, the “twice the value” measure can dwarf that figure. Criminal penalties for willful violations reach up to $1,000,000 in fines and 20 years of imprisonment for individuals.³ Organizations with strong compliance programs, and those that voluntarily self-disclose violations before an investigation begins, can see meaningful reductions.

1
Office of Foreign Assets Control. Sanctions Programs and Country Information
2
Office of Foreign Assets Control. Who Must Comply With OFAC Sanctions
3
Office of the Law Revision Counsel. 50 USC 1705 – Penalties
4
Office of Foreign Assets Control. Sanctions List Service
5
U.S. Department of the Treasury. Specially Designated Nationals and the SDN List
6
U.S. Department of the Treasury. Blocking and Rejecting Transactions
7
Office of Foreign Assets Control. Questions on Virtual Currency
8
Office of Foreign Assets Control. FAQ 1128 – Services Prohibited Under EO 14071
9
eCFR. 31 CFR 589.506 – Provision of Certain Legal Services
10
U.S. Department of the Treasury. Compliance for the Insurance Industry
11
U.S. Department of the Treasury. Guidance for Shipping and Maritime Stakeholders on Detecting and Mitigating Iranian Oil Sanctions Evasion
12
eCFR. 31 CFR Part 515 – Cuban Assets Control Regulations
13
U.S. Department of the Treasury. General Travel Authorizations in the Cuba Program
14
U.S. Department of State. Cuba Prohibited Accommodations List
15
Office of Foreign Assets Control. OFAC Consolidated Frequently Asked Questions
16
Office of Foreign Assets Control. FAQ 398 – The 50 Percent Rule
17
Office of the Law Revision Counsel. 50 USC 1702 – Presidential Authorities
18
eCFR. 31 CFR 501.601 – Records and Recordkeeping Requirements
19
U.S. Department of the Treasury. Filing Reports With OFAC
20
Office of Foreign Assets Control. FAQ 74 – What Is a License
21
Federal Register. Inflation Adjustment of Civil Monetary Penalties