An OFAC, EAR and ITAR compliance program is the documented set of policies, procedures and controls a company puts in place to avoid violating U.S. economic sanctions and export controls.
U.S. regulations have a broad extraterritorial reach, which is why non-U.S. entities need internal assurance processes to avoid non-compliance.
A compliance program that meets the guidelines of U.S. regulators rests on five essential components: management commitment, risk assessment, internal controls, testing and auditing, and training.
That five-part framework is defined by OFAC; the Department of Commerce (BIS) and the Department of State (DDTC) expand it with their own elements for dual-use and defense exports.
None of the three agencies generally requires a program, but all of them recommend one. And in practice it is indispensable. Having one significantly reduces the penalty when something goes wrong. For a company outside the United States, this program makes the difference between detecting a risk in time and discovering it when an investigation is already under way.
Any cost associated with a program is more than justified when compared with the possible consequences of non-compliance: multimillion-dollar fines and, in the worst case, designation on a sanctions list and being unable to take part in U.S. markets or use the U.S. dollar.
What Is an OFAC, EAR and ITAR Compliance Program?
A U.S. economic sanctions and export controls compliance program is a documented, risk-based system that integrates compliance with OFAC sanctions and EAR and ITAR export controls into a company’s day-to-day operations. Its purpose is to identify, interdict, escalate and record any potentially prohibited transaction before it is carried out.
Three different regulators oversee three different areas. OFAC controls economic sanctions. BIS administers the EAR, which covers dual-use products and technology. DDTC administers ITAR, which covers defense articles. A company with U.S.-related operations or that works with international counterparties could touch all three at once, in which case a single program covering them in a coordinated way may be preferable to three isolated systems.
A single program is usually the most effective in these circumstances, since the essential elements are the same and one integrated program avoids duplicated or contradictory procedures. Even so, the program would normally include some elements dedicated exclusively to OFAC, the EAR or ITAR. In other circumstances, completely separate programs for the different regimes may be advisable, for example if a company has multiple separate business units with very different risk profiles, or if its ITAR-controlled operations are significant and require segregation of duties.
If no defense articles are handled, the ITAR component would obviously not be needed. Likewise, if no U.S. products or technology are used, EAR controls would not apply and the compliance component for that regime would not be needed either. Even so, reaching these conclusions requires established, reliable processes.
Is a Compliance Program Mandatory?
Not generally. OFAC and BIS recommend a program but do not require one by law. Neither does ITAR, although it comes closer to doing so. Liability for non-compliance, however, is the same whether or not you have a program.
In practice, having a compliance program is indispensable.
Why Does It Matter to a Non-U.S. Company?
Because OFAC sanctions and EAR and ITAR controls reach companies located outside the United States, as explained in our article on the extraterritorial reach of these rules. And because a documented program is an officially recognized mitigating factor. OFAC takes it into account when calculating a penalty and may reduce the amount when an effective program exists. There are also many practical reasons. Counterparties in commercial, M&A or financial transactions will inevitably carry out their own due diligence and require robust compliance representations and warranties as conditions. Without a compliance program, it is impossible to meet those conditions.
The 5 Essential Components of a Compliance Program
The OFAC framework, published on May 2, 2019, defines five essential components: management commitment, risk assessment, internal controls, testing and auditing, and training. These five pillars are also the foundation on which EAR and ITAR programs are built.
Management Commitment
Management commitment is senior management’s active support for the compliance program. It is the factor that most determines its success. Management reviews and approves the program, gives the compliance function resources and autonomy, establishes direct reporting lines and promotes a culture in which staff can raise a problem without fear of retaliation.
Risk Assessment
Risk assessment is the systematic analysis of the company’s points of contact with sanctioned persons, countries or sectors, and with products or technology subject to export controls. It reviews customers, suppliers, intermediaries and counterparties, the products and services offered and the geographic areas where the company operates. It is especially critical in mergers and acquisitions, where the company inherits the risk of the entity it buys.
Internal Controls
Internal controls are the policies and procedures that identify, interdict, escalate and record potentially prohibited transactions. They include screening counterparties against the SDN List and other lists, and due diligence on customers and suppliers. Screening in the financial sector requires specific care because of the role of the dollar in international payments.
Prior screening of counterparties —their beneficial ownership, location and links— is the piece that prevents the most failures. That sanctions due diligence process deserves its own procedure within the program.
Testing and Auditing
Testing and auditing check that the program works as designed and detect its weaknesses. A useful audit function is independent of the areas it reviews and reports to management. When it finds a failure, the company applies compensating controls while it resolves the root cause. What a compliance audit reviews is covered separately.
Training
Training keeps staff up to date on their compliance responsibilities and on red flags. The OFAC framework calls for it to be periodic, at least annual, and tailored to the role: those who handle payments, sales or exports need more depth than others. The compliance training program is developed in its own article.
How OFAC, EAR and ITAR Differ in Practice
The three regimes share the same five-pillar backbone, but BIS for the EAR and DDTC for ITAR each define eight elements. BIS guidance on the EAR has also been published in Spanish, and DDTC’s ITAR compliance program guidelines were published on December 5, 2022. Both start from the OFAC framework and add operational requirements specific to exports and technology transfers.
| Element | OFAC | EAR (BIS) | ITAR (DDTC) |
|---|---|---|---|
| Management commitment | Yes | Yes | Yes |
| Risk assessment | Yes | Yes | Yes |
| Internal controls and procedures | Yes | Yes | Yes |
| Testing and auditing | Yes | Yes | Yes |
| Training | Yes | Yes | Yes |
| Record-keeping | Within controls | Separate element | Separate element |
| Written compliance manual | Within controls | Separate element | Separate element |
| Handling and disclosure of violations | Within controls | Separate element | Separate element |
| Total elements in the framework | 5 | 8 | 8 |
What the EAR (BIS) Adds
The EAR compliance program adds four operational elements to OFAC’s five-part framework: export authorization, record-keeping, a written compliance manual and a procedure for handling violations and corrective actions. Screening and classifying products under the Commerce Control List are the day-to-day work of these controls, as explained in our export controls guide.
What ITAR (DDTC) Adds
The ITAR compliance program also requires specific control over the classification of articles on the U.S. Munitions List (USML). It also adds the detection, reporting and disclosure of violations and a dedicated ITAR manual. It is the strictest of the three regimes because it concerns defense material.
How to Implement a Compliance Program Step by Step
Implementing a compliance program follows a logical sequence: assess the risk, design proportionate controls, document them, train staff and audit the result. A small company does not need the same structure as a multinational, but it does need the same pillars.
- Appoint a compliance officer and secure management’s express support.
- Assess your real exposure: customers, suppliers, products, technology and geographies.
- Design the controls: counterparty screening, due diligence and product classification.
- Document policies and procedures in a clear, workable manual.
- Train staff in the highest-risk areas.
- Audit periodically and fix the weaknesses you find.
If sanctions are your priority, our OFAC economic sanctions service applies the five components to that regime alone.
Practical Example: A Company Without a Program vs. One With a Program
A compliance program changes the outcome of an investigation and reassures counterparties in M&A, commercial or financial transactions. Imagine two European distributors of electronic components.
The first, Company A, has no program. It receives an attractive order from an intermediary in a third country that, in reality, reexports the material to a sanctioned jurisdiction. Nobody checks the end customer. When the transaction passes through a bank with a U.S. nexus, it triggers an alert and, months later, an investigation arrives. With no controls in place, the conduct is considered careless and aggravates the response.
The second, Company B, does have a program. Its screening detects that the intermediary appears to be linked to risky transactions. The compliance officer blocks the order and documents the decision. The company avoids the violation and also keeps proof that its controls work. In any future review, that file is its best defense.
Frequently Asked Questions
Does the same program work for OFAC, the EAR and ITAR?
Partly. The five pillars are common to all three regimes, so a single program can cover them if it incorporates the additional EAR and ITAR elements: record-keeping, product classification and a written manual.
Does having a compliance program reduce fines?
Yes. OFAC recognizes the program as a mitigating factor. An effective program can reduce the amount of a civil penalty and, in some cases, influence whether a case is classified as egregious. Without a program, careless conduct becomes an aggravating factor.
Is it mandatory for a company outside the United States?
No. The program is recommended but not required by law. But liability for a violation is the same with or without a program, so not having one only increases the risk.
And in practice it is indispensable.
Where do I start if I have never had one?
With the risk assessment. Identifying where your company touches sanctioned persons, countries or controlled technology defines which controls you need. That way you invest in what really applies to your business rather than in a generic program.
Free download: Checklist of the 5 components of an OFAC/EAR/ITAR compliance program (in Spanish)
A practical checklist to assess, pillar by pillar, whether your company covers the five essential components and the additional EAR and ITAR elements.
Need to set up or review your compliance program? Talk to Burke Compliance and assess your exposure with a specialist.
Related service. If this issue affects your company, at Burke Compliance we analyze it as part of our audits and due diligence service.
