Office of Foreign Assets Control (OFAC) compliance is essential for financial institutions and companies that conduct business with foreign entities and individuals. However, it is also extremely challenging. There are numerous aspects to OFAC regulations compliance, and no two institutions’ or companies’ compliance obligations are exactly alike. 

As a result, when assessing their OFAC compliance obligations, financial institutions and companies must do so on an individualized basis. The Office of Foreign Assets Control has published several resources that institutions and companies can (and should) use. These resources include:  

1. OFAC’s Sanctions Programs 

The Office of Foreign Assets Control has established several economic and trade sanctions programs that either prohibit or restrict financial transactions involving designated foreign nations, entities, and individuals. These OFAC sanctions programs fall into four broad categories: (i) country-based sanctions, (ii) list-based sanctions (also known as “smart sanctions”), (iii) sector-based sanctions, and (iv) secondary sanctions that apply to parties affiliated with blocked entities and individuals. Information about all of OFAC’s sanctions programs is available through the Office’s website, and users can search for sanctions that apply to specific nations, entities, and individuals. 

2. OFAC’s General Licenses 

General licenses permit transactions that would otherwise be blocked under an OFAC sanctions program. The Office of Foreign Assets Control has issued several general licenses which are available for use by financial institutions and companies in the United States. When determining what compliance efforts are necessary, institutions and companies should not only determine which sanctions programs apply, but also whether they can structure their transactions or operations to secure protection under any general licenses that are currently in effect.  

3. A Framework for OFAC Compliance Commitments  

A Framework for OFAC Compliance Commitments (the “Framework”) is a guidance document that OFAC published to help financial institutions and companies assess the sufficiency and efficacy of their OFAC compliance programs (which OFAC refers to as “sanctions compliance programs” or “SCPs”). The Framework identifies “five essential components of compliance” and provides insight into what financial institutions and companies can (and should) do to meet OFAC’s expectations in these areas.  

Crucially, however, the Framework also makes clear that these “five essential components” are not the only essential components of an SCP. Thus, while the Framework is instructive, it does not truly serve as a framework for building a comprehensive compliance program.  

4. Economic Sanctions Enforcement Guidelines 

OFAC’s Economic Sanctions Enforcement Guidelines (the “Guidelines”) provide additional key insights by explaining how and when the Office pursues enforcement actions against financial institutions and companies. Among other things, the Guidelines define what constitutes an “apparent violation” of the laws and regulations falling within OFAC’s enforcement jurisdiction, explain when self-disclosure of an apparent violation may be required, and outline the factors OFAC considers when determining what penalties (if any) are warranted.  

5. OFAC Risk Matrix 

The OFAC Risk Matrix is appended to the Guidelines. In explaining the Risk Matrix’s utility, OFAC simply states that it “can be used by financial institutions [and companies] to evaluate their compliance programs.” But, despite this brief explanation, the OFAC Risk Matrix provides several key insights, and financial institutions and companies should utilize the Risk Matrix not only when evaluating existing compliance programs, but also when developing new compliance programs or overhauling their current compliance efforts.  

The Risk Matrix identifies 13 key areas of compliance and then provides examples of practices that OFAC considers to be “low,” “moderate,” or “high” risk. Any time a financial institution’s or company’s practices fall into the “moderate” or “high” risk category, this indicates that the institution or company should devote special attention to addressing compliance in this area.  

6. OFAC Information for Industry Groups 

OFAC has published additional compliance resources for certain industry groups. These resources—which include guidance documents, fact sheets, FAQs, and industry brochures—are also publicly available on OFAC’s website.  

Since OFAC makes these resources publicly available, it expects all covered financial institutions and companies to address them when developing their SCPs. Currently, the industry groups for which OFAC has published specific guidance include:  

• Instant Payment Systems 

• Credit Reporting 

• Exporters and Importers 

• Financial Sector 

• Insurance Industry 

• Legal and Compliance Services Sector 

• Money Service Businesses 

• Non-Governmental Organizations (NGO)/Non-Profit 

• Virtual Currency Industry  

Many financial institutions and companies will fall into two or more of these industry groups. When this is the case, they must address all pertinent industry-specific compliance requirements that apply. While this can add substantially to these entities’ compliance burdens, OFAC expects all entities to maintain full compliance regardless of what this entails.  

7. OFAC FAQs 

OFAC has published an extensive library of FAQs on its website—and it adds to this library regularly. While some of OFAC’s FAQs address very specific issues (i.e., one newly-added FAQ addresses the recent sanctions imposed against Russia-based Polimetall AO), others address aspects of OFAC compliance more broadly. When developing their compliance programs or addressing specific compliance-related concerns, financial institutions and companies can look to OFAC’s FAQs as a starting point. However, in most cases, institutions and entities will need to seek additional insights, whether from their outside counsel or by requesting interpretive guidance from OFAC.  

Importantly, while OFAC’s resources are intended to assist with understanding and addressing financial institutions’ and companies’ compliance obligations, applying OFAC’s guidance is not sufficient on its own. OFAC itself makes this clear. Rather, institutions and companies must independently assess their compliance obligations under all pertinent federal laws and regulations to protect foreign policy and national security interests, and then they must develop comprehensive and custom-tailored compliance programs that address their specific risks and needs. This requires experienced legal counsel, and company owners, compliance officers and others who have questions or concerns about OFAC compliance should engage counsel before any potential issues lead to civil or criminal exposure.