What Is OFAC? A Complete Guide

What Is OFAC?

The Office of Foreign Assets Control, known as OFAC, is part of the U.S. Department of the Treasury. Its job is to administer and enforce economic and trade sanctions that support US foreign policy and national security objectives. If you do business in the United States, OFAC's rules apply to you.

What Does OFAC Actually Do?

OFAC maintains several lists of individuals, companies, and countries that US persons are prohibited from doing business with. The most well-known is the Specially Designated Nationals and Blocked Persons List (the SDN List). OFAC also manages country-based sanctions programs targeting nations like Iran, North Korea, Cuba, Syria, and Russia, among others.

When OFAC identifies a threat, it can freeze assets under US jurisdiction and prohibit transactions with designated parties. These designations carry the force of law, and violating them can result in serious penalties.

Who Must Comply with OFAC?

The short answer: virtually every US person and business. OFAC regulations apply to all US citizens, permanent residents, entities organized under US law, and anyone physically located in the United States. This includes:

• Banks and credit unions
• Insurance companies
• Auto dealerships
• Mortgage lenders and title companies
• FinTech and payment companies
• Real estate firms
• Any business that processes payments or maintains customer relationships

There is a common misconception that OFAC compliance is only for large banks. That is not the case. OFAC has pursued enforcement actions against businesses of all sizes, including small companies that assumed the rules did not apply to them.

What Are the Penalties?

OFAC penalties are steep. Civil penalties can reach over $300,000 per violation, and in some cases much higher depending on the sanctions program involved. Criminal penalties can include fines up to $1 million and prison time of up to 20 years. OFAC operates under a strict liability standard, which means you can be penalized even if the violation was unintentional.

The agency publishes enforcement actions on its website, and the list includes businesses that had no idea they were dealing with a sanctioned party. Ignorance is not a defense.

How to Stay Compliant

Building an OFAC compliance program does not have to be complicated, but it does require intentional effort. Here are the basics:

1. Screen your customers and counterparties. Run names against the SDN List and other OFAC lists before onboarding new customers and on an ongoing basis.
2. Designate a compliance officer. Someone in your organization should own OFAC compliance, even if it is not their only role.
3. Document everything. Keep records of your screening activity, your policies, and any matches you investigate.
4. Train your staff. Employees who interact with customers need to understand the basics of OFAC and know what to do if a potential match comes up.
5. Use screening software. Manual screening against OFAC lists is slow, error-prone, and hard to document. Automated screening tools like OFACScreen make the process faster and more reliable.

OFAC compliance is not optional, and the cost of getting it wrong is high. The good news is that for most businesses, a straightforward screening process and some basic policies are enough to stay on the right side of the law.