INTERNATIONAL TRADE LAW
OFAC Sanctions Compliance: What Businesses Must Do
OFAC sanctions compliance means making sure your company never deals — directly or indirectly — with a person, entity, or country the U.S. has placed off-limits, and keeping records that prove it. OFAC is the Treasury Department’s Office of Foreign Assets Control, and it enforces U.S. economic sanctions on a strict-liability basis: you can be penalized even if you never meant to break the rules. This guide explains what OFAC enforces, who has to comply, and how to build a program that holds up.
What OFAC Is and What It Enforces
OFAC administers and enforces U.S. economic and trade sanctions to advance national security and foreign policy. It works mainly through two statutes — the International Emergency Economic Powers Act (IEEPA) and the older Trading with the Enemy Act (TWEA) — plus statutes written for specific programs. The agency traces back to 1950, but its reach has grown to cover terrorism, narcotics, weapons proliferation, human rights abuses, and dozens of country and regional programs.
In practice, OFAC’s rules turn into three things you have to watch:
- The SDN List. The Specially Designated Nationals and Blocked Persons List names individuals, companies, vessels, and aircraft that U.S. persons generally cannot transact with. Their property must be “blocked” (frozen) if it comes into your control.
- Comprehensive country and regional programs. A handful of jurisdictions are subject to near-total embargoes, so most transactions need a license. As of mid-2026 those are Cuba, Iran, North Korea, and the Crimea, Donetsk, and Luhansk regions of Ukraine. This set changes — the comprehensive Syria program, for example, was terminated in 2025 — so always confirm a country’s current status on OFAC’s Sanctions Programs and Country Information page before you rely on it.
- Activity-based and list-based programs. Many sanctions target conduct (terrorism finance, ransomware, narcotics) rather than a whole country, which is why screening matters even for ordinary commercial deals.
Who Must Comply
OFAC’s rules bind all “U.S. persons,” and that category is broader than most people assume.
| Who | Covered? |
|---|---|
| U.S. citizens and permanent residents | Yes — anywhere in the world |
| Anyone (any nationality) physically in the U.S. | Yes |
| Companies formed in the U.S. and their foreign branches | Yes |
| Foreign subsidiaries of U.S. companies | For certain programs (e.g., Cuba, Iran) |
| Non-U.S. companies clearing U.S. dollars or handling U.S.-origin goods | Often — through the transaction’s U.S. nexus |
If you are unsure whether the rules reach your business at all, start with our companion guide on whether OFAC applies to your company.
The 50 Percent Rule
A name does not have to appear on the SDN List for a deal to be prohibited. Under OFAC’s 50 Percent Rule, any entity owned 50% or more — directly or indirectly, and in the aggregate — by one or more blocked persons is itself blocked, even though OFAC never lists it by name. Ownership is added together across blocked persons and across programs. That is why screening a counterparty’s name alone is not enough; you also have to understand who owns it.
Building a Compliance Program
In 2019 OFAC published A Framework for OFAC Compliance Commitments, which lays out the five components OFAC looks for when it evaluates a program — including when it decides a penalty.
| Component | What it means |
|---|---|
| Management commitment | Senior leaders fund the program, name a compliance owner, and back enforcement |
| Risk assessment | You map exposure across customers, products, countries, and supply chain |
| Internal controls | Written policies, screening, escalation, and recordkeeping that catch problems |
| Testing and auditing | Independent review confirms the controls actually work |
| Training | Relevant staff understand the rules and how to flag red flags |
The right-sized program is risk-based: a domestic retailer and a global freight forwarder need very different controls. For the build-out details, see how to comply with OFAC regulations, and to size your own exposure, how to conduct a sanctions risk assessment.
What Non-Compliance Costs
OFAC civil penalties operate on strict liability — no intent required. The maximum civil penalty under IEEPA is the greater of roughly $377,700 per violation (a figure OFAC adjusts annually for inflation) or twice the value of the underlying transaction. Willful violations can be prosecuted criminally, carrying fines up to $1 million and up to 20 years in prison per violation.
Two 2024–2025 changes raised the stakes for documentation: the statute of limitations for civil and criminal sanctions violations doubled to ten years, and OFAC’s recordkeeping requirement likewise extended to ten years. Keep your screening hits, licenses, and decisions for a decade.
Frequently Asked Questions
Does OFAC compliance only matter for banks? No. Banks face the heaviest screening duties, but the prohibitions apply to every U.S. person — manufacturers, exporters, importers, software firms, and nonprofits included.
Is checking the SDN List enough? No. Because of the 50 Percent Rule and activity-based programs, you also need beneficial-ownership diligence and, for many deals, counterparty screening that goes beyond a name match.
What if a blocked party’s payment lands in my account? You generally must block (freeze) the funds and report the blocking to OFAC, typically within 10 business days. Do not return the money without checking your obligations.
Can I still do business with a sanctioned country? Sometimes — but only under a general or specific OFAC license that authorizes the activity.
Sanctions exposure is one of the most expensive risks in international trade, and it turns on facts specific to your customers, products, and routes. Reidel Law Firm delivers a flat-fee import/export compliance memo that maps your OFAC exposure and gives you a clear, written plan. Get an export compliance memo →
