What Is OFAC and Why Does It Matter for Your Business?
OFAC stands for the Office of Foreign Assets Control. It sits inside the US Department of the Treasury and runs the country's economic sanctions programs. Its job is to cut off the flow of money to sanctioned governments, terrorist organizations, narcotics traffickers, and weapons proliferators.
If that sounds like it only applies to big banks, it doesn't. OFAC regulations are broad, and enforcement doesn't care how large your company is.
Who Has to Comply?
Every "US person." That includes:
- US citizens and permanent residents, anywhere in the world
- Any entity organized under US law, including foreign branches
- Anyone physically present in the US
In practice, that covers banks, credit unions, insurance companies, fintechs, payment processors, auto dealers, mortgage lenders, real estate brokerages, casinos, crypto exchanges, and any other business that deals with customers or counterparties.
The SDN List
OFAC's main tool is the Specially Designated Nationals and Blocked Persons List (the SDN list). It contains thousands of individuals, companies, vessels, and aircraft. If someone is on the SDN list, US persons must block their assets and cannot do business with them.
The list gets updated frequently. New names can appear multiple times per week, which is why one-time screening at customer onboarding is not enough.
Penalties
OFAC can impose a civil penalty of up to the greater of twice the value of the underlying transaction or a statutory base of $250,000 per violation. That base is adjusted for inflation every year, so the effective cap only climbs, and it currently sits above $375,000 per violation. Look up the current adjusted figure rather than trusting a number quoted in an article. Criminal penalties for willful violations are set by 50 U.S.C. 1705: a fine of up to $1,000,000 and, for a natural person, imprisonment for up to 20 years.
These are strict liability violations. "I didn't know they were on the list" is not a defense. OFAC expects you to have a screening process in place.
What Compliance Looks Like
At a minimum, compliance means screening the parties to a transaction against the SDN list and other relevant sanctions lists before the transaction goes through. Automated screening catches name variations that manual checks miss, and it gives you the audit trail that examiners want to see.
If you don't have a screening process yet, start with the basics: screen every new customer, re-screen periodically, and keep records of every check.