OFAC Enforcement Trends: What Compliance Teams Should Watch
OFAC's enforcement activity has kept climbing, and the settlements it publishes are the clearest signal of what it actually cares about. A few patterns run through the cases it has announced in recent years. The figures and dates below come from OFAC's own enforcement releases; anything published since is at ofac.treasury.gov/civil-penalties-and-enforcement-information.
Smaller Companies, Bigger Penalties
OFAC used to focus enforcement primarily on large financial institutions. That's changed. Recent actions have targeted payment processors, fintechs, and companies with fewer than 100 employees. The penalty amounts haven't scaled down with the company size, either. A small business can face six-figure penalties just as easily as a large bank.
The takeaway: "we're too small for OFAC to care about" is not a safe assumption.
Crypto Enforcement Is Real
OFAC has added cryptocurrency wallet addresses to the SDN list and has brought enforcement actions against exchanges that processed transactions involving sanctioned persons. If your business touches crypto in any way, you need a sanctions screening process that covers it.
Voluntary Self-Disclosure Gets Rewarded
OFAC's enforcement guidelines give significant credit for voluntary self-disclosure (VSD). Companies that discover a potential violation and self-report it to OFAC receive substantially reduced penalties compared to those that get caught. In some cases, OFAC has issued "no action" letters for self-disclosed violations by companies with otherwise strong compliance programs.
This only works if you have the monitoring and detection capabilities to discover violations in the first place. You can't self-disclose what you don't know about.
Russia Sanctions Keep Getting More Complex
The Russia-related sanctions programs have expanded significantly since 2022. The Sectoral Sanctions Identifications (SSI) list has grown, and the 50% rule (where entities owned 50% or more by a sanctioned party are themselves sanctioned even if not listed) makes screening harder. A name might not appear on any list but still be sanctioned by ownership.
For businesses with any Russian exposure, this means screening alone isn't enough. You also need to understand ownership structures.
Recent Settlements Worth Reading
Three cases from OFAC's own enforcement releases show the range:
- Adani Enterprises Limited, 18 May 2026, $275,000,000. Thirty-two apparent violations of the Iran sanctions. The India-based company bought liquefied petroleum gas from a Dubai trader that presented the cargo as Omani and Iraqi; OFAC found that red flags should have put it on notice the gas was Iranian, and the purchases caused US financial institutions to process the payments.
- IMG Academy, LLC, 12 February 2026, $1,720,000. Eighty-nine apparent violations of the counternarcotics sanctions. Between 2019 and 2025 the academy signed yearly tuition agreements with two SDNs tied to a Mexico-based cartel and processed their payments. A sports academy, not a bank.
- FTI Consulting, Inc., 1 June 2026, $1,050,000. Six occasions of indirectly dealing in prohibited debt of VTB Bank OAO, a Russian state-owned bank on the Sectoral Sanctions Identifications List, between April 2019 and May 2021. OFAC recorded the conduct as non-egregious and not voluntarily self-disclosed, which is the combination that costs a company the self-disclosure discount.
Note what these have in common: a consulting firm, a sports academy, and a commodities buyer. None of them is a bank.
What To Do About It
- Screen against all relevant lists, not just the SDN list. The Non-SDN, SSI, and international lists carry their own obligations.
- Monitor continuously. One-time screening at onboarding does not protect you when lists get updated weekly.
- Keep audit trails. If you do face an enforcement inquiry, documented screening records are the single most important thing you can show OFAC.
- Have a self-disclosure plan. Know who at your company is responsible for reporting potential violations and what the process looks like.