INTERNATIONAL TRADE LAW
How to Build a Sanctions Compliance Program
A sanctions compliance program (SCP) is a documented set of policies, controls, and training that keeps your company from doing business with parties the U.S. government has blocked. The Office of Foreign Assets Control (OFAC) enforces U.S. economic sanctions on a strict-liability basis — you can be penalized for a prohibited transaction even if you never knew the other side was sanctioned. A real program is the difference between a defensible mistake and an indefensible one. This guide builds one around the five components OFAC itself uses to judge them.
Watch — Elements of a Sanctions Compliance Program:
Why a program matters: strict liability
OFAC administers sanctions under the International Emergency Economic Powers Act (IEEPA) and related authorities, and it can impose civil penalties without proving you intended to break the law. The statutory maximum civil penalty is the greater of an inflation-adjusted cap (raised each year) or twice the value of the transaction, per violation — and a single shipment can generate many violations. Good faith does not excuse the violation; it only helps reduce the penalty once OFAC is already calculating one.
That strict-liability standard is why a program is worth building before anything goes wrong. When OFAC weighs an enforcement action, the presence — or absence — of an effective compliance program is one of the factors it considers in setting the penalty.
The five components OFAC expects
OFAC’s 2019 Framework for OFAC Compliance Commitments sets out five components that every compliance program should contain. They are the backbone of this article and the rest of this series.
| Component | What it means in practice |
|---|---|
| Management commitment | Senior leaders fund the program, appoint a compliance owner, and back that person’s authority |
| Risk assessment | You routinely map where your customers, products, and geographies expose you to sanctions risk |
| Internal controls | Written policies and screening that prevent, detect, and escalate prohibited dealings |
| Testing and auditing | Independent checks confirm the controls actually work, and findings get fixed |
| Training | The people who touch transactions understand the rules and their own obligations |
The Framework is a starting point, not a ceiling. A program tailored to your actual risk is what holds up — a generic binder no one follows does not.
Component 1 — Management commitment
Sanctions compliance starts at the top. Leadership has to commit real resources, name a qualified compliance officer, give that person direct access to senior management, and make clear that compliance can stop a deal. A program that exists only on paper, with no budget and no authority, is the pattern OFAC repeatedly identifies in its enforcement actions.
Component 2 — Risk assessment
A risk assessment identifies where sanctions exposure actually lives in your business. Look at who your customers and counterparties are, where they sit, what you sell, and how money and goods move. The point is to right-size everything that follows — heavier controls where the risk is real, lighter where it is not. We cover this in depth in sanctions risk assessment.
Component 3 — Internal controls
Internal controls are the policies, procedures, and screening that turn your risk assessment into day-to-day practice. The core control is screening counterparties against OFAC’s Specially Designated Nationals (SDN) List and Consolidated Sanctions List — and accounting for the 50 Percent Rule, under which any entity owned 50% or more (in aggregate) by blocked persons is itself blocked, even though it never appears on a list. Build screening into onboarding and into ongoing monitoring, document every decision, and define how a potential match gets escalated and resolved. See sanctions screening for clients and partners for the mechanics.
Component 4 — Testing and auditing
Testing and auditing confirm the controls work. An independent review — internal audit or an outside specialist — checks whether screening is catching what it should, whether records are complete, and whether staff follow the procedures. Benchmarking your program against recognized standards is one way to find the gaps before a regulator does.
Component 5 — Training
Training puts the rules in front of the people who act on them — sales, operations, finance, logistics, and leadership. It should be role-specific, repeated on a set cadence, and documented so you can prove it happened. See sanctions compliance training for how to structure and record it.
Recordkeeping and self-disclosure
Two rules sit alongside the five components. First, recordkeeping: OFAC now requires records of sanctions-relevant transactions to be kept for ten years — extended from five, effective March 12, 2025 — to match the ten-year statute of limitations for sanctions violations. Second, voluntary self-disclosure: if you do find a violation, reporting it to OFAC before they find it is a recognized mitigating factor that can substantially cut the base penalty under OFAC’s Economic Sanctions Enforcement Guidelines.
Frequently asked questions
Is a sanctions compliance program legally required?
No statute orders every company to maintain a formal SCP, but OFAC’s strict-liability enforcement and its published Framework make one effectively mandatory for any business with international exposure. The absence of a program is treated as an aggravating factor when OFAC sets a penalty.
Who needs an OFAC compliance program?
Any U.S. person, and many non-U.S. businesses with U.S. touchpoints — exporters, importers, banks, and companies with foreign customers, suppliers, or investors. Sanctions reach far beyond banks.
What is the 50 Percent Rule?
An entity owned 50% or more, directly or indirectly and in aggregate, by one or more blocked persons is itself blocked — even though OFAC does not separately list it. You have to analyze ownership, not just match names against a list.
How long do we have to keep records?
Ten years for records relating to transactions subject to OFAC regulations, as of the March 2025 rule change. The longer window aligns with the extended statute of limitations for sanctions violations.
A sanctions compliance program is far cheaper to build than a penalty is to pay — but only if it is tailored to your real risk and actually followed. Reidel Law Firm builds and reviews sanctions and export-compliance programs for U.S. exporters and importers on a flat fee, with a plain-English memo and direct attorney access: get a flat-fee compliance memo to start.
