OFAC (Office of Foreign Assets Control) is the U.S. Department of the Treasury agency that administers and enforces U.S. government economic sanctions. Its sanctions reach companies in any country in the world if their transactions have any U.S. nexus.
You do not need to be headquartered in the United States, have customers there or ever have done business there. A U.S. dollar transfer, a U.S.-origin component or an executive with U.S. citizenship is enough to trigger OFAC jurisdiction over a non-U.S. company.
This guide explains what OFAC is, how its sanctions work, whom they apply to and what an organization should do if it finds it is exposed to U.S. regulations.
What Is OFAC and Where Does Its Authority Come From?
OFAC is the Office of Foreign Assets Control, a division of the U.S. Department of the Treasury founded in 1950. It administers and enforces U.S. government economic sanctions programs against countries, regimes, organizations and individuals.
Its main legal basis is the International Emergency Economic Powers Act (IEEPA), which empowers the U.S. President to declare national emergencies and block foreign assets under U.S. jurisdiction. OFAC implements that mandate through regulations that are binding on financial institutions, companies and individuals.
OFAC has the power to impose civil penalties, freeze assets, prohibit access to the U.S. financial system and designate persons or entities as sanctions targets. Its decisions take effect immediately upon publication.
What Tools Does OFAC Use to Enforce Its Sanctions?
OFAC operates through three mechanisms:
- Asset blocking: immediately freezes any property or interest in property under U.S. jurisdiction belonging to designated persons or entities. Any transfer or transaction involving those assets is prohibited without express authorization.
- Trade restrictions: prohibits imports, exports and the provision of services involving certain countries, sectors or entities. In some programs, the embargo is almost total.
- Designation of persons and entities: places individuals and organizations on sanctions lists that trigger automatic prohibitions for anyone subject to U.S. jurisdiction.
The most widely used tool is the SDN List (Specially Designated Nationals and Blocked Persons List). Any entity on it is blocked: its assets are frozen and no person under U.S. jurisdiction may deal with it. OFAC administers more than 30 active sanctions programs simultaneously, each with its own lists and restrictions.
To understand what it means for a counterparty to appear on the SDN List and how to check it, see our guide on the OFAC SDN List.
Whom Do OFAC Sanctions Apply To?
OFAC sanctions apply at three distinct levels.
The first covers all U.S. persons and companies: U.S. citizens and permanent residents anywhere in the world, individuals and legal entities within U.S. territory, and entities organized under U.S. law, including their foreign branches.
The second level includes foreign entities owned or controlled by U.S. persons. In certain programs —such as those for Cuba or Iran— foreign subsidiaries of U.S. companies or persons are also required to comply with the applicable restrictions.
The third level reaches non-U.S. companies with a jurisdictional nexus to the United States. Any foreign organization that uses U.S. infrastructure, technology, currency or intermediaries in its operations may become subject to certain OFAC prohibitions. This is the level that creates the most uncertainty among companies operating outside the United States.
Why Can OFAC Reach Companies Outside the United States?
OFAC has extraterritorial reach: it can penalize non-U.S. companies for transactions carried out entirely outside the United States if any of these jurisdictional nexuses is present:
- U.S. dollar (USD) transactions: any dollar payment passes at some point through the U.S. correspondent banking system. That alone triggers OFAC jurisdiction, regardless of the country of origin or destination of the payment.
- U.S.-origin technology, software or components: exporting, reexporting or transferring U.S.-origin technology without the required authorization may constitute a violation of OFAC regulations and of the EAR and ITAR export controls, even if the seller is not American.
- Directors, executives or employees with U.S. citizenship or permanent residence (green card): their presence in the organization could create compliance obligations for the whole company, regardless of where it is headquartered or incorporated.
- Subsidiaries, partners or shareholders controlled by U.S. persons: if a U.S. entity owns or controls part of the organization, certain sanctions programs extend their obligations to the entire corporate structure.
OFAC, BIS and DOJ have published official guidance expressly warning of the extraterritorial application of these rules to companies outside the United States. In documented enforcement cases, ignorance of the regulations was not considered a mitigating factor in any of the penalties imposed.
Does your organization operate internationally or have any of these U.S. nexuses? Download the free checklist to assess where you could be exposed to OFAC sanctions and to EAR and ITAR export controls.
→ Download the OFAC / EAR / ITAR Risk Checklist — Free (in Spanish)
Which OFAC Sanctions Programs Matter Most to Non-U.S. Companies?
OFAC manages more than 30 active sanctions programs. The ones with the greatest practical impact for companies with international operations are:
- Russia and Belarus: since February 2022, these programs include sectoral restrictions on energy, finance, technology and defense, as well as extensive individual designations. They affect exporters, manufacturers and financial companies with any activity linked to those regions.
- Iran: one of the broadest and most restrictive programs. It covers a near-total embargo on financial, commercial and technology transactions. Any indirect link to Iranian entities can trigger liability.
- Cuba: a long-standing embargo with very broad restrictions. Under this program, foreign subsidiaries of U.S. companies are also expressly required to comply with the applicable restrictions.
- Venezuela: sectoral sanctions on the energy sector and individual designations of government officials and affiliated entities. Relevant for companies with operations in the region’s extractive or financial sectors.
- North Korea: a near-total embargo. Especially relevant for companies with supply chains in Asia.
- China — specific entities: there are no general sanctions on China, but a growing number of Chinese companies and individuals are designated on the SDN List or on the BIS Entity List. Dealing with them without prior screening creates a real risk of non-compliance.
Each program has its own restrictions, exceptions and authorized licenses. For a detailed analysis of which countries are under U.S. sanctions and which transactions are prohibited, see our guide on countries sanctioned by OFAC.
What Are the Consequences of Violating OFAC Sanctions?
The consequences of non-compliance are of three distinct types and can occur simultaneously in the same case.
Civil penalties. OFAC applies a strict liability regime: a company can be penalized even if it had no intention of violating the rules. The maximum civil penalty under IEEPA is $377,700 per violation (in effect since January 2025; there was no inflation adjustment in 2026), or twice the value of the transaction if that amount is greater. In cases with multiple violations, penalties accumulate for each prohibited transaction.
Criminal penalties. Willful violations are federal crimes under IEEPA and the Export Control Reform Act (ECRA). The Department of Justice can criminally prosecute individuals and companies, with penalties of up to 20 years in prison and fines of up to $1 million per violation.
Operational consequences. Beyond the fines, non-compliance can lead to blocked bank accounts, exclusion from the U.S. financial system, loss of access to U.S. suppliers and customers, and designation of the company itself as a sanctioned entity. These operational consequences can be more damaging to the business than the fines themselves.
For a detailed analysis of the types of penalties and real cases of non-U.S. companies penalized by OFAC, see our guide on OFAC sanctions and their consequences.
How Does OFAC Relate to BIS and the EAR and ITAR Export Controls?
OFAC is not the only U.S. body with the power to penalize non-U.S. companies. Three different agencies act in this space with complementary powers:
- OFAC — Department of the Treasury: administers economic sanctions. Its focus is on sanctioned persons, entities and countries, and on financial and commercial transactions with them. Its main tool is the SDN List.
- BIS — Bureau of Industry and Security, Department of Commerce: administers the Export Administration Regulations (EAR), which control the export and reexport of dual-use goods, technology and software. Its equivalent tool is the Entity List.
- DDTC — Directorate of Defense Trade Controls, Department of State: administers ITAR (International Traffic in Arms Regulations), which regulates defense articles and services on the U.S. Munitions List (USML).
A single transaction can trigger obligations before all three agencies at the same time. A company that exports advanced technology to a sanctioned country may be violating OFAC regulations, the EAR and ITAR in the same transaction.
To understand how export controls work and when they apply to non-U.S. companies, see our guide on U.S. export controls: EAR and ITAR.
What Should an Organization Do If It Finds It Is Exposed to OFAC?
The first step is to identify whether the organization has any jurisdictional nexus to the United States: whether it transacts in dollars, uses U.S.-origin technology or software, has executives with U.S. citizenship or a green card, or operates in markets connected to sanctioned jurisdictions.
The second step is to systematically screen commercial and financial counterparties against the OFAC SDN List, the BIS Entity List and other applicable lists. Dealing with a sanctioned entity unknowingly does not eliminate liability: OFAC applies strict liability in civil matters.
The third step is to design or update the internal compliance program. In its Framework for OFAC Compliance Commitments, OFAC expressly states that the existence of a robust, good-faith compliance program is one of the most relevant factors when determining the penalty and when classifying a violation as non-egregious.
At Burke Compliance we specialize in OFAC and carry out exposure assessments, counterparty reviews and compliance program design tailored to each organization’s operational reality.
Request an initial consultation.
Frequently Asked Questions About OFAC
Can OFAC penalize a company that has never operated in the United States?
Yes. OFAC can penalize non-U.S. companies if their transactions involve a jurisdictional nexus: U.S. dollar transactions, use of U.S.-origin technology, executives with U.S. citizenship or a green card, or subsidiaries controlled by U.S. persons. Documented enforcement cases against Australian, European and Asian companies confirm this.
What happens if a company deals with a sanctioned country without knowing it?
OFAC applies strict liability to civil sanctions. Lack of knowledge does not eliminate liability, and a company can be penalized even if it did not intend to violate the rules. The existence of an active, documented compliance program is, however, considered a mitigating factor when determining the amount of the penalty.
What is the difference between the SDN List and the BIS Entity List?
The SDN List is administered by OFAC and includes individuals, companies and entities with which dealings are prohibited in all circumstances without an express license. The Entity List is administered by BIS and includes entities to which certain exports of goods and technology subject to the EAR are restricted. An entity may appear on one list, on both or on neither, and the applicable restrictions differ in each case.
Does my organization need an OFAC compliance program?
OFAC does not formally require a compliance program, but it expressly recommends one for any organization that deals with the United States or uses its infrastructure. The absence of a compliance program is considered an aggravating factor in any investigation. For organizations with real exposure, a documented program reduces the risk of a penalty and its amount in the event of a violation.
What is an OFAC license and when is one needed?
An OFAC license is an express authorization from the U.S. government to carry out a transaction that would otherwise be prohibited under current sanctions. There are two types: general licenses, which authorize categories of transactions predefined in the regulations, and specific licenses, which require an individual, reasoned application to OFAC. They are needed when an organization must deal with a sanctioned country, entity or sector and no exception applies to its specific case.
When did OFAC come into being and what is its legal basis?
The Division of Foreign Assets Control, OFAC’s direct predecessor, was established in December 1950. OFAC carries out its mandate mainly under the authority of the IEEPA (International Emergency Economic Powers Act), the Trading with the Enemy Act (TWEA) and other statutes that authorize specific sanctions programs. The regulations issued under these laws are binding and directly applicable.
