What it means
Most people first meet OFAC as a checkbox in an onboarding system or as the reason a payment has been held up. Behind that checkbox sits a set of sanctions programmes that prohibit US persons, and often anyone touching US dollars, from dealing with named individuals, companies, vessels, aircraft and in some cases whole countries.
The best known list is the Specially Designated Nationals list, usually shortened to the SDN list. It matters commercially because the consequences are financial and immediate.
Civil penalties can run into millions of dollars, banks may exit the relationship rather than manage the risk, and a single blocked payment can strand a shipment for weeks. For a growing business, the reputational cost of appearing in an enforcement notice usually outweighs the fine itself.
The practical work splits into screening and decision-making. Screening compares names, addresses, vessel identifiers and country data against the lists, allowing for spelling variants and transliteration, then a human reviews the hits to separate genuine matches from coincidences.
Anyone with a common surname will generate false positives, so the quality of the review process matters as much as the quality of the software. Two rules catch businesses out more than any others.
The first is the 50% rule, under which an unlisted company is treated as sanctioned if listed parties own half or more of it, directly or together, which means ownership has to be traced rather than assumed. The second is the distinction between blocking a payment, where funds must be frozen and reported, and rejecting one, where the transaction is simply refused.
When a legitimate deal touches a sanctioned party or country, the route through is a licence. Some activities are covered by general licences that apply automatically, while others require a specific licence applied for case by case, and proceeding without one on the basis that the deal is obviously humanitarian or trivial is a common and expensive misjudgement.
In practice
Real-world examples.
Example
A payments fintech screens a new business customer and gets a hit on a director's name. The compliance analyst compares date of birth, nationality and address, concludes it is a false positive, records the reasoning, and clears the account within the same day. The documented decision is what protects the firm if the case is ever reviewed.
Example
A freight forwarder is asked to move machinery to a buyer in a third country whose ultimate parent turns out to be 55% owned by a listed entity. Under the 50% rule the buyer is treated as sanctioned even though its own name appears nowhere, so the forwarder declines the booking.
Example
A software company discovers that a reseller has been providing its product to users in a comprehensively sanctioned territory. It suspends the account, investigates the full extent, and files a voluntary self-disclosure, which is generally treated as a mitigating factor when penalties are assessed.
Think of it
“OFAC is the US sanctions authority-the office that enforces economic restrictions.
Case study
Seen in the real world.
Vellmark Components is an illustrative, fictional industrial parts distributor used here to show how OFAC exposure creeps up on a growing business. It had grown from domestic sales to exporting through six agents, and screened customers at onboarding only, with no re-screening afterwards and no check on the agents themselves.
A routine bank query about a $340,000 dollar payment revealed that one agent had been added to the SDN list eleven months earlier. The payment was blocked, the bank asked for a full account of the relationship, and the finance director found that nothing had been re-screened since the original onboarding in 2021.
Vellmark filed a voluntary self-disclosure, moved to daily automated re-screening of its whole counterparty base, and added ownership checks for any counterparty in a higher-risk jurisdiction. In this fictional example the penalty was materially reduced because the disclosure came from the company rather than from an investigation, but the episode still cost roughly nine months of senior management attention.
Watch out
Common mistakes.
- Assuming OFAC only applies to US companies. Dollar-clearing, US-origin goods and US-based staff or software can all pull a non-US business into scope.
- Screening once at onboarding. Lists change constantly, so a counterparty that was clean when you signed them can be designated the following month.
- Treating a false positive as a reason to switch off alerts. The answer to too many hits is better tuning and documented review, not a lower screening standard.
Questions
People also ask.
Is a small or accidental breach still a violation?
Yes, most sanctions rules operate on strict liability, so intent affects the size of the penalty rather than whether a violation occurred.
What is the difference between blocking and rejecting a payment?
Blocking means freezing the funds in a separate account and reporting them, while rejecting means declining the transaction and returning it, and which applies depends on the specific programme.
Do we need software to comply?
Not necessarily for a very small counterparty base, but manual list checks stop being credible once volumes rise, and regulators expect screening to be systematic and evidenced.
From the founder's library
Take it further with the book.
Build your financial confidence beyond this definition. Shihan's full-length guide, Accounting Fundamentals, takes the same plain-English approach and turns it into a complete, practical playbook for non-finance managers, business owners and students - with chapter-end quiz answers and presentation slides included.
25% off with code MMHQ25, applied at checkout. Priced in USD - checkout may show the equivalent in your local currency.
View the book and save 25%