OFAC does not just monitor: it penalizes. And it does so with a reach that extends beyond U.S. borders.
In 2025 alone, civil penalties imposed by the Office of Foreign Assets Control (OFAC) exceeded $265 million. The previous year, the figure was around $49 million. In 2023, it reached $1.5 billion, driven by the Binance settlement. These are not theoretical figures: they are amounts that real companies —many of them non-U.S.— had to pay for violating U.S. economic sanctions.
This article explains what types of penalties OFAC imposes, how it assesses their severity, what has happened to specific companies that violated sanctions and what a company can do if it detects a possible violation. If you first need to understand what this agency is and why it may affect you, see our guide on what OFAC is.
What Is OFAC and Where Does Its Authority Come From?
OFAC is the Office of Foreign Assets Control, a division of the U.S. Department of the Treasury founded in 1950. It administers and enforces U.S. government economic sanctions programs against countries, regimes, organizations and individuals.
Its main legal basis is the International Emergency Economic Powers Act (IEEPA), which empowers the U.S. President to declare national emergencies and block foreign assets under U.S. jurisdiction. OFAC implements that mandate through regulations that are binding on financial institutions, companies and individuals.
OFAC has the power to impose civil penalties, freeze assets, prohibit access to the U.S. financial system and designate persons or entities as sanctions targets. Its decisions take effect immediately upon publication.
What Types of Penalties Does OFAC Impose on Companies?
The consequences of violating OFAC sanctions fall into three categories: civil penalties (administrative), criminal penalties and operational consequences. They can occur simultaneously in the same case.
The difference between them is not just the amount. Civil penalties are imposed directly by OFAC without a trial. Criminal penalties require the involvement of the Department of Justice (DOJ) and proof of intent. Operational consequences, for their part, can be more damaging in the long run than the fine itself.
What Are OFAC Civil Penalties and How Are They Calculated?
Civil penalties are administrative fines that OFAC imposes directly, without judicial involvement. Their most relevant feature is that they operate under a strict liability regime: the company can be penalized even if it did not know it was violating the regulations.
The maximum amount per individual violation depends on the enabling statute. Under the International Emergency Economic Powers Act (IEEPA), the penalty can reach $377,700 per violation, or twice the value of the transaction underlying the violation —whichever is greater. This amount is adjusted annually under the Federal Civil Penalties Inflation Adjustment Act of 1990.
Penalties accumulate for each prohibited transaction. A company that processed 500 payments through the U.S. financial system linked to a sanctioned jurisdiction faces 500 individual violations, each with its own potential penalty.
OFAC publishes its calculation criteria in the Economic Sanctions Enforcement Guidelines (31 C.F.R. Part 501, Appendix A). These guidelines set a base penalty amount that is then adjusted up or down based on aggravating and mitigating factors.
When Are Criminal Penalties Imposed for OFAC Violations?
Criminal penalties are reserved for willful violations. Unlike civil penalties, here it must be proven that the company or individual acted knowingly and with intent to violate the law.
Criminal prosecution of violations falls to the Department of Justice (DOJ). The maximum penalties under IEEPA and the Export Control Reform Act (ECRA) are 20 years in prison and a $1 million fine per violation (50 U.S.C. § 1705(c) and 50 U.S.C. § 4819(b)).
These penalties apply to both companies and individuals. An executive who authorizes, facilitates or participates in a prohibited transaction may face federal criminal charges personally, regardless of whether the company is also prosecuted.
In practice, DOJ has stepped up its activity in recent years. The joint note from the Department of Commerce, the Department of the Treasury and DOJ published in March 2024 (known as the Tri-Seal Compliance Note) details multiple criminal prosecutions of foreign nationals for attempting to transfer U.S. technology to prohibited destinations, including Latvian, Ukrainian, Iranian and Chinese nationals.
What Operational Consequences Can a Company Sanctioned by OFAC Suffer?
The operational consequences of a violation can exceed the economic impact of the fine itself. The first is asset blocking: OFAC can freeze any asset or property subject to U.S. jurisdiction, immediately prohibiting any transfer or transaction related to that property.
The second is exclusion from the U.S. financial system. A company that loses access to U.S. dollar payment channels is cut off from most international trade. U.S. correspondent banks stop processing its transactions. International financial institutions, as part of their own risk management, sever commercial relationships with the company concerned.
The third is the reputational cascade effect. Customers, suppliers and business partners that deal with the United States —or that simply want to avoid risk— distance themselves. International contracts include sanctions compliance clauses, and a known violation can trigger early termination clauses in dozens of business relationships at the same time.
The case of Banco Delta Asia in Macau (China) illustrates this effect. In 2005, the mere threat of designation by FinCEN triggered a massive withdrawal of deposits: 34% in a few days. The bank had to enter insolvency proceedings before the formal designation took effect.
How Does OFAC Determine the Severity of a Violation?
OFAC classifies each violation into one of two categories: egregious or non-egregious. This classification is decisive because it determines the penalty range and the severity of any additional measures.
To decide which category a case falls into, OFAC applies the General Factors (A to K) set out in its Economic Sanctions Enforcement Guidelines. These factors assess the full set of circumstances surrounding the violation, not just the individual transaction.
What Factors Aggravate an OFAC Penalty?
The factors that lead OFAC to classify a violation as egregious —and therefore to impose more severe penalties— are the following:
- Willful or reckless conduct: the company acted knowing that the activity was prohibited, or recklessly ignored obvious warning signs.
- Active concealment: manipulating documentation, removing references to sanctioned parties from payment messages (stripping), or using shell companies or intermediaries to disguise the real destination of goods or funds.
- Pattern of repeated conduct: the violation was not an isolated incident but a practice sustained over months or years.
- Management knowledge: the company’s leadership knew or should have known that the activity was taking place.
- Size and sophistication of the organization: OFAC expects more from large, well-resourced companies. A multinational with legal and compliance departments has less room for excuses than a small business.
- Harm to U.S. foreign policy objectives: severity increases when the violation benefits regimes or persons that pose a direct threat to national security.
A recent example: in 2024, OFAC classified as egregious the conduct of SCG Plastics Co., Ltd. (Thailand) for concealing the Iranian origin of polyethylene resin that it reexported through the United Arab Emirates. The company manipulated shipping documents to disguise the product’s origin. The penalty was $20 million.
What Factors Can Reduce an OFAC Penalty?
The most powerful mitigating factor is voluntary self-disclosure (VSD). When a company detects a possible violation and proactively reports it to OFAC before the agency opens its own investigation, the base penalty amount is substantially reduced.
Other mitigating factors recognized in the Enforcement Guidelines include:
- An effective compliance program (Sanctions Compliance Program, or SCP): OFAC assesses whether the company had a compliance program in place at the time of the violation, and whether that program was genuine rather than merely on paper.
- Full cooperation with the investigation: providing documents, access to employees and transparency throughout the process.
- Immediate remedial measures: stopping the violating activity, identifying the root cause and implementing compensating controls.
- Lack of prior knowledge: the company did not know and had no reason to know that the transaction was prohibited (a mitigating factor for civil penalties, although strict liability still applies).
OFAC has published a specific framework for assessing compliance programs: A Framework for OFAC Compliance Commitments. This framework sets out five components every program should have: management commitment, risk assessment, internal controls, testing and auditing, and training. Companies that meet these five components are in a better position to negotiate a reduction in the event of a violation.
What Real Cases Illustrate the Consequences of Violating OFAC Sanctions?
OFAC publishes all its enforcement actions on its official website. Recent cases reveal three clear patterns: penalties are growing, geographic reach is expanding and non-U.S. companies are a frequent target.
Which Non-U.S. Companies Have Been Penalized by OFAC in Recent Years?
The following cases, verified against official sources, illustrate the real exposure of non-U.S. companies:
Toll Holdings Limited (Australia, 2022). This international logistics and transportation company agreed to pay $6,131,855 to settle 2,958 apparent violations of multiple sanctions programs. The violations consisted of originating or receiving payments through the U.S. financial system in connection with shipments involving North Korea, Iran and Syria. OFAC determined that Toll acted recklessly by failing to implement policies to prevent the prohibited transactions.
Alfa Laval Middle East Ltd. (United Arab Emirates, 2021). A subsidiary of a foreign parent, it agreed to pay $415,695 for conspiring with companies in Dubai and Iran to export storage tank cleaning equipment from the United States to Iran. The company falsely listed a Dubai company as the end user in the export documentation to conceal the real destination of the goods.
Swedbank Latvia AS (Latvia, 2023). A subsidiary of a Swedish international financial institution, it agreed to pay $3,430,900 for 386 apparent violations of the Crimea sanctions. A customer used Swedbank Latvia’s online banking platform from an IP address located in the sanctioned jurisdiction to send payments through U.S. correspondent banks.
Binance Holdings Limited (2023). The world’s largest cryptocurrency exchange agreed to pay $968,618,825 to OFAC to settle 1,667,153 apparent violations of multiple sanctions programs. In addition, as part of the global resolution with DOJ (which also covered Bank Secrecy Act violations), Binance agreed to total penalties of $4.3 billion. Binance knew it had users in sanctioned jurisdictions such as Iran and did not implement controls to prevent transactions between U.S. users and users in those jurisdictions.
GVA Capital Ltd. (2025). OFAC imposed a penalty of $215.99 million —the largest individual civil penalty of the year— on this investment management firm for managing U.S. assets linked to a sanctioned Russian oligarch and failing to comply with an OFAC administrative subpoena.
These cases show that OFAC acts against companies of any size, sector and jurisdiction. For a detailed analysis of why these sanctions reach non-U.S. companies, see our article on sanctions against non-U.S. companies.
What Trends Do OFAC’s Recent Enforcement Actions Show?
OFAC’s 2024 and 2025 enforcement actions reveal five trends every company with U.S. exposure should know:
1. Sustained focus on Russia. In 2025, eight of the fourteen enforcement actions published by OFAC related to violations of Russia sanctions. The designation of entities such as Lukoil and Rosneft in October 2025 confirms that this program remains a priority.
2. Individual liability. OFAC no longer limits itself to penalizing the corporate entity. Three of the 2025 actions targeted individuals for managing assets or facilitating transactions linked to sanctioned Russian oligarchs.
3. Scrutiny of intermediaries and advisors. OFAC has expressly stated that gatekeepers —investment advisors, real estate managers, lawyers, consultants— have their own compliance obligations. Their role as facilitators of access to assets or markets makes them a direct enforcement target.
4. Longer statute of limitations. Since March 2025, the period during which OFAC can investigate and penalize violations has been extended from 5 to 10 years. Companies must keep records for a decade and cannot count on an old violation going unpunished.
5. Maximum penalties more frequent. OFAC is showing greater willingness to impose penalties at the upper end of the Enforcement Guidelines, particularly when the company did not cooperate, concealed information or lacked an effective compliance program.
What Should a Company Do If It Detects a Possible OFAC Violation?
The first step is to immediately stop the suspicious activity. Do not close the transaction, do not delete records and do not try to “fix” the situation internally before documenting it. Every additional transaction processed while a known violation exists becomes a new violation and an aggravating factor.
The second step is to document everything. OFAC views rigorous record-keeping favorably. Gather the transaction documents, internal communications, screening system reports and any prior red flags that were generated.
The third is to assess the real scope of the violation. Is it an isolated transaction or a pattern? Does it affect a single sanctions program or several? Are there more similar transactions that have not yet been identified?
The fourth —and the most relevant in terms of reducing the penalty— is to consider voluntary self-disclosure. The joint Compliance Note published by OFAC, BIS and DOJ expressly recommends that companies that detect possible violations report them proactively to the competent agency. Self-disclosure is the mitigating factor that carries the most weight in determining the penalty.
This whole process should be handled with specialist guidance on U.S. sanctions. The decisions made in the first hours —whether or not to self-disclose, the scope of the internal investigation, communication with third parties— irreversibly shape the final outcome. If your company needs to assess its level of exposure or has identified a possible violation, a structured OFAC compliance program is the tool to manage it.
If you want to know exactly what OFAC, BIS and DOJ have told non-U.S. companies about their obligations, download our analysis of the official OFAC, BIS and DOJ documents on non-U.S. companies (in Spanish).
Related service. If this issue affects your company, at Burke Compliance we analyze it as part of our economic sanctions (OFAC) service.
Frequently Asked Questions About OFAC Sanctions on Companies
Can OFAC penalize a company that did not know it was violating sanctions?
Yes. OFAC civil penalties apply under a strict liability regime. A company can be penalized even if it had no knowledge of or intention to violate the regulations. Lack of knowledge may be considered a mitigating factor, but it does not exempt the company from liability.
What is the maximum penalty OFAC can impose?
Under IEEPA, the maximum penalty per individual violation is $377,700 or twice the value of the transaction, whichever is greater. This figure is adjusted annually for inflation. Penalties accumulate for each prohibited transaction: a case involving hundreds or thousands of transactions can result in penalties of hundreds of millions of dollars.
How long does OFAC have to investigate a violation?
Since March 2025, the statute of limitations for violations of sanctions administered by OFAC has been extended from 5 to 10 years. Companies must keep records for at least a decade and cannot assume that a past violation is time-barred.
Does voluntary self-disclosure reduce the penalty?
Yes. Voluntary self-disclosure (VSD) is one of the most heavily weighted mitigating factors in the Economic Sanctions Enforcement Guidelines. Proactively reporting a possible violation to OFAC before the agency opens its own investigation can substantially reduce the base penalty amount.
Can executives be penalized personally?
Yes. OFAC can impose civil penalties on individuals. DOJ can bring criminal charges carrying up to 20 years in prison. In 2025, three of the fourteen published enforcement actions targeted individuals rather than corporate entities. The SDN List includes both companies and individuals.
What is the difference between an egregious and a non-egregious violation?
OFAC determines the classification by applying the General Factors in its Enforcement Guidelines. An egregious violation involves willful or reckless conduct, concealment, a pattern of repeated conduct or management knowledge. An egregious classification places the penalty in the upper range of the scale and may be accompanied by additional measures, such as naming the company publicly.
If your company operates in international markets, invoices in U.S. dollars, works with U.S.-origin technology or has counterparties linked to sensitive jurisdictions, assessing your level of exposure cannot wait. Contact Burke Compliance.
