Office of Foreign Assets Control OFAC

For any transaction, the questions are which sanctions program applies, who the parties to the transaction are, and what the program prohibits.

The Specially Designated Nationals List

OFAC publishes the List of Specially Designated Nationals and Blocked Persons, usually called the SDN List. OFAC's materials describe the effect of appearing on it as follows: property and interests in property of the listed persons are blocked if they are within U.S. jurisdiction.

Two ideas should be kept apart. The SDN List is a list of names, and blocking is the legal consequence. A match on the list raises a further question, which is whether the firm holds property or interests in property that are blocked. The next sections explain what that means.

What Blocking Means

OFAC's frequently asked questions define the term. They state that blocking refers to freezing assets or other property, and that blocking immediately imposes an across-the-board prohibition against transfers or dealings of any kind with regard to the property.

The same answer describes what the word property includes. It includes financial property such as money, checks, savings accounts, stocks, bonds, debt and any other financial instruments. It also includes real, tangible and intangible assets such as goods, merchandise, ships, land contracts and real estate, along with any other property or interests in property, whether present, future or contingent. For a broker-dealer, the reference to stocks, bonds and other financial instruments is the part that connects directly to customer accounts.

Blocking does not move ownership. OFAC states that title to blocked property remains with the blocked person, but the exercise of powers and privileges normally associated with ownership is prohibited without authorization from OFAC. In other words, the owner is still the owner, but the owner cannot deal with the property, and neither can the firm holding it, unless OFAC authorizes it.

OFAC also states a reporting duty. Blocked property must be reported to OFAC within ten business days of the property becoming blocked.

Who Must Comply

OFAC's answer to this question is broad. It states that all U.S. persons must comply with OFAC sanctions, including all U.S. citizens and permanent residents regardless of where they are located, all individuals and entities within the United States, and all U.S. incorporated entities and their foreign branches.

The answer adds two further points. It states that, in the case of certain programs, foreign subsidiaries owned or controlled by U.S. persons also must comply. It also addresses people who are not U.S. persons, stating that they can face consequences for causing or conspiring to cause U.S. persons to violate U.S. sanctions, and for engaging in conduct that evades U.S. sanctions. The terms used, such as U.S. person, are defined in the implementing regulations, and OFAC notes that the definitions vary by program.

Location does not remove the obligation. A U.S. citizen who works abroad is still covered, and a U.S. incorporated firm's foreign branch is still covered.

Lists Beyond the SDN List

The SDN List is the best-known list, but OFAC's frequently asked questions explain that it is not the only one. OFAC publishes the SDN List and other sanctions lists, and some of these lists do not call for blocking. A reader who sees a name on a list should therefore find out which list it is and what the relevant program requires.

OFAC's materials also state that some persons are blocked even when they do not appear on the SDN List. The categories OFAC describes include most Cuban nationals, blocked foreign governments, and entities that meet the 50 Percent Rule.

The 50 Percent Rule

The 50 Percent Rule means that an entity owned fifty percent or more in the aggregate by one or more blocked persons is itself blocked, even if the entity does not appear on the SDN List. OFAC's guidance states the rule in these terms: any entity owned in the aggregate, directly or indirectly, fifty percent or more by one or more blocked persons is itself considered to be a blocked person, and its property is blocked regardless of whether the entity itself is listed.

The rule has three features.

The first is aggregation. OFAC's example is that if Blocked Person X owns twenty-five percent of Entity A and Blocked Person Y owns another twenty-five percent of Entity A, then Entity A is blocked, because the two blocked persons together own fifty percent. OFAC also states that the ownership interests of persons blocked under different sanctions programs are aggregated for this purpose.

The second is indirect ownership. OFAC states that indirect ownership means ownership through another entity or entities that are themselves fifty percent or more owned by blocked persons. A chain of companies does not break the rule when each link in the chain is owned fifty percent or more by blocked persons.

The third is the limit of the rule. The test is about ownership. OFAC's guidance recommends that U.S. persons exercise caution when considering a transaction with a non-blocked entity in which one or more blocked persons has a significant ownership interest that is less than fifty percent, or which one or more blocked persons may control by means other than a majority ownership interest. The rule itself does not block those entities, but OFAC recommends caution toward them.

An Illustration

An illustration shows the aggregation. Suppose two blocked persons each own twenty-five percent of a company that does not appear on any list, and nobody else owns more than a small fraction. Under OFAC's stated example, the company would be blocked, even though no single blocked person owns half of it. Suppose instead that one blocked person owns forty percent and nobody else on the SDN List owns any of the company. On OFAC's stated test, the company would not be blocked by that ownership, although OFAC's recommendation of caution toward significant ownership interests below fifty percent would still be relevant. This illustration is simplified and does not describe any actual company. Whether a particular entity is blocked depends on the facts and on the applicable sanctions program.

Licenses and Exemptions

A sanctions prohibition is not always absolute. OFAC's frequently asked questions define an OFAC license as an authorization from OFAC to engage in transactions that otherwise would be prohibited by U.S. sanctions administered by OFAC.

OFAC describes two kinds. A general license permits certain categories of transactions that would otherwise be prohibited under a particular sanctions program. General licenses are publicly available and self-executing, which means that no further approval from OFAC is needed if the conditions of the license are met. A specific license is a non-public document that OFAC issues to a particular individual or entity, authorizing a particular transaction in response to a license application. OFAC states that anyone relying on either kind of license must comply with all of its terms, including conditions and any recordkeeping and reporting requirements. For applying for a specific license, OFAC refers readers to 31 CFR 501.801 and to its licensing pages.

OFAC's frequently asked questions also describe exemptions. They give examples of transaction types that may be exempt, including personal communications, humanitarian donations, information or informational materials, and travel. They state that most OFAC sanctions programs have certain exceptions, but that exceptions vary in type and scope across programs.

A firm must identify the sanctions program that applies and then check what that program permits. A general license has terms, an exemption has limits, and both vary from program to program, so one program's exceptions do not carry over to another.

OFAC and Securities Firms

OFAC has issued guidance directed at securities and futures firms. The guidance carries the date November 5, 2008. It states that all U.S. persons, including securities and futures firms such as investment advisers, broker-dealers and futures commission merchants, must comply with OFAC's regulations. It also states that firms should establish and maintain an effective OFAC compliance program, and that OFAC's regulations apply to all property and interests in property of a sanctions target that are within the possession or control of a U.S. person.

The guidance covers account opening. It states that a firm should screen a new client's identification information against the SDN List and against the applicable OFAC sanctions programs. It states that a new customer's identity should be verified before the account is opened, or within a reasonable time period after account opening. And it states that firms should maintain adequate documentation about the results of their screening in order to illustrate their efforts to comply with OFAC regulations.

Delegating Compliance

The guidance also addresses outsourcing. It states that OFAC does not generally permit businesses to reallocate their legal liability to a third party, and that if a business delegates its OFAC compliance responsibilities to others, it and the third parties could be held liable for any OFAC violations that occur.

Reporting Blocked Property and Rejected Transactions

OFAC's regulations contain reporting duties. Two of them are distinct from each other.

The first concerns blocked property. Under 31 CFR 501.603, any U.S. person, including a financial institution, holding, unblocking or transferring property blocked under OFAC's regulations must submit the relevant reports. The regulation provides that reports shall be filed within ten business days from the date that property becomes blocked. It also provides for an annual report. A report on all blocked property held as of June 30 of the current year must be filed annually by September 30. The initial report must include the name, address and contact information of the holder, a description of the transaction and its participants, the sanctions targets and their interest in the property, a description and location of the property including account numbers, the date of blocking, the value of the property in U.S. dollars, the actions taken regarding the property, the legal authority for the blocking, and copies of related documentation such as payment instructions.

The second concerns rejected transactions. A rejected transaction is not the same thing as blocked property. Under 31 CFR 501.604, a rejected transaction is a transaction that is not blocked under OFAC's regulations, but where processing or engaging in the transaction would nonetheless violate a provision of those regulations. The regulation applies to any U.S. person, including a financial institution, that rejects such a transaction. It provides that the term transaction includes wire transfers, trade finance, transactions related to securities, checks, foreign exchange, and sales or purchases of goods or services. Reports must be filed within ten business days of the rejected transaction. The report must include the name and address of the person that rejected the transaction, a description of the transaction and its parties, the sanctions targets whose involvement caused the rejection, the date of rejection, the value of the property, the legal authorities, and copies of related instructions and documents.

The difference between the two is the status of the property. Blocked property is frozen and held, and the holder reports on it, including in the annual report. A rejected transaction is one that the person declines to process, and the person reports the rejection. Both reports carry a ten business day deadline in the regulations.

Recordkeeping

OFAC's regulations also require records. Under 31 CFR 501.601, every person engaging in any transaction subject to OFAC's regulations must keep a full and accurate record of each such transaction. The records must be available for examination for at least ten years after the date of the transaction. For a person holding blocked property, the regulation provides that the records must be available for examination for the period of time that the property is blocked and for at least ten years after the date the property is unblocked.

OFAC, FinCEN and FINRA Compared

Three different bodies appear in this area, and they should not be confused.

OFAC administers and enforces sanctions. Its subject is who may and may not be dealt with, and what must be done with blocked property.

FinCEN is another Treasury bureau. Its subject is financial intelligence and the reporting and compliance duties under the Bank Secrecy Act, such as the suspicious activity report and the customer identification program.

FINRA is a self-regulatory organization for broker-dealers, and its Rule 3310 requires member firms to have an anti-money laundering program. FINRA's anti-money laundering page includes a link to OFAC's reporting system for blocked and rejected transactions and lists OFAC among its related links. In February 2022 FINRA published a sanctions alert on Russia-related sanctions. The alert states that OFAC prohibited U.S. persons from engaging in transactions with certain Russian financial entities and added others to the SDN List, it encourages member firms to continue to monitor OFAC's website for relevant information, and it refers to Regulatory Notice 22-06. FINRA does not administer OFAC's sanctions programs. The obligation to comply with OFAC's regulations comes from OFAC's sanctions regulations.

Customer identification information is relevant to both, but the sources of the duties are different. The customer identification program comes from FinCEN's regulation, and sanctions screening comes from OFAC's.

Sanctions Compliance Programs

OFAC has published a document called A Framework for OFAC Compliance Commitments. It states that OFAC strongly encourages organizations subject to U.S. jurisdiction, as well as foreign entities that conduct business in or with the United States, U.S. persons, or using U.S.-origin goods or services, to employ a risk-based approach to sanctions compliance by developing, implementing, and routinely updating a sanctions compliance program.

The framework names five components: management commitment, risk assessment, internal controls, testing and auditing, and training.

Management commitment. OFAC states that senior management's commitment to, and support of, an organization's risk-based sanctions compliance program is one of the most important factors in determining its success. The elements OFAC lists include senior management approval of the program, delegating sufficient authority and autonomy to compliance units, providing adequate resources including people, technology and expertise, appointing a dedicated OFAC compliance officer, promoting a culture of compliance, and recognizing the seriousness of violations.

Risk assessment. OFAC describes a routine and, where appropriate, ongoing risk assessment as one of the central tenets of the approach, for the purpose of identifying the potential OFAC issues an organization is likely to encounter. The elements OFAC lists include assessing customers, supply chains, intermediaries, counterparties, products and services, and geographic locations, developing sanctions risk ratings during customer on-boarding, integrating sanctions compliance into mergers and acquisitions, and developing a methodology to identify and address risks.

Internal controls. OFAC states that an effective program should include internal controls, including policies and procedures, in order to identify, interdict, escalate, report as appropriate, and keep records pertaining to activity that may be prohibited by the regulations and laws OFAC administers. The elements include written policies and procedures, controls that address the results of the risk assessment, enforcement through audits, recordkeeping procedures, immediate action on control weaknesses, communication of policies to staff, and integration of the procedures into daily operations.

Testing and auditing. OFAC states that a comprehensive and objective testing or audit function ensures that an organization identifies program weaknesses and deficiencies, and that it is the organization's responsibility to enhance its program. The elements include accountability to senior management, independence from the functions being audited, comprehensive and objective assessment procedures, immediate action on negative findings, and the implementation of compensating controls.

Training. OFAC states that an effective training program is an integral component of a successful program. The elements include providing employees with adequate information and instruction, a scope appropriate to the firm's products, services, customers and geographic regions, a frequency based on the risk assessment, immediate corrective action on deficiencies, and accessible resources and materials.

The framework also connects the program to enforcement. It states that an effective sanctions compliance program in place at the time of an apparent violation may result in mitigation of the civil monetary penalty, and that it can influence whether OFAC treats a case as egregious. A program therefore has two functions: it helps prevent violations, and it can bear on OFAC's response if one occurs.

The framework also lists root causes of sanctions violations that OFAC has identified. The list includes a lack of a formal sanctions compliance program, misinterpreting or failing to understand the applicability of OFAC's regulations, facilitating transactions by non-U.S. persons, exporting or re-exporting U.S.-origin goods to sanctioned persons, utilizing the U.S. financial system improperly, sanctions screening software or filter faults, improper due diligence on customers, decentralized compliance functions and inconsistent application of the program, utilizing non-standard payment or commercial practices, and individual employee liability.

The five components resemble what FINRA Rule 3310 requires of an anti-money laundering program, such as independent testing, a designated person and ongoing training. The two are separate documents with separate purposes.

Enforcement and Penalties

OFAC's frequently asked questions state that violations of OFAC-administered sanctions programs may result in civil and, in some cases, criminal penalties. They state that civil penalties vary by sanctions program and that the Federal Civil Penalties Inflation Adjustment Act requires OFAC to adjust civil monetary penalty amounts annually. For current amounts, OFAC points readers to Appendix A to 31 CFR part 501, the Economic Sanctions Enforcement Guidelines. This entry does not give penalty amounts, because they change every year and a reader should use the current figures.

The Enforcement Guidelines use the term apparent violation. They define it as conduct that constitutes an actual or possible violation of U.S. economic sanctions laws. The Guidelines then list general factors that OFAC considers in deciding how to respond. They include whether the violation was willful or reckless, the awareness of the conduct on the part of the person involved, the harm to the objectives of the sanctions program, the individual characteristics of the person, the compliance program, the remedial response, the cooperation with OFAC, the timing of the apparent violation, any other enforcement action, and the effect on future compliance and deterrence.

The factors show how a firm's own conduct bears on OFAC's response, since the compliance program and the remedial response both appear on the list.

Common Misunderstandings

One misunderstanding is that OFAC is a securities regulator. It is a sanctions authority in the Treasury Department, and it does not oversee the securities markets.

A second misunderstanding is that only entities on the SDN List are blocked. OFAC states that some persons are blocked even if they are not listed, including entities that meet the 50 Percent Rule.

A third misunderstanding is that the 50 Percent Rule requires one blocked person to own half. The rule aggregates the interests of blocked persons, and OFAC's example uses two blocked persons who each own twenty-five percent.

A fourth misunderstanding is that blocked property belongs to the government. OFAC states that title remains with the blocked person, and that dealings are prohibited without authorization.

A fifth misunderstanding is that a firm can hand sanctions compliance to a vendor and be finished with it. OFAC's guidance states that a business that delegates its compliance responsibilities, and the third parties, could be held liable.

A sixth misunderstanding is that sanctions apply only inside the United States. OFAC states that U.S. citizens and permanent residents must comply regardless of where they are located, and that U.S. incorporated entities' foreign branches must comply.

A seventh misunderstanding is that FINRA Rule 3310 and OFAC compliance are the same thing. The rule requires an anti-money laundering program, and OFAC's regulations impose their own obligations.

An eighth misunderstanding is that a sanctions prohibition never has exceptions. OFAC describes general licenses, specific licenses and exemptions, although the exceptions vary in type and scope across sanctions programs.

A ninth misunderstanding is that a rejected transaction and blocked property are the same thing. Under OFAC's regulations, a rejected transaction is one that is not blocked but that the person could not process without violating the regulations.

A tenth misunderstanding is that the ten business day report is the only report on blocked property. The regulation also provides for an annual report on all blocked property held as of June 30, due by September 30.

An eleventh misunderstanding is that records may be discarded once a transaction is finished. The regulation requires records to be available for examination for at least ten years after the date of the transaction, and for blocked property for the period it is blocked and at least ten years after it is unblocked.

Key Points

OFAC is the Treasury office that administers and enforces economic and trade sanctions against targeted foreign jurisdictions and regimes, and against individuals and entities engaging in harmful activity.

Blocking freezes property. It imposes an across-the-board prohibition against transfers or dealings, title remains with the blocked person, and blocked property must be reported to OFAC within ten business days.

All U.S. persons must comply, including U.S. citizens and permanent residents wherever they are located and U.S. incorporated entities and their foreign branches.

Entities owned fifty percent or more in the aggregate by one or more blocked persons are blocked even if they are not listed, and OFAC recommends caution for significant ownership below that level or control by other means.

OFAC's guidance to securities and futures firms calls for screening new clients against the SDN List and applicable sanctions programs, documenting the results, and recognizing that compliance liability cannot generally be reallocated to a third party.

Licenses are of two kinds. General licenses are public and self-executing, and specific licenses are issued to a particular person for a particular transaction. Exemptions and other exceptions vary from program to program.

Blocked property is reported within ten business days of becoming blocked, with an annual report on blocked property held as of June 30 due by September 30. Rejected transactions are reported within ten business days of the rejection. Records must be available for examination for at least ten years after the transaction.

OFAC's framework names five components of a sanctions compliance program, and violations may lead to civil and in some cases criminal penalties.