OFAC Lawyer Guide to Compliance and International Law

Imagine your finance team processes a routine wire transfer to a long-standing supplier. Three days later, your bank freezes the funds. The recipient’s parent company just landed on a sanctions list, and now you’re holding blocked property you cannot legally release without Treasury authorization. This scenario plays out daily for businesses operating across borders, and it illustrates why understanding U.S. economic sanctions isn’t just a compliance nicety—it’s a survival skill.

This guide explains what OFAC is, who must follow its rules, and how to build a defensible compliance program. You’ll learn the difference between blocking and rejecting transactions, navigate the maze of licensing, and understand when the cost of going it alone exceeds the investment in specialized counsel.

What Is OFAC and How Does It Relate to International Law?

The Office of Foreign Assets Control (OFAC) is a component of the U.S. Department of the Treasury charged with administering and enforcing economic and trade sanctions tied to foreign policy and national security objectives. Its mission centers on denying resources to targeted regimes, terrorists, narcotics traffickers, and others who threaten U.S. interests abroad. Sanctions programs administered by OFAC can be either comprehensive, prohibiting virtually all dealings with an entire jurisdiction, or selective, targeting specific individuals, entities, or sectors.

Critically, OFAC’s authority is rooted in U.S. domestic law, primarily the International Emergency Economic Powers Act (IEEPA) and the National Emergencies Act. While these statutes give the President broad power to regulate international transactions during declared national emergencies, they do not transform OFAC into an international-law body. OFAC regulations are domestic U.S. law that applies to prescribed conduct, not treaties or conventions that bind states in the international legal order.

That said, OFAC operates within a broader international-law environment that includes United Nations Security Council sanctions imposed under Chapter VII, Article 41 of the UN Charter. These multilateral measures can range from comprehensive economic embargoes to targeted financial restrictions and travel bans. When the U.S. implements UN sanctions through executive orders, OFAC enforces them as domestic measures. Understanding this distinction matters: violating OFAC rules exposes you to U.S. civil and criminal penalties, even if your conduct complies with the UN charter or other international norms. Sanctions law, in this context, is primarily U.S. domestic law with international implications, not a standalone body of public international law.

Who Must Comply With OFAC Regulations in the USA?

Jurisdiction under OFAC regulations is broad and unforgiving. The term “U.S. persons” includes all U.S. citizens and permanent residents wherever they are located in the world, all individuals and entities physically present within the United States, and all entities organized under U.S. law—including their foreign branches. This means a U.S.-incorporated technology firm with a branch in Dubai must ensure its Dubai office complies with OFAC sanctions, even when no Americans are physically present there.

Non-U.S. companies are not automatically exempt. Foreign persons can become subject to OFAC prohibitions when their conduct causes U.S. persons to violate sanctions, or when they engage in activities that evade U.S. sanctions. For example, if a German manufacturer routes payments through a U.S. correspondent bank to conceal dealings with a sanctioned Iranian entity, that manufacturer may face enforcement action.

The most common flashpoint involves cross-border payments and U.S.-dollar clearing. Because most USD transactions clear through correspondent accounts in New York, even purely offshore transactions often touch U.S. jurisdiction. A Chinese exporter invoicing a Brazilian importer in dollars typically routes those funds through a U.S. financial institution, creating an OFAC nexus. Businesses navigating these complexities often work with specialized advisory firms. For instance, Sequoia Legal advises companies on corporate structuring and international regulatory compliance to ensure U.S. jurisdiction hooks are identified before transactions close.

Foreign subsidiaries of U.S. companies present unique risks. While non-U.S. subsidiaries are generally not considered U.S. persons themselves, they cannot cause the U.S. parent to violate sanctions, and U.S. persons cannot approve or facilitate prohibited transactions by their foreign subsidiaries. This creates a compliance obligation that extends far beyond American borders.

The SDN List and the 50 Percent Rule: Ownership vs. Control

At the heart of OFAC compliance lies the Specially Designated Nationals (SDN) List. Inclusion on this list blocks all property and interests in property of the designated persons that are within U.S. jurisdiction or come within the possession or control of U.S. persons. Effectively, you must freeze any assets belonging to an SDN and refuse to engage in transactions with them.

The 50 Percent Rule adds a layer of complexity. Under this rule, an entity is treated as blocked if it is directly or indirectly owned 50 percent or more in the aggregate by one or more blocked persons. This applies even if the entity itself does not appear on the SDN List. Ownership is calculated by aggregating the percentages held by all blocked persons; if the total reaches 50 percent, the entity is blocked.

Here is where many businesses stumble: the 50 Percent Rule addresses ownership, not control. An entity controlled by a blocked person—but owned less than 50 percent by blocked persons—is not automatically blocked under the rule. OFAC may separately designate such an entity if it determines the control presents a sanctions risk, but until that designation occurs, the entity is not legally blocked merely because a sanctioned shareholder exercises managerial control. This distinction is crucial for legal risk assessment, as control-based screening alone will miss ownership-based blocking and vice versa.

When Blocked Ownership Falls Below 50 Percent

If blocked ownership later falls below 50 percent entirely outside U.S. jurisdiction—perhaps through a foreign share sale—the entity is no longer automatically blocked for future transactions. However, property that was already blocked within U.S. jurisdiction does not automatically unblock. You must still hold those funds and seek specific authorization from OFAC to release them, even though new business with the entity might now be permissible.

Blocked vs. Rejected Transactions and Reporting Requirements

Understanding the difference between blocking and rejecting transactions is essential for accurate reporting. Blocking means freezing property; the title remains with the blocked person, but you cannot transfer, withdraw, or otherwise deal in the property without OFAC authorization. Blocking does not constitute seizure—the U.S. government does not take title, but the property remains frozen indefinitely or until the designation is removed or a license is obtained.

Rejection, by contrast, occurs when you decline to process a transaction that would violate sanctions but does not involve blocked property. For example, if a customer attempts to wire funds to a sanctioned party before the funds leave your account, you reject the transaction and return the money to the customer. You do not freeze it.

Reporting timelines are strict. Under 31 CFR Part 501, blocked property must be reported to OFAC within 10 business days of becoming blocked. Annual reports on blocked property held as of June 30 are due by September 30 of each year. When blocked property is unblocked or transferred pursuant to authorization, you must report that within 10 business days as well. Rejected transactions carry their own reporting obligations under 31 CFR 501.604, requiring U.S. persons to report rejections that are not blocked but would have violated sanctions.

Recordkeeping for Blocked Property and Transactions

Recordkeeping requirements under 31 CFR 501.601 mandate that records of transactions subject to Chapter V be maintained for at least five years, though OFAC’s guidance often references ten years as a conservative standard for compliance programs. For blocked property specifically, records must be kept for as long as the property is blocked, plus at least five years after it is unblocked. These retention rules are critical during an OFAC audit, as investigators will demand documentation of screening decisions, ownership calculations, and the rationale for blocking or rejecting specific transactions.

Navigating OFAC Licenses: General, Specific, and Exemptions

When prohibited conduct is necessary for legitimate business, OFAC offers licensing mechanisms. General licenses are self-executing authorizations that permit certain categories of transactions without requiring you to apply to OFAC, provided you meet all stated conditions. For example, general licenses may authorize specific types of personal remittances or the provision of legal services to blocked persons. If you rely on a general license, you must strictly adhere to every term; deviating by even a minor detail can convert a permitted transaction into a violation.

Specific licenses, by contrast, are issued on a case-by-case basis following a formal application to OFAC. These written authorizations permit particular transactions by specific parties and are limited to the facts presented in the application. They do not create broad precedent.

It is also important to distinguish licenses from statutory exemptions. Certain transactions are exempt from sanctions by statute—notably, information and informational materials, and personal communications in many programs. These exemptions require no license at all, whereas general and specific licenses authorize otherwise prohibited conduct. Engaging an OFAC compliance lawyer is often prudent when determining whether your transaction falls under a general license, requires a specific application, or is statutorily exempt, as the wrong classification can trigger enforcement.

Building a Sanctions Compliance Program: The Five Core Elements

In 2019, OFAC published its Framework for OFAC Compliance Commitments, identifying five essential components of an effective sanctions compliance program: (1) management commitment, (2) risk assessment, (3) internal controls, (4) testing/auditing, and (5) training. This framework serves as a practical OFAC compliance guide for organizations of all sizes.

Management commitment means senior leadership must allocate adequate resources, empower compliance officers to halt suspicious transactions, and foster a culture where sanctions risk is taken seriously. Risk assessment requires identifying geographic, customer, product, and supply chain vulnerabilities. Internal controls include clear policies, automated screening software, and escalation procedures for potential matches. Testing and auditing ensure your controls actually work, while training keeps staff current on evolving threats and regulatory expectations.

Global trade compliance integrates these elements with export controls under the Export Administration Regulations (EAR) and customs procedures. A robust program does not treat sanctions as an isolated silo; rather, it coordinates screening against the SDN List with denied party screening for dual-use goods and customs valuation checks.

Testing and Auditing Protocols

An effective OFAC audit should test the technical configuration of screening software to ensure it captures variations of sanctioned names and addresses. It must verify the completeness of ownership diligence for the 50 Percent Rule, review the timeliness of blocked and rejected transaction reporting, and confirm compliance with the five-to-ten-year recordkeeping rule. Auditors should also examine whether escalation procedures were followed when alerts fired, and whether decisions to unblock or reject were documented with sufficient legal reasoning.

Enforcement Exposure and Penalty Mitigation Strategies

Enforcement is not theoretical. In 2023, for example, OFAC’s public enforcement actions resulted in penalties totaling over $1.5 billion, demonstrating the severe financial exposure for non-compliance, which can include both civil monetary penalties and criminal liability under IEEPA and other statutes.

Voluntary self-disclosure (VSD) serves as a critical mitigating factor. When an entity discovers and reports its own apparent violation to OFAC, the disclosure can reduce the base amount of any proposed civil penalty. However, VSD is not amnesty; you remain liable for the underlying conduct. OFAC generally expects an initial disclosure to be followed by a detailed report within 180 days, though this timeline can be extended with good cause. The Department of Justice has also demonstrated that cooperation matters; in recent declination decisions, such as the White Deer/Unicat matter from June 2023, the DOJ declined prosecution of a private equity firm following a voluntary disclosure and full cooperation regarding potential sanctions and export control violations.

When to Hire an OFAC Lawyer: Practical Risk Triggers

Certain scenarios demand specialized legal counsel. Cross-border wire transfers and USD clearing activities create high-risk touchpoints where jurisdictional analysis is essential. M&A transactions involving complex beneficial ownership chains require sophisticated screening against the SDN List and calculation of indirect ownership under the 50 Percent Rule. Operations through foreign subsidiaries or branches, as noted earlier, create compliance obligations that general corporate counsel may miss.

You should engage an OFAC lawyer when preparing for or responding to OFAC audits, particularly when subpoenas arrive under 31 CFR 501.602. Counsel can help distinguish between ownership and control issues, manage the 180-day timeline for voluntary self-disclosure supplemental reports, and defend against enforcement actions. An experienced sanctions lawyer also helps navigate the technical distinctions between general licenses, specific licenses, and statutory exemptions—areas where well-meaning compliance officers often err.

M&A and Beneficial Ownership Due Diligence

Mergers, acquisitions, and joint ventures are recurring failure points in sanctions compliance. Buyers must screen target entities against the SDN List, calculate indirect ownership under the 50 Percent Rule for every tier of the corporate structure, and assess whether control exists even when ownership is below 50 percent. Representations and warranties in purchase agreements should address sanctions compliance specifically, and escrow arrangements may be necessary to address potential blocking issues discovered post-close.

Conclusion

OFAC compliance requires understanding three core principles: First, OFAC’s domestic authority extends globally through U.S. person status and the USD clearing system. Second, the 50 Percent Rule creates blocking based on ownership aggregation, not control, with distinct consequences for future versus past transactions. Third, a defensible compliance program built on management commitment, risk assessment, internal controls, testing, and training is your best shield against the massive enforcement exposure demonstrated by recent multi-billion dollar penalty years.

Don’t wait for a frozen wire transfer or a subpoena to address your sanctions risk. Review your screening protocols today, audit your recordkeeping practices, and consult specialized counsel when entering high-risk jurisdictions or complex transactions. Proactive compliance costs far less than reactive remediation.