What Does It Mean That U.S. Sanctions Are Extraterritorial?
U.S. sanctions do not stop at the border. OFAC (Office of Foreign Assets Control) has the legal power to penalize companies that have never set foot on U.S. soil, are not headquartered in the United States and do not employ a single American citizen.
The mechanism is extraterritoriality: the extension of a State’s jurisdiction beyond its territorial limits. In the case of the United States, this extension rests on the role of the dollar as the global reserve currency, on the presence of U.S. technology in international supply chains and on the breadth of enabling statutes such as the IEEPA (International Emergency Economic Powers Act).
In March 2024, the U.S. Departments of the Treasury, Commerce and Justice published the Tri-Seal Compliance Note, a joint document aimed specifically at non-U.S. companies. Its message was direct: compliance obligations under U.S. sanctions and export controls reach persons and entities located outside the country, and the U.S. government has mechanisms to enforce them, including criminal prosecution.
What Is the Difference Between Primary and Secondary Sanctions?
Primary sanctions prohibit U.S. persons from engaging in transactions with designated entities, countries or individuals. Their scope includes U.S. citizens, permanent residents, persons within the United States and entities organized under U.S. law.
In addition, the scope of primary sanctions includes non-U.S. entities in the case of transactions that have a U.S. nexus.
Secondary sanctions go one step further. They penalize third parties —non-U.S. companies and individuals— that engage in significant transactions with entities, sectors or activities sanctioned by the United States. The practical consequence: the non-U.S. company must choose between maintaining business relationships with the sanctioned entity and keeping its access to the U.S. financial system.
This distinction is not theoretical. In 2023 and 2024, OFAC imposed secondary sanctions on Turkish logistics companies and Chinese technology companies for maintaining business relationships with Russia. In November 2024, OFAC warned that foreign financial institutions joining SPFS, the Russian financial messaging system, risked designation.
What Nexuses Connect a Non-U.S. Company to U.S. Jurisdiction Under Primary Sanctions?
There are at least four specific jurisdictional nexuses. Just one of them is enough to give OFAC a legal basis to act against a non-U.S. company. Most companies with international operations have at least one of these nexuses, in some cases without knowing it.
Does Transacting in U.S. Dollars Create OFAC Compliance Obligations?
Yes. Every transaction denominated in U.S. dollars (USD) is cleared through U.S. correspondent banks. This means the payment crosses, even if only electronically, the U.S. financial system. From OFAC’s perspective, that transaction “touches” U.S. territory.
The consequence is immediate: if any party to the transaction is sanctioned, the U.S. correspondent bank is legally required to block the funds. The company that originated the payment is exposed to an investigation for having caused a U.S. financial institution to process a prohibited transaction.
The Swedbank Latvia case illustrates this mechanism. In June 2023, this subsidiary of a Swedish financial institution agreed to pay $3,430,900 to settle its potential liability for 386 apparent violations of the Crimea sanctions. A Swedbank Latvia customer used the online banking platform from an IP address in a sanctioned jurisdiction to send payments to persons located in another sanctioned jurisdiction, routing the transfers through U.S. correspondent banks. Neither Swedbank Latvia nor its customer was based in the United States. The jurisdictional nexus was the dollar.
Does U.S.-Origin Technology in Your Products Expose You to Sanctions?
Yes. Goods that incorporate certain levels of certain U.S.-origin components, software or technology, or that are made with certain U.S.-origin technology or equipment, are subject to the Export Administration Regulations (EAR), administered by the Commerce Department’s Bureau of Industry and Security (BIS). The rule applies regardless of where the product is located or who owns it.
The deciding factor under the de minimis rules is the proportion of controlled U.S.-origin content in the final product. If the value of that content exceeds the 25% de minimis threshold of the total value of the finished item, the product is subject to the EAR. For destinations such as Cuba, Iran, North Korea and Syria, the threshold drops to 10%.
There are also the various Foreign Direct Product Rules (FDPR), which extend U.S. jurisdiction to products made entirely outside the United States if they were produced using certain U.S.-controlled technology, software or production equipment. There are multiple variations of this concept aimed at different control objectives. The FDPR concept is complex and far-reaching. In practice, for example, given the dominant position of U.S. technology in the sector, BIS may consider that a large share of the semiconductors produced worldwide, wherever they are made, is subject to restrictions if destined for certain entities or countries.
The Seagate case is the essential reference. In April 2023, BIS announced a $300 million settlement —the largest standalone administrative penalty in BIS history— with Seagate Technology LLC (U.S.) and Seagate Singapore for shipping millions of hard drives to Huawei without a license, in violation of the Huawei FDPR. When its two main competitors stopped selling to Huawei after the FDPR took effect, Seagate kept doing so and became its sole supplier.
For non-U.S. companies, the lesson is clear: if your products contain certain U.S.-origin components or are made with U.S. equipment, you may need a BIS export license before selling them to certain destinations or customers. To learn more, see our guide on U.S. export controls.
Does Having Employees or Executives with U.S. Citizenship or a Green Card Affect the Whole Company?
Yes. Every U.S. person must comply with OFAC regulations wherever they are. The definition of U.S. person includes all U.S. citizens, all lawful permanent residents (green card holders) and all persons physically present in U.S. territory, regardless of nationality.
This means that if a company has an executive, board member or employee with U.S. citizenship or permanent residence, that person cannot take part in any transaction that violates OFAC sanctions. If they do, liability is not limited to the individual: in many cases it can extend to the whole organization.
A common scenario: a Latin American company whose CFO holds dual nationality (that of their country and U.S. citizenship). If the company closes a deal with an entity on the SDN List and the CFO authorizes the payment, both the CFO and the company are exposed. The individual, as a U.S. person; the company, for having caused a U.S. person to violate sanctions.
Are Subsidiaries Controlled by U.S. Entities Subject to OFAC?
Under certain sanctions programs, yes. Foreign subsidiaries owned or controlled by U.S. entities must comply with the applicable restrictions. This is expressly the case under the sanctions programs for Iran (31 C.F.R. §560.215), Cuba (31 C.F.R. §515.329) and North Korea (31 C.F.R. §510.214).
What Has Happened to Non-U.S. Companies That Violated U.S. Sanctions?
OFAC has repeatedly acted against non-U.S. companies. Documented cases span every continent, multiple industries and amounts ranging from hundreds of thousands to billions of dollars. The pattern is consistent: neither company size, geographic location nor the absence of direct operations in the United States offers protection against action by U.S. authorities. You can find a detailed analysis of the types of penalties and their amounts in our article on OFAC sanctions.
Which European Companies Have Been Penalized by OFAC?
Aiotec GmbH (Germany) — $14.6 million (2024). OFAC determined that Aiotec conspired to acquire a dismantled polypropylene plant in Australia from a U.S. company and transfer it to Iran. The conduct was classified as willful and egregious. Aiotec did not make a voluntary self-disclosure, which aggravated the penalty.
Alfa Laval Middle East Ltd. (UAE/Sweden) — $415,695 (2021). This Dubai-based subsidiary of a Swedish parent conspired with companies in Dubai and Iran to export storage tank cleaning units from a U.S. company to Iran. The scheme included listing a Dubai company as the end user in the export documents, concealing the real destination of the goods. OFAC documented that the owner of the Dubai company sent Alfa Laval Middle East a memo detailing the strategy for obtaining U.S.-origin goods and reexporting them to Iran.
And Companies in Asia-Pacific and Other Regions?
SCG (Thailand) — $20 million (2024). SCG, a Thai company, was penalized after it was determined that it tried to conceal the Iranian origin of high-density polyethylene (HDPE) resin by transshipping it through the United Arab Emirates. OFAC classified the conduct as willful and the violations as egregious. SCG used shipping and documentation practices designed to obscure the origin of the product and the involvement of Iranian parties in order to facilitate the resulting U.S. dollar bank transfers by U.S. banks.
Binance Holdings Limited (global) — $968,618,825 civil penalty + $4.3 billion criminal fine (2023). The operator of the world’s largest cryptocurrency exchange admitted knowing that it had a significant number of users in comprehensively sanctioned jurisdictions (such as Iran) and a significant number of users in the United States. Despite this knowledge, it did not implement controls to prevent transactions between U.S. users and users in Iran, resulting in nearly $900 million in transactions between users in the two countries over a four-year period.
How Is the Extraterritorial Reach of U.S. Sanctions Evolving?
The scope of U.S. sanctions enforcement has not stood still. Since 2022, each year has brought significant expansions in the authorities’ ability to reach non-U.S. companies. Recent trends confirm that the risk for non-U.S. companies is growing.
What Changed with the Extension of the Record-Keeping Period to 10 Years?
In March 2025, an amendment took effect that extended the record-keeping period for sanctions-related records from 5 to 10 years. This extension has a direct operational consequence: companies with jurisdictional nexuses to the United States must keep compliance documentation for a decade.
The practical implication goes beyond archiving. A longer statute of limitations means OFAC can investigate and penalize transactions carried out up to ten years ago. For a company that has processed dollar payments, used U.S. technology or employed persons with U.S. citizenship, this retroactively widens the window of exposure.
What Risk Do Other Countries’ Anti-Sanctions Laws Add?
Companies with international operations face a growing risk of conflict of laws. While the United States expands the extraterritorial reach of its sanctions, other countries have passed legislation prohibiting their companies from complying with foreign sanctions.
The European Union has maintained the Blocking Statute (Regulation 2271/96) since 1996, which prohibits European companies from complying with certain extraterritorial U.S. sanctions. In practice, enforcement of this regulation has been limited, but its existence creates a legal gray area for companies that deal simultaneously with counterparties in the United States and in sanctioned jurisdictions.
For non-U.S. companies, this scenario of double regulatory exposure means there is no universally safe answer. Every decision must be assessed in light of U.S. regulations, local anti-sanctions legislation and the practical implications of each option.
What Should a Non-U.S. Company Do to Protect Itself?
Exposure to U.S. sanctions cannot be eliminated. It is managed. A non-U.S. company with active jurisdictional nexuses cannot ignore these regulations without taking on a risk that can reach millions of dollars in civil penalties, up to 20 years in prison for its executives and exclusion from the U.S. financial system.
Building a complete compliance program requires a structured approach and dedicated resources. But before reaching that point, there are immediate steps any company can take to assess and reduce its exposure.
What Immediate Steps Should Your Company Take?
Map your jurisdictional nexuses. Identify whether your company transacts in dollars, uses U.S.-origin technology, employs persons with U.S. citizenship or permanent residence, or is owned by a U.S. entity. A single active nexus is enough to create obligations.
Screen all counterparties against the SDN List, among others. Customers, suppliers, partners, intermediaries and beneficial owners should be checked against OFAC’s Specially Designated Nationals List and against the BIS Entity List. This check is not a one-off exercise: it must be repeated with every list update and every new business relationship.
Review USD transactions. Every payment your company makes or receives in dollars passes through U.S. correspondent banks. If any counterparty to those transactions is sanctioned, the payment will be blocked and your company will be exposed to an investigation.
Audit the supply chain for U.S.-origin technology. Components, software, usage licenses and manufacturing equipment: if the controlled U.S.-origin content exceeds the de minimis threshold, or the use of U.S.-origin technology or equipment triggers one of the FDPRs, your product is subject to the EAR.
Identify the U.S. persons in the organization. Executives, directors, employees and advisors with U.S. citizenship or a green card are subject to OFAC at all times. Their involvement in transactions with sanctioned countries or entities can create liability for the whole company.
Document everything for at least 10 years. Since March 2025, the record-keeping period has been a decade. This includes compliance decisions, screening results, risk analyses and any communications related to transactions with jurisdictional nexuses.
At Burke Compliance, we are specialists in OFAC economic sanctions. If you want to know exactly what U.S. authorities expect from non-U.S. companies, download our analysis of the official documents: what OFAC, BIS and DOJ have already warned non-U.S. companies about (in Spanish).
