What Is OFAC and Why Does It Matter for Your Business?
OFAC stands for the Office of Foreign Assets Control. It sits inside the US Department of the Treasury and runs the country's economic sanctions programs. Its job is to cut off the flow of money to sanctioned governments, terrorist organizations, narcotics traffickers, and weapons proliferators.
If that sounds like it only applies to big banks, it doesn't. OFAC regulations are broad, and enforcement doesn't care how large your company is.
Who Has to Comply?
Every "US person." That includes:
- US citizens and permanent residents, anywhere in the world
- Any entity organized under US law, including foreign branches
- Anyone physically present in the US
In practice, that covers banks, credit unions, insurance companies, fintechs, payment processors, auto dealers, mortgage lenders, real estate brokerages, casinos, crypto exchanges, and any other business that deals with customers or counterparties.
The SDN List
OFAC's main tool is the Specially Designated Nationals and Blocked Persons List (the SDN list). It contains thousands of individuals, companies, vessels, and aircraft. If someone is on the SDN list, US persons must block their assets and cannot do business with them.
The list gets updated frequently. New names can appear multiple times per week, which is why one-time screening at customer onboarding is not enough.
Penalties
OFAC can impose civil penalties up to $356,579 per violation (adjusted for inflation annually) or twice the transaction value, whichever is greater. Criminal penalties for willful violations go up to $20 million and 30 years in prison.
These are strict liability violations. "I didn't know they were on the list" is not a defense. OFAC expects you to have a screening process in place.
What Compliance Looks Like
At a minimum, compliance means screening the parties to a transaction against the SDN list and other relevant sanctions lists before the transaction goes through. Automated screening catches name variations that manual checks miss, and it gives you the audit trail that examiners want to see.
If you don't have a screening process yet, start with the basics: screen every new customer, re-screen periodically, and keep records of every check.