OFAC Publishes New Introductory Guide to US Sanctions: Who Must Comply and How
The US Office of Foreign Assets Control (OFAC) has published a new introductory guide explaining how its sanctions programmes operate and what is required to comply with them.
The guide addresses the following key areas:
Types of sanctions. OFAC administers five categories: list-based, government or regime-based, broad jurisdiction-based, sectoral, and secondary sanctions.
Who must comply. The obligations apply to all US citizens and permanent residents, all individuals and entities physically located in the United States, and all US-incorporated entities including their foreign branches. Certain non-US persons may also fall within scope — notably foreign entities owned or controlled by US persons.
How to comply. OFAC recommends building a risk-based compliance programme structured around five components: management commitment, risk assessment, internal controls, testing and auditing, and training.
Sanctions screening. Organisations are expected to screen customers, counterparties, and transactions against OFAC lists. Where a potential match is identified, the organisation must determine whether to block, reject, or proceed with the transaction.
Reporting. Blocked property must be reported to OFAC within 10 business days. Annual reports of all blocked property are due by 30 September each year.
Recordkeeping. All relevant records must be retained for 10 years from the date of the transaction, or 10 years from the date the property is unblocked.
The guide addresses the following key areas:
Types of sanctions. OFAC administers five categories: list-based, government or regime-based, broad jurisdiction-based, sectoral, and secondary sanctions.
Who must comply. The obligations apply to all US citizens and permanent residents, all individuals and entities physically located in the United States, and all US-incorporated entities including their foreign branches. Certain non-US persons may also fall within scope — notably foreign entities owned or controlled by US persons.
How to comply. OFAC recommends building a risk-based compliance programme structured around five components: management commitment, risk assessment, internal controls, testing and auditing, and training.
Sanctions screening. Organisations are expected to screen customers, counterparties, and transactions against OFAC lists. Where a potential match is identified, the organisation must determine whether to block, reject, or proceed with the transaction.
Reporting. Blocked property must be reported to OFAC within 10 business days. Annual reports of all blocked property are due by 30 September each year.
Recordkeeping. All relevant records must be retained for 10 years from the date of the transaction, or 10 years from the date the property is unblocked.
- Penalties. OFAC applies a strict liability standard. As of 15 January 2025, the maximum civil penalty per breach of IEEPA stood at $377,700. Voluntary self-disclosure may reduce a proposed penalty by up to 50%.
