Who Is Required to Comply With OFAC? What 'All US Persons' Actually Means for Your Business

Who Has to Follow OFAC Rules?

Every "US person," and that term is broader than most business owners assume. Across OFAC's sanctions programs, a US person generally includes:

• US citizens and lawful permanent residents, anywhere in the world. A US citizen living and working abroad is still bound by OFAC rules; citizenship travels with the person, not the address.
• Anyone physically located inside the United States, regardless of citizenship or immigration status. A foreign national on a visa, running a business from a US office, is subject to OFAC while they're here.
• Entities organized under US law, meaning any corporation, LLC, partnership, or other entity formed in any US state or under federal law, including their branches operating overseas. A Delaware LLC does not shed OFAC obligations by opening a foreign branch office.

If your business is incorporated in the US, or you are a US citizen or permanent resident, or you are simply standing on US soil right now, OFAC's rules apply to you. There is no carve-out for small businesses or companies outside the financial sector. A one-person consulting shop and a multinational bank sit under the exact same jurisdictional umbrella.

Is Screening Actually Required by Law?

For most businesses outside the financial sector, no specific statute says "you must screen every customer against the SDN list." What the law actually prohibits is transacting with a blocked person: providing goods, services, or funds to someone on a sanctions list, or otherwise dealing in property in which a blocked person has an interest. Screening isn't the legal requirement; avoiding a prohibited transaction is.

But that distinction doesn't give you an out. Screening is the only realistic way to know, before you sign a contract or move money, whether the party on the other end is blocked. A business that never checks and unknowingly deals with a sanctioned party has still violated the prohibition, whether or not it screened. Skipping the check doesn't remove the obligation, it just removes your ability to know you're about to break it, which is why screening is a practical necessity even where no statute names it as a checkbox.

OFAC vs. BSA: Why "We're Not a Bank" Doesn't Help You

The single most common reason business owners assume OFAC doesn't apply to them is that they know they're not a bank. That instinct is drawing a real line, just the wrong one.

The Bank Secrecy Act's program requirements, a written AML program, a designated compliance officer, Suspicious Activity Report filing, apply only to entities meeting the statutory definition of a "financial institution": banks, credit unions, money services businesses, broker-dealers, casinos, and a defined list of others. If your business isn't on that list, you correctly have no BSA-mandated program.

OFAC is a separate body of law with a separate trigger. It doesn't run off an industry definition at all, it runs off "US person," full stop. A bakery, a landscaping company, a law firm, a manufacturer, and a bank are all equally bound by OFAC's prohibitions, even though only one of them has BSA obligations. Being outside BSA's financial institution definition tells you nothing about your OFAC status. See how BSA/AML and OFAC programs work together for the fuller mechanics of how these two regimes interact for businesses that carry both.

Strict Liability: "We Didn't Know" Is Not a Defense

OFAC civil violations are strict liability. OFAC does not have to prove you knew, intended, or were even reckless about who you were dealing with in order to find a violation. If you transacted with a blocked person, a violation occurred, regardless of your state of mind at the time.

Intent and knowledge still matter, just not to whether a violation happened, only to how large the penalty is. OFAC's enforcement guidelines set the base penalty according to whether the violation was voluntarily self-disclosed and whether the case is deemed "egregious," a determination that weighs factors like willfulness, awareness, and harm. Willful or egregious conduct pushes the penalty up substantially, and can open the door to criminal exposure. But "we had no idea" doesn't make the violation disappear; it's a mitigating fact for the penalty calculation, not a defense to liability. That's precisely why screening matters even without a statutory mandate: since ignorance doesn't prevent a violation, the only way to actually avoid one is to know in advance who you're dealing with.

Foreign Companies Aren't Automatically Off the Hook Either

Being organized outside the US doesn't guarantee you're outside OFAC's reach. Several common business activities create a US jurisdictional hook even for a company with no US incorporation:

• Clearing payments in US dollars. Dollar transactions typically clear through a US correspondent bank at some point, pulling that bank, and by extension the transaction, into US jurisdiction.
• Dealing in US-origin goods or technology. Products or technology that originated in the US can carry sanctions exposure downstream, even after leaving US hands.
• Employing US persons. A US citizen employee, anywhere in the company's operations, is bound by OFAC as an individual, which can implicate the employer.
• Having a US subsidiary, parent, or significant US ownership. Corporate structure alone can extend US jurisdiction into an otherwise foreign entity.

Beyond direct jurisdiction, certain sanctions programs (Russia, Iran, and North Korea being the prominent examples) carry secondary sanctions authority, letting OFAC penalize non-US persons for significant dealings with sanctioned parties even without a direct US nexus, typically by cutting the foreign company off from the US financial system. A foreign company assuming it's outside OFAC's reach simply because it has no US office is often wrong.

Who Actually Checks for Screening, Even Without a Statute Requiring It

Even though screening isn't spelled out as a standalone legal mandate for most businesses, plenty of parties expect to see it in practice, and they'll ask:

• Bank examiners. Regulators examining a bank routinely evaluate its customers and vendors for sanctions risk, pushing screening expectations down onto the businesses banks work with.
• State insurance departments. Market conduct exams for insurers and agencies increasingly probe for a documented screening process.
• HUD/FHA and the GSEs. Mortgage originators and servicers working with FHA-insured loans or selling to Fannie Mae and Freddie Mac operate under program requirements that expect sanctions screening as part of loan-level compliance.
• Card network rules. Visa, Mastercard, and other network operating rules require merchants and processors to have sanctions compliance measures in place as a condition of participation.

None of these is OFAC itself mandating screening by statute. They're downstream actors who've decided screening is the reasonable way to demonstrate you're not violating the underlying prohibition, and they'll hold you to it contractually or through examination even where the law is silent on the mechanism.

What Proportionate Compliance Looks Like

You don't need an enterprise compliance department to meet this standard. The right level of effort scales with your transaction volume and risk:

• Sole proprietors and low-volume businesses. Run a name through the free sanctions search at OFACScreen before signing a new contract or onboarding a client. Full results, no signup, all eight major lists (OFAC SDN, OFAC Non-SDN Consolidated, BIS Denied Persons, UN Consolidated, EU FSF, UK OFSI, Canada SEMA, and Swiss SECO). For a significant transaction, a real estate closing or a large contract, generate the one-time $9.99 audit-ready PDF report instead of a screenshot, so you have something dated and documented if anyone asks.
• Higher-volume or recurring counterparties. A subscription plan with batch screening and API access makes more sense once you're checking dozens or hundreds of names, or need screening wired directly into a signup or onboarding flow rather than run manually. See the OFAC compliance checklist for small businesses for a fuller proportionate-program framework.

What's at Stake If You Skip It

Penalty severity scales with willfulness: OFAC's enforcement guidelines treat a company with no compliance program at all more harshly than one that made a documented good-faith effort and still missed a match. But the statutory maximum civil penalty per violation runs into six figures (the greater of a set inflation-adjusted cap or twice the value of the transaction), and each transaction with a blocked party can count as a separate violation. Willful violations add criminal exposure on top. For the full penalty structure and how voluntary self-disclosure affects the outcome, see OFAC penalties and enforcement.

The size of your business has no bearing on any of this. A sole proprietor and a regional bank face the same prohibition, the same strict-liability standard, and the same per-violation exposure. The only thing that scales with size is how much compliance effort is reasonable to expect, not whether the rule applies at all.