U.S. companies with international clients or customers have to comply with far more laws and regulations than companies that only operate domestically. These include laws and regulations enforced by the U.S. Office of Foreign Assets Control (OFAC) that prohibit doing business with countries, companies, and individuals under economic and trade sanctions based on the United States.
OFAC compliance presents many unique challenges regarding national security goals, and facing scrutiny from OFAC presents substantial risks. As a result, companies that are subject to OFAC’s oversight need to devote the necessary resources to compliance, and when facing OFAC investigations, they must promptly build and execute effective defense strategies. Both of these require highly experienced legal representation.
“The Office of Foreign Assets Control (OFAC) plays a critical role in the federal government’s ongoing efforts to protect national security and avoid foreign influence. To this end, it vigorously enforces companies’ obligations to comply with sanctions, pursuing both investigations and enforcement actions as necessary.” – Dr. Nick Oberheiden, Founding Attorney of Oberheiden P.C.
Given the risks of OFAC non-compliance—which include both civil and criminal penalties—failing to maintain an effective OFAC compliance program isn’t an option. Companies subject to OFAC’s oversight must prioritize compliance and be prepared to prove their compliance when necessary.
5 Keys to Effective OFAC Compliance and Defense
With this in mind, what do company owners and executives need to know about OFAC compliance (and defense) in 2025? Here are five important considerations:
1. Staying Up-to-Date on OFAC Sanctions
Companies in the U.S. that do business with foreign parties need to stay apprised of international developments. If a country or world leader does something that triggers a response from the United States, OFAC sanctions could follow. Identifying situations that have the potential to lead to OFAC sanctions can help companies avoid entering into business relationships that might trigger scrutiny from OFAC—or that could become prohibited under newly imposed OFAC sanctions.
That said, OFAC’s current list of sanctioned parties is over 1,000 pages long. As a result, many parties that might appear to be potential targets for sanctions could very well be subject to sanctions already. Before entering into business relationships with foreign parties that present potential concerns, companies should review OFAC’s list of sanctioned parties to determine if any existing sanctions apply. If any existing sanctions do apply, then the company will need to either (i) rely on a general license, (ii) seek a specific license from OFAC, or (iii) pursue an alternate business opportunity.
2. Using OFAC Sanctions Screening Software (But Doing So Cautiously)
Several software applications allow companies to screen parties, transactions, and financial documents for hits on OFAC’s lists of sanctioned individuals and entities. Licensing one of these applications can be a worthwhile investment, especially for companies that do a substantial volume of business abroad or that do business with individuals or entities in parts of the world that are known areas of concern for the U.S. government.
However, companies must be cautious about relying exclusively on sanctions screening software. If the software fails to update the latest OFAC sanctions list, it may fail to serve its intended purpose. Additionally, software applications may not identify sanctioned parties’ attempts to evade detection. Sanctioned parties may use a variety of tactics to gain access to U.S. markets, including misspelling locations or parties in documents that are likely to be searched using OFAC sanctions screening applications. Thus, while sanctions screening software can be an effective tool, it should generally be just one of several tools that companies use to manage OFAC compliance. If a screening application fails to identify a sanctioned party, this is not an excuse for noncompliance.
3. Taking a Comprehensive and Proactive Approach to OFAC Compliance
Adopting an effective OFAC compliance program is important not only because it can help companies avoid violations and sanctions but also because it can help to mitigate the penalties for a violation if one occurs. As OFAC explains, the “existence, nature, and adequacy” of a corporate compliance strategy are factors the agency will consider when imposing civil monetary penalties (CMP) for sanctions violations. Adherence to appropriate internal OFAC compliance protocols can also prevent the agency from labeling violations as “egregious,” which can increase the risks involved in facing enforcement.
Since OFAC takes into account the adequacy and effectiveness of a company’s compliance program, deciding whether (and to what extent) to impose sanctions, a comprehensive and proactive approach to OFAC compliance is essential. Companies that do business with foreign parties need to thoroughly address the national security and other federal-level considerations involved, and they need to ensure that they thoroughly address these considerations before engaging in transactions that have the potential to trigger scrutiny from OFAC.
4. Being Careful to Avoid Known Types of OFAC Violations
OFAC expects companies to remain fully up-to-date with its enforcement measures, including (but not limited to) its imposing new OFAC sanctions. To assist companies and maintain its updated OFAC sanctions programs list, OFAC also publishes its recent enforcement actions online. Companies that are (or that may be) subject to OFAC’s oversight should review these enforcement actions or rely on their legal counsel to do so, and they should proactively update their compliance protocols as necessary. If a company not only violates a law, regulation, or OFAC sanction but does so in a way that has previously led to OFAC enforcement action, this can substantially increase the risks involved.
OFAC has also published a list of the most common issues it identifies when pursuing enforcement. According to the agency, 10 of the most common reasons for the imposition of CMP (and other penalties) are:
- Not having formal OFAC compliance programs;
- Misinterpreting OFAC regulations or wrongly presuming that it does not apply to the company;
- Conducting business with OFAC-sanctioned countries, blocked persons, or specially designated nationals from a non-U.S. subsidiary that is subject to OFAC sanctions;
- Purchasing U.S.-origin goods through a foreign-based subsidiary, with the purpose of re-exporting those goods to a country, person, or entity that is subject to OFAC sanctions;
- Using the U.S. financial system to facilitate commercial transactions with OFAC-sanctioned people or countries without looking at the bank's OFAC risk profile;
- Failing to update sanctions screening software or find data entry mistakes;
- Failing to conduct adequate due diligence on the company’s customers, supply chain partners, intermediaries, or other counterparties;
- Using a decentralized OFAC compliance strategy that leads to inconsistent interpretation of agency regulations and erratic compliance measures within the company;
- Ignoring the use of non-standard business practices which likely indicate that a party to a transaction is trying to evade OFAC sanctions; and,
- Individual employees committing OFAC violations abroad without the knowledge of their U.S.-based employers, often while covering up their actions.
Since these are all known risks, OFAC expects companies to address them proactively, and failure to do so can lead to more aggressive enforcement action. Inadvertence is not an excuse for noncompliance, and OFAC expects companies to implement sufficient safeguards to ensure that their employees cannot violate the law or run afoul of OFAC sanctions undetected.
5. Making Appropriate Voluntary Self-Disclosures to OFAC When Necessary
When companies become aware of potential OFAC violations involving transactions with sanctioned parties, voluntarily self-disclosing the violation may be necessary. OFAC encourages self-disclosure, and timely self-disclosures can substantially mitigate the consequences of inadvertent OFAC sanctions violations.
However, self-disclosures can also be risky, and weighing the benefits and risks of voluntary self-disclosure requires the insights of an experienced OFAC defense lawyer. Determining whether self-disclosure is necessary at all requires legal insights as well. As we have discussed, OFAC compliance is extremely complex, and OFAC’s sanctions list constantly changes. This means that determining whether a voluntary self-disclosure is necessary is not easy. But, making an informed determination is extremely important, as both non-disclosures and improper voluntary self-disclosures can have significant adverse consequences.
Is Your Company Prepared to Effectively Manage OFAC Compliance in 2025?
Given everything we’ve discussed thus far, is your company prepared to manage OFAC compliance in 2025 effectively? If you answer “No” or “I don’t know,” you will want to address any compliance-related concerns proactively. While effectively managing OFAC compliance is not easy, it is extremely important, as even unknowingly and inadvertently, violations can lead to investigations, enforcement actions, and substantial penalties.
Taking a proactive approach to OFAC compliance starts with understanding your company’s risks and needs. Due to the breadth of OFAC’s oversight, companies’ compliance obligations can vary widely. A custom-tailored approach is critical, and company leaders need to be confident that they are doing everything necessary to maintain sanctions compliance, document their compliance, and submit timely voluntary self-disclosures if and when necessary. Experienced OFAC compliance counsel can help, and for companies that do not yet have OFAC compliance protocols in place, engaging experienced counsel is the first step toward mitigating their risk and avoiding unnecessary consequences.
