Sanctions Policies & Procedures Checklist

A sanctions policy is the written record of how your business stays on the right side of OFAC — it names who is responsible, defines what gets screened, and sets the rules for due diligence, recordkeeping, and escalation. Policies and procedures are the “internal controls” pillar of OFAC’s compliance framework: the part that turns intent into repeatable practice. A program that lives only in people’s heads cannot be trained, audited, or defended.

This checklist covers what belongs in the document and how to keep it from becoming shelfware.

Why written controls matter

In its 2019 Framework for OFAC Compliance Commitments, the Treasury’s Office of Foreign Assets Control lists internal controls as one of five essential components, alongside management commitment, risk assessment, testing and auditing, and training. Internal controls are where a risk assessment becomes action — written policies, procedures, and the screening and escalation steps employees follow every day. When OFAC evaluates a company after the fact, it looks at whether those controls existed and whether people actually used them.

What belongs in the policy

A workable sanctions policy is specific to how your business operates. At a minimum it should cover:

Scope and definitions — which entities, people, products, and destinations the policy reaches, and which sanctions programs apply to your trade lanes.
Ownership and accountability — the designated compliance officer, senior-management oversight, and who decides a close call.
Risk assessment — how exposure is identified and how often the assessment is refreshed.
Screening — when parties and transactions are screened, against which lists, and how potential matches are resolved.
Due diligence — the checks performed on customers, suppliers, and intermediaries before onboarding and at defined triggers.
Recordkeeping — what is kept, where, and for how long.
Escalation and reporting — how an employee raises a concern and how a possible violation mov