Office Of Foreign Assets Control

Overview

The Office of Foreign Assets Control (OFAC) is the U.S. Department of the Treasury's financial intelligence and enforcement agency responsible for administering and enforcing all U.S. economic sanctions programs. OFAC's mandate directly impacts every dollar moved through the US financial system: all payments must be screened against OFAC's Specially Designated Nationals (SDN) List and other sanctions lists, with blocking and rejection of transactions involving sanctioned parties mandatory.

Operating under authorities granted by the Trading with the Enemy Act (1917) and the International Emergency Economic Powers Act (1977), OFAC maintains comprehensive embargoes against six countries (Cuba, Iran, North Korea, Russia, Syria (transitioning), and Venezuela) and administers over 30 targeted and sectoral sanctions programs worldwide. The SDN List alone contains over 17,000 entries, updated multiple times daily.

For payments professionals, OFAC represents the highest-impact Layer 1 sovereign regulator: compliance is non-negotiable, violations carry civil penalties up to $307,922 per offense, and the statute of limitations has been extended to 10 years under recent legislation.

Basic Identity

Classification

Inclusion Justification

What This Entity Oversees

2. OFAC's Sanctions Programs & Lists

2.1 Active Sanctions Programs

OFAC administers over 30 active sanctions programs, organized by geography, threat category, and legal authority:

Comprehensive Country Embargoes

Status Note (2026): Syria sanctions underwent significant transition in mid-2025 following the fall of the Assad regime. The US moved to recalibrate its approach; EO 14312 revoked previous executive orders, signaling potential normalization process. This represents the most significant OFAC program change in recent years.

Targeted Sanctions Programs

• Terrorism Sanctions Programs — Designations under Executive Order 13224 and related authorities; targets terrorist organizations and individuals financing terrorism.
• Narcotics Trafficking Program — Foreign Narcotics Kingpin Designation Act; targets international drug trafficking organizations and kingpins.
• Weapons of Mass Destruction (WMD) Program — Proliferation-related sanctions targeting non-state actors and entities involved in WMD programs.
• Cyber-Related Sanctions Program — Targets nations and entities engaged in significant malicious cyber activities.
• Human Rights Abusers — Sanctions against foreign officials and entities engaged in human rights violations.
• Sectoral Sanctions Programs — Russia (energy, financial sectors); Iran (petroleum, banking, shipping); targeted restrictions on specific economic sectors.

2.2 The Specially Designated Nationals (SDN) List

The SDN List is OFAC's primary enforcement tool — a consolidated database of individuals, entities, vessels, and aircraft designated as targets of US sanctions.

Current Size and Scope:

• 17,000+ entries as of 2026
• Continuously updated — multiple updates issued daily
• Publicly searchable and downloadable
• Covers individuals and entities from dozens of countries and multiple sanctions programs

List Entry Categories:

• Named individuals (terrorists, narcotics traffickers, regime officials, human rights abusers)
• Corporate entities and subsidiaries
• Government agencies and state-owned enterprises
• Vessels and aircraft
• Special designations (Islamic Revolutionary Guard Corps (IRGC) organizations, aliases)

Screening Implications:

Any transaction involving a named SDN or entity in which an SDN has an interest is automatically prohibited unless licensed by OFAC. Payment systems must screen against the SDN List at transaction initiation.

2.3 Additional Sanctions Lists

Beyond the SDN List, OFAC maintains:

• Sectoral Sanctions Identifications List (SSI List) — Entities targeted under sectoral rather than comprehensive sanctions; transactions may be blocked on sectoral basis.
• Foreign Sanctions Evaders List (FSE List) — Non-US persons subject to sanctions evasion designations.
• Non-SDN Consolidated Sanctions List — Entities subject to sanctions restrictions but not formally designated as SDNs.

2.4 Sanctions List Infrastructure & Modernization

Sanctions List Service (SLS) — Launched May 6, 2024, SLS is OFAC's cloud-based platform providing:

• Real-time, multiple daily updates to all sanctions lists
• Complete data download in machine-readable formats
• Integration APIs for financial institutions
• Mobile-friendly access

Sanctions List Search Tool — sanctionssearch.ofac.treas.gov — Public-facing tool employing fuzzy logic name matching to identify potential SDN matches. Useful for initial screening; positive matches should be escalated to OFAC for verification.

Regulatory Requirement: All U.S. persons must screen customers and transactions; financial institutions required to maintain policies for timely list updates and dissemination across operations.

3. Compliance Requirements for Payments

3.1 Core Payment Screening Mandate

OFAC's foundational requirement: All U.S. financial institutions and payment processors must screen every transaction against OFAC lists and block/reject transactions involving sanctioned parties.

This applies to:

• Wire transfers (domestic and international)
• Correspondent banking relationships
• Letters of credit and trade finance
• ACH payments
• Card networks and payment processors
• Digital and cryptocurrency transactions
• Nostro account transactions

3.2 Payment Compliance Program Requirements

Financial institutions must establish written OFAC compliance programs that include:

Program Elements (31 CFR 501.603)

1. Risk Identification & Assessment — Determine OFAC risk profile based on customer base, product mix, and transaction types.
2. Customer Screening Procedures — Screen all new customers against SDN List before account opening; ongoing screening of existing customers.
3. Transaction Monitoring — Implement systems (manual or automated) to screen transactions for:

• Sanctioned parties (SDN List matches)
• Sanctioned jurisdictions
• Red-flag indicators (unusual payment patterns, third-party involvement, structuring)

1. Independent Testing & Audit — Conduct testing of compliance program effectiveness; retain testing documentation for regulatory examination.
2. Designation of Responsible Officers — Assign OFAC compliance responsibility to named individual(s); establish audit trail of designations.
3. Staff Training — Provide OFAC sanctions training to relevant personnel; document training attendance and completion.
4. List Update Policies — Establish procedures for obtaining updated SDN List; distribute to all operating units; document deployment.
5. Record Retention — Maintain transaction records, screening results, and compliance documentation for minimum 5 years.

Software Requirement: While no federal regulation mandates automated screening software, OFAC guidance clarifies there is "no legal requirement to use software," but acknowledges reality that transaction volume makes manual screening infeasible. De facto industry standard is automated transaction screening with human override capability.

3.3 Specific Payment Controls

Pre-Transaction Screening

• Initiated party matching — Screen payment initiator (originator) against SDN List
• Beneficiary party matching — Screen payment beneficiary (recipient) against SDN List
• Beneficial owner screening — Identify ultimate beneficial owners of parties; screen against SDN List
• Correspondent bank screening — For international payments, screen correspondent banks

Transaction Blocking Rules

• Automatic blocking — Any transaction matching SDN List entry must be blocked immediately
• Reject procedures — Blocked transactions rejected with notice to originating party
• Reporting requirement — Block/reject transactions reported via OFAC Reporting System (ORS)

Wire Transfer Blocking

• Mandatory blocking — Wire transfers to/from SDN parties or sanctioned jurisdictions are prohibited
• Sanctions program matching — Russia sanctions, Iran sanctions, Cuba sanctions, etc. may have program-specific rules
• Beneficial ownership verification — Payment systems must verify beneficial ownership to prevent circumvention

Correspondent Banking Rules

• Respondent bank screening — Verify correspondent banks have no SDN connections
• Correspondent relationship agreements — OFAC FAQs recommend written policies on correspondent relationships
• Overline and limit monitoring — Screen against credit limits when correspondent banks reach exposure thresholds

3.4 Limitations on Software Requirement

OFAC FAQ 65 explicitly states: "There is no legal or regulatory requirement to use software or to scan. There is a requirement not to violate the law, but the method by which compliance with that requirement is achieved is left to the compliance officer."

Practical Reality: Given SDN List size (17,000+ entries, updated multiple times daily) and transaction volume in US financial system, automated screening is effectively mandatory for any institution with significant payment volume.

6. Payment Relevance & Financial Institution Impact

6.1 Payment Criticality Assessment

OFAC Payments Relevance: CRITICAL (10/10)

Every payment transaction through the US financial system is subject to OFAC screening. OFAC's authority directly impacts:

• Payment initiation — Every wire transfer, ACH, card transaction must be screened pre-settlement
• Payment blocking — US banks must block transactions to/from sanctioned parties
• Payment settlement — Transactions blocked cannot settle; originating party notified
• Compliance cost — Financial institutions invest hundreds of millions in OFAC screening infrastructure

6.2 Financial Institution Obligations

Mandatory Compliance Programs:

• All US banks and non-bank financial institutions must maintain written OFAC compliance programs
• Federal banking regulators (OCC, Federal Reserve, FDIC) examine OFAC compliance as part of routine supervision
• Failure to maintain adequate programs triggers enforcement by banking regulators and OFAC

Payment Operations Obligations:

• Pre-transaction screening (SDN List matching)
• Customer due diligence (identify beneficial owners)
• Transaction monitoring (rules-based and anomaly detection)
• Block/reject reporting (via OFAC Reporting System)
• Record retention (5 years minimum)

Third-Party Screening Requirements:

• Correspondent banks must be screened
• Clearing and settlement agents must be verified as compliant
• Software vendors and screening providers must be evaluated

6.3 Payment Blocking & Rejection Procedures

Automatic Transaction Blocking:

Transactions matching SDN List entries are automatically blocked by payment systems. Originating party receives notice of block/rejection with:

• Transaction details
• OFAC reference number
• Reason for block (SDN name match)
• Instructions for appealing block or requesting delisting

Block/Reject Reporting:

• Mandatory reporting of all blocks/rejects to OFAC via OFAC Reporting System (ORS)
• Reporting timeline: Within 10 days of transaction block/rejection (as of August 8, 2024 regulatory update)
• Report includes transaction details, matched SDN, screening methodology

Financial Institution Liability:

• Failed to block transaction with SDN: Civil penalty exposure
• Continued violations: Criminal prosecution risk + banking regulator enforcement
• Pattern of violations: Enhanced penalties under enforcement guidelines

7. Regulatory Modernization & Technology

7.1 Recent Modernization Initiatives

Reporting, Procedures and Penalties Regulations (2024 Amendment)

• Effective Date: August 8, 2024
• Changes: Clarified reporting requirements; made OFAC Reporting System (ORS) mandatory for block/reject filings
• Impact: Standardized reporting format; real-time visibility into US financial system blocking activity
• Technology: Migrated to cloud-based reporting; eliminated legacy paper-based processes

Sanctions List Service (SLS) Launch (May 6, 2024)

• Cloud-based platform replacing legacy download-based distribution
• Real-time list updates (multiple times daily)
• Machine-readable data formats (JSON, XML, CSV)
• Integration APIs for financial institution systems
• Public and authenticated access tiers

Licensing Portal Modernization

• Online application system for specific licenses
• Real-time status tracking
• Document upload and management
• Reduced processing delays

7.2 Technology Infrastructure Assessment

OFAC's Technology Posture:

• Cloud Migration: SLS platform represents move to modern, scalable infrastructure
• API-First: Licensing and list distribution increasingly API-based
• Real-Time Updates: SDN List updated multiple times daily vs. legacy quarterly distribution
• Data Integration: APIs enable financial institution integration with OFAC data

Compliance Technology Adoption:

• Automated screening tools standard across major US banks
• Machine learning and anomaly detection increasingly deployed
• Third-party compliance platforms (Thomson Reuters, Actinver, LexisNexis, etc.) provide screening services
• Blockchain/crypto sector implementing custom OFAC screening (nascent)

11. Historical Context & Regulatory Evolution

Timeline of OFAC Development

Regulatory Framework Evolution

Early Era (1950-1975): OFAC administered limited TWEA-based Cuba embargo; minimal regulatory infrastructure.

Modern Era (1977-2000): IEEPA enacted; OFAC expanded authority; formal regulations codified; comprehensive programs on Iran, Cuba established.

Post-9/11 Era (2001-2013): Dramatic expansion of terrorism sanctions and targeted programs; CFT (Combating Terrorism Financing) emerged as major function.

Ukraine/Sanctions Innovation Era (2014-Present): Sectoral sanctions model developed; non-traditional targets (technology, cryptocurrency); increased enforcement; regulatory modernization ongoing.

12. Conclusion: OFAC as Critical Payment Regulator

OFAC represents the highest-impact Layer 1 sovereign regulator in the payments domain. Its authority — derived from 1917 legislation but modernized through 1977 IEEPA and continual Executive Orders — extends to every dollar moved through the US financial system.

Key Takeaways for Payments Professionals:

1. Mandatory Compliance — OFAC screening is not optional; all US persons and financial institutions must comply.
2. Transaction Blocking — Any payment involving a sanctioned party (SDN or under sectoral sanctions) must be blocked; blocking procedures are mandatory.
3. Regulatory Modernization — OFAC's shift to cloud-based infrastructure (SLS, ORS) and real-time list updates requires continuous systems investment from payment providers.
4. Enforcement Escalation — Recent enforcement focus on fintech/crypto and secondary sanctions suggests broader expansion of OFAC's enforcement reach.
5. Extended Liability — 10-year statute of limitations (extended 2024) increases long-tail exposure for past violations.
6. Licensing Pathway — Specific licenses available for exceptional transactions; general licenses provide humanitarian exceptions; compliance with licensing procedures reduces enforcement risk.

For payments infrastructure serving US persons, OFAC compliance is non-negotiable infrastructure requirement. Every payment system must implement pre-transaction SDN screening, maintain compliance documentation, and stay current with list updates.

Regulatory Powers

5.1 Civil Enforcement (Primary)

OFAC's principal enforcement mechanism is civil monetary penalties under Section 206 of IEEPA and Section 5(b) of TWEA.

Penalty Amounts (2024 Adjusted)

Inflation Adjustment: Penalties adjusted annually pursuant to Federal Civil Penalties Inflation Adjustment Act of 1990.

Enforcement Process

1. Violation Detection — OFAC reviews facts and circumstances surrounding apparent violation
2. Pre-Penalty Notice (PPN) — If OFAC determines violation occurred, issues written notice detailing alleged violation, proposed penalty, and opportunity to respond
3. Response Period — Respondent has 30+ days to submit written response, settlement proposals, or mitigating circumstances
4. Settlement Negotiation — OFAC may negotiate settlement, reduced penalties, or compliance measures
5. Final Notice — OFAC issues final determination and penalty order (or settlement agreement)
6. Payment & Compliance — Respondent pays penalty and implements remedial compliance measures

Factors in Penalty Determination

Per Appendix A to 31 CFR Part 501, OFAC considers:

• Severity of violation — Prohibited transactions vs. administrative violations
• Culpability — Negligent vs. intentional vs. reckless conduct
• Pattern of behavior — First violation vs. repeat offender
• Harm caused — Impact on sanctions policy; whether actual transaction occurred
• Compliance program — Presence or absence of written procedures
• Remedial actions — Corrective measures implemented post-violation
• Financial hardship — Ability to pay (rarely dispositive)

5.2 Criminal Enforcement (Secondary)

The Department of Justice pursues criminal prosecution of willful OFAC violations:

• Criminal Authority — Section 206 of IEEPA (criminal provisions); criminal penalties under TWEA
• Elements — Willful violation of OFAC restrictions; scienter required (knowing, reckless, or negligent conduct)
• Penalties — Imprisonment up to 20 years; fines up to $1 million (individual) or $5 million (entity)
• Statute of Limitations — 10 years (extended from 5 years by 21st Century Peace through Strength Act)

Enforcement Partnership: OFAC and DOJ coordinate; DOJ typically prosecutes egregious, intentional violations or cases involving material support to terrorism/WMD.

5.3 2024 Enforcement Summary

Public Enforcement Actions (2024):

• Actions Issued: 12 public enforcement actions
• Civil Penalties Assessed: $48.8 million
• Comparison: 2023 (17 actions, $1.5B); 2022 (12 actions, similar magnitude)

Program Focus:

• Iran sanctions violations: 50% of 2024 actions (6 cases)
• Sectoral sanctions: HDPE resin transshipment, equipment sales
• Non-US entities: Majority of settled parties were foreign companies

Notable 2024 Cases:

5.4 Emerging Enforcement Trends

Focus Areas (2024-2025):

• Non-traditional sectors — Technology companies, fintech, cryptocurrency exchanges (previously outside OFAC enforcement spotlight)
• Secondary sanctions — Violations by non-US parties dealing with US persons/entities
• Russia enforcement escalation — Continued emphasis on Russian sanctions evasion
• Beneficial ownership concealment — Penalties for structuring transactions to obscure sanctioned party involvement

Regulatory Role and Function

Legal Foundation

1.1 Foundational Legal Authority

OFAC derives its authority from multiple statutory sources:

• Trading with the Enemy Act (TWEA), 1917 (50 U.S.C. § 4301 et seq.) — The original grant of presidential authority to regulate trade in wartime; remains primary authority for OFAC's most comprehensive sanctions programs, particularly Cuba.
• International Emergency Economic Powers Act (IEEPA), 1977 (50 U.S.C. § 1701 et seq.) — Enacted to limit and modernize the President's emergency powers, IEEPA allows the President to declare a national emergency in response to "any unusual and extraordinary threat" to the US with sources outside the US. Authorizes regulated international commerce, asset freezes, and comprehensive financial controls.
• Executive Order Authorities — Presidents issue Executive Orders declaring national emergencies and establishing specific sanctions programs under TWEA and IEEPA authority. These orders form the immediate regulatory basis for individual sanctions programs.
• Supporting Legislation — Foreign Narcotics Kingpin Designation Act, Anti-Terrorism and Effective Death Penalty Act, and other targeted statutes expand OFAC's authority over terrorism financing, narcotics trafficking, and WMD proliferation.

1.2 Regulatory Codification

OFAC's implementing regulations are codified in 31 CFR Chapter V, the comprehensive regulatory framework governing all OFAC programs:

• 31 CFR Part 501 — Reporting, Procedures and Penalties Regulations — General rules applicable across all programs; establishes civil penalty framework, filing requirements, and procedural rules. Amended effective August 8, 2024.
• 31 CFR Parts 586-598 — Program-specific regulations for Cuba, Iran, Russia, North Korea, Terrorism Sanctions, and other programs. Each program has tailored restrictions and licensing provisions.
• Appendix A to Part 501 — Economic Sanctions Enforcement Guidelines — Establishes factors OFAC considers when determining whether to initiate enforcement and appropriate penalty amounts.

Statute of Limitations: Section 3111 of the 21st Century Peace through Strength Act (2024) extended the statute of limitations for civil and criminal violations of IEEPA and TWEA from 5 years to 10 years.

1.3 Scope of Regulatory Jurisdiction

OFAC's jurisdiction is global and comprehensive. It applies to:

• All U.S. persons — US citizens, permanent residents, entities incorporated in the US, and US branches/subsidiaries of foreign entities, regardless of where they are located.
• All persons and entities within US territory — Individuals and firms operating within US geographic borders.
• All transactions through US financial system — Wire transfers, letters of credit, payments, investments, and trade finance involving US banks or clearing systems.
• Transactions outside the US by US persons — Overseas subsidiaries and branches of US entities must comply.
• Foreign persons dealing with US persons — Non-US parties transacting with US entities must ensure transactions comply with OFAC restrictions.

Licensing and Authorization Relevance

4.1 General Licenses

OFAC issues General Licenses as blanket authorizations for classes of transactions that would otherwise be prohibited.

Key Characteristics:

• Pre-authorized for all U.S. persons meeting specified criteria
• No application required; self-executing
• Listed in relevant program regulations (31 CFR Parts 586-598)
• Often used for humanitarian exceptions

Common General License Categories:

Policy: OFAC's policy is not to grant specific licenses where a general license exists. If a general license covers the transaction, the specific license path is not available.

4.2 Specific Licenses

Specific Licenses are written authorizations issued by OFAC to a particular person for a particular transaction.

Application Process:

• Online Portal — OFAC License Application Page
• Required Information — Detailed transaction structure, parties involved, business justification, SDN status verification
• Review Timeline — Varies by program complexity and staff availability; typically 3-60 days
• Approval Standard — OFAC must find transaction consistent with foreign policy and national security objectives

Common Specific License Uses:

• Transactions with countries under comprehensive embargo requiring exception
• Wind-down of business relationships with SDNs (time-limited)
• Humanitarian projects in sanctioned jurisdictions
• Trade and investment in sectoral sanctions environments

4.3 Deemed Authorization & Regulatory Exemptions

Certain transactions are exempt from OFAC restrictions by statute or regulation:

• Personal remittances under specific statutory authority
• Unblocking of humanitarian resources (medical supplies, humanitarian aid)
• Certain informational materials (newspapers, books, educational content)

Payments and Money Movement Relevance

The ============================================================================ has the following relevance to payments and money movement in US:

Payment Systems Governed or Overseen

The ============================================================================ does not directly operate payment systems. Its payment-related role includes:

Money transmitters, payment processors, and fintech companies operating in this jurisdiction require licensing or registration with this entity.

Relationship to Other Regulators

8.1 Interagency Coordination

OFAC operates within a multi-agency sanctions enforcement framework:

8.2 International Coordination

OFAC coordinates sanctions implementation with:

• UN Sanctions Committees — Alignment with UN Security Council sanctions resolutions
• G7 Coordination — Joint sanctions on Russia, North Korea, others
• EU Sanctions Regime — Parallel or coordinated sanctions with European Union
• Bilateral Relationships — Intelligence sharing with allied nations' sanctions authorities

Geography and Jurisdiction Notes

Important Departments and Divisions

Key Public Resources

9.1 OFAC Guidance Documents

OFAC publishes comprehensive guidance on specific programs and compliance issues:

• FAQ Library — OFAC Frequently Asked Questions organized by topic (17 major categories)
• Program-Specific Guidance — Detailed guidance for Iran, Cuba, Russia, North Korea, and other programs
• Interpretive Guidance — Authoritative OFAC positions on compliance questions
• Advisory Notices — Notices to financial institutions on emerging compliance issues
• Public Statements — OFAC Director statements on enforcement priorities

9.2 Regulatory Resources

• Official Website: ofac.treasury.gov
• Licensing Portal: OFAC License Application Page
• Sanctions List Search: sanctionssearch.ofac.treas.gov
• Sanctions List Service: SLS Platform
• Legal Library: 31 CFR Chapter V and related regulations

9.3 Compliance Best Practices

Recommended Compliance Practices:

1. Establish written OFAC compliance policies documenting procedures
2. Implement automated transaction screening with human review capability
3. Conduct regular independent testing of compliance program (minimum annual)
4. Maintain detailed documentation of customer identification and beneficial ownership
5. Subscribe to OFAC alert services and list updates
6. Train relevant staff on sanctions compliance (minimum annual)
7. Monitor OFAC FAQ updates and enforcement actions for emerging issues
8. Maintain block/reject documentation for regulatory examination
9. Establish SDN matching threshold and escalation procedures
10. Coordinate OFAC compliance with AML/CFT compliance programs

Primary Contact Points

Official Website

https://ofac.treasury.gov

Main portal for all OFAC information; includes:

• SDN List and downloadable lists
• Program regulations (31 CFR)
• Licensing applications
• FAQ library
• Enforcement actions
• News and updates

Notes on Naming and Language