What are the penalties for OFAC violations?

Two features of OFAC penalties surprise people who meet them for the first time. Civil liability is strict — OFAC does not have to show that the violator knew the counterparty was sanctioned — and the statutory maximum applies per violation, so a hundred prohibited payments are a hundred violations. In practice OFAC settles most cases well below the maximum, using published guidelines that reward self-disclosure, cooperation and a working compliance program.

The scale is real nonetheless. OFAC's 2025 enforcement year closed at 14 actions totalling $265,746,819, led by a $215,988,868 penalty on the venture firm GVA Capital. By 27 October 2026 the current year stood at 10 actions and $297,513,285, including a $275,000,000 settlement with Adani Enterprises in May and $11,662,930 with Bank of America in October.

The maximum depends on the statute the sanctions program rests on. Most programs are issued under IEEPA, whose maximum is adjusted for inflation; the January 2025 adjustment set the figures below, and as of 8 November 2026 OFAC has published no 2026 adjustment, so they remain current. On 25 September 2026 OFAC consolidated its penalty and enforcement-procedure provisions into a new 31 CFR Part 505, the Sanctions Penalties Regulations, which restates the IEEPA maximum and confirms that the Enforcement Guidelines in Appendix A to Part 501 still govern how cases are assessed.

OFAC's Economic Sanctions Enforcement Guidelines (31 CFR Part 501, Appendix A, 2009) set out the process. First OFAC chooses a response — no action, a request for information, a cautionary letter, a Finding of Violation with no penalty, a civil monetary penalty, a criminal referral, or an administrative action such as a licence revocation. If it imposes a penalty, it decides whether the case is egregious, computes a base amount from the matrix below, then adjusts it up or down using eleven General Factors:

For non-egregious cases that were not self-disclosed, the base penalty is a fixed amount keyed to the size of the transaction rather than a percentage. A voluntary self-disclosure is a self-initiated notification to OFAC made before OFAC or another agency learns of the conduct, complete and accurate and followed by a full report; a disclosure prompted by a blocked-transaction report another party was required to file does not qualify.

OFAC publishes every civil penalty, settlement and Finding of Violation on its Civil Penalties and Enforcement Information page, one table per year since 2003, with a web notice for each that explains the conduct and the factors weighed. The largest actions of the last two years, as published there on 8 November 2026:

Criminal liability requires a wilful violation and is prosecuted by the Department of Justice, not OFAC. Under IEEPA, as restated in 31 CFR 505.401, a wilful violation, attempt, conspiracy or aiding and abetting carries a fine of up to $1,000,000, imprisonment of up to 20 years for a natural person, or both — on top of any civil penalty. OFAC's 2019 Framework lists individual liability among its root causes of violations: employees who caused or facilitated a violation have been penalised personally, and OFAC's enforcement tables record several settlements with individuals in 2025 and 2026.

The guidelines reward four things, and the enforcement notices repeat them case after case: