What is OFAC?

The OFAC meaning most people need is the practical one: OFAC is the agency behind the sanctions list a bank, exchange or payment company checks you against. It sits within Treasury's Office of Terrorism and Financial Intelligence, and its lists — above all the Specially Designated Nationals and Blocked Persons list — are the reference data behind the phrase "OFAC check".

OFAC is the successor to the Office of Foreign Funds Control, set up in 1940 after the German invasion of Norway to keep occupied countries' assets out of Axis hands. OFAC itself was formally created in December 1950, after China entered the Korean War, when President Truman declared a national emergency and blocked all Chinese and North Korean assets under US jurisdiction. The tools have not changed much since: block the property, prohibit the dealings, license the exceptions, penalise the breaches.

OFAC administers sanctions programs — country-based ones such as Cuba, Iran and North Korea, and conduct-based ones such as counter-terrorism, counter-narcotics, cyber and non-proliferation — under statutes including the International Emergency Economic Powers Act and the Trading with the Enemy Act, and under executive orders issued for each program. Within those programs it does four things.

OFAC publishes two families of list. The SDN list names blocked parties: a match means freeze and reject. The Non-SDN lists, published together as the Consolidated Sanctions List, name parties subject to narrower restrictions — sectoral debt and equity limits, securities bans, correspondent-account restrictions — where only the activity named by the program is prohibited. Both are published as free data files and change irregularly, as designations, amendments and removals are made.

OFAC also maintains country programs. Whether a jurisdiction is comprehensively embargoed or subject to a targeted program is a separate question from whether a party is listed, and a compliance program has to answer both.

OFAC's answer (FAQ 11) is every US person: all US citizens and permanent residents wherever they are located, everyone physically in the United States, all US-incorporated entities and their foreign branches, and — under some programs — foreign subsidiaries owned or controlled by US persons. Non-US persons are not directly bound, but they may not cause a US person to violate sanctions or help a sanctioned party evade them, and a payment that clears in US dollars touches the US financial system.

Asking what services are subject to OFAC regulations therefore has a short answer: any service a US person provides, and any transaction that passes through US jurisdiction. Banks, broker-dealers, insurers, money transmitters, crypto exchanges, marketplaces and software companies with a US nexus all fall in scope, whatever their industry regulator says.

In banking, OFAC is the compliance function that screens customers, counterparties and payments against OFAC's lists and country programs, and blocks or rejects what matches. A bank screens at account opening, re-screens its customer base when the lists change, and screens every wire and ACH message in flight. A confirmed SDN match on a customer is blocked — the funds are frozen in an interest-bearing account and reported to OFAC within ten business days; a prohibited payment that cannot be blocked is rejected and reported the same way.

OFAC's A Framework for OFAC Compliance Commitments (2 May 2019) describes what it expects a sanctions compliance program to contain: management commitment, risk assessment, internal controls, testing and auditing, and training. The same five components apply to a fintech or crypto platform as to a bank; the framework is written for any organisation subject to US jurisdiction.

OFAC screening is checking an identifier — a name, a government ID number, an email address, a website, a crypto wallet address — against OFAC's lists, and checking a location against its country programs. The screening is only as good as the list copy behind it: OFAC publishes changes irregularly, so a screen against last month's file misses this week's designations.

CompliAPI's screening endpoints check crypto addresses, emails, websites and government IDs against the SDN list, the Non-SDN Consolidated list and other government sanctions lists in one request, with OFAC's publication stream polled every 15 minutes. Matches are exact on normalised identifiers (government IDs also match on substrings, ranked by similarity); every match names the list and links the official record. The ?lists=ofac filter narrows a check to OFAC alone.

Violations carry civil and, in some cases, criminal penalties (OFAC FAQ 12). Civil liability is strict: OFAC does not need to show that the violator knew a party was sanctioned. The statutory maximum civil penalty per violation under IEEPA, adjusted for inflation each January, was set at $377,700 or twice the value of the underlying transaction, whichever is greater, by the January 2025 adjustment (Federal Register, 15 January 2025); the TWEA maximum was set at $111,308. OFAC's enforcement guidelines then weigh factors such as wilfulness, awareness, harm to program objectives, the size of the business and the quality of its compliance program, and voluntary self-disclosure can halve the base penalty.

Criminal prosecution — for wilful violations — is a matter for the Department of Justice and can bring fines and imprisonment on top of the civil penalty.