After a tumultuous 2022 that saw the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) make numerous additions to its list of companies and individuals under economic and trade sanctions by the U.S., domestic and foreign companies (and foreign subsidiaries owned by U.S. companies) are likely to see more of the same in 2024. In fact, if global upheaval spreads beyond the Russian invasion of Ukraine, OFAC (Office of Foreign Assets Control) compliance could get even more difficult in the name of national security. 

1. Take Extra Care Doing Your Due Diligence

As more new parties get added to the Office of Foreign Assets Control (OFAC)’s Specially Designated Nationals and Blocked Persons List, commonly referred to as the SDN list (one of OFAC's sanctions programs), companies need to go the extra mile to ensure they are not transacting with a person or company that is on it. While many executives know to consult the SDN whenever they open a business transaction with a new foreign entity, far fewer think of consulting their ongoing business operations when someone new is added to the SDN. OFAC imposing economic sanctions on your current business partner is a common situation, is much easier to miss, and can lead to serious penalties against your company for flouting American sanctions and embargoes. All companies need to look for newly sanctioned individuals and entities in their list of current contacts, customers, and clients as part of their compliance programs in order to avoid a sanctions violation.

However, merely checking the SDN list twice is not sufficient anymore. Many sanctioned individuals know better than to approach U.S. markets without a mask on or without an intermediary to hide behind. Unknown entities – particularly new ones that have been created within the last year and in sensitive areas of the world – should be scrutinized until reasonable suspicions can be alleviated. Not taking these steps can lead to OFAC casting a wary eye on your business and not mitigating the penalties of noncompliance. 

2. Beef Up Your Managerial Commitment to Compliance

The Treasury Department provides a general framework for OFAC compliance that should serve as at least a basic blueprint for most companies. According to the framework, there are five essential components for an effective OFAC regulations compliance structure:

1. A commitment of compliance from management
2. Risk assessment
3. Internal controls
4. A system of testing and auditing
5. Employee training

Of these, creating an atmosphere of gravity among management with regards to OFAC compliance is one of the trickiest to accomplish. All successful compliance mechanisms are silent; it is only when they fail that they are noticed. This makes it difficult to impress managerial workers about the need to strictly abide by the rules of compliance, particularly when they are onerous or even just inconvenient. Managers often feel that their resources should be deployed elsewhere, in a position where money can be made for the company. 

If not checked, this attitude can undermine compliance efforts, with managers urging their subordinates to focus their time elsewhere in order to maximize their department’s profits or productivity. Like a snowball rolling down a hill, this atmosphere can quickly get worse as workers actively see OFAC compliance mechanisms as an obstacle rather than as a carefully crafted asset that is designed to insulate the company from serious liability. 

Global upheaval and a rapidly-evolving list of sanctioned individuals provides a great, concrete example of the threats that you company faces from OFAC noncompliance. Use it to impress managerial staff of the necessity of taking compliance seriously. 

3. Check In On Sanctions List More Often

Ideally, you will want to be subscribed to OFAC’s email system to be notified about changes to the SDN, and to keep up with all of the differences between the current SDN and its prior version. At the very least, you should consider tightening the amount of time between check-ins.

Keeping apprised of changes made to the SDN is one of the most fundamental aspects of OFAC compliance. If you do not know who is on the SDN then you cannot comply with its obligations. Having as close to a real-time understanding of who is being sanctioned by the United States is essential because it allows you to cut ties with sanctioned individuals as quickly as possible. OFAC also requires you to freeze any of their accounts that are in your possession. Failing to take this step because the entity withdrew and closed its accounts in the week that you were unaware that they had become sanctioned can lead to legal liability and some very bad publicity.

Furthermore, lackadaisically or only occasionally reviewing the SDN list can be seen as a reason to come down hard on your company if a violation is made. OFAC is known for using offenders to set an example and hopefully deter others. Checking the sanctions list often can keep this from happening to you.

4. If You Have Not Audited Your OFAC Compliance Rules, Now is the Time to Do It

The Treasury Department’s recommendations for OFAC compliance include the need to test and audit those that you have already created. Given the importance that OFAC compliance will have in 2024, auditing your compliance protocols, whether using your employees or using compliance professionals, should be at the top of your list if you have not done it recently. 

Performing an audit does not just test the effectiveness of your OFAC compliance design – it also tests how it performs in practice. Additionally, an audit is a great way to get a good sense of how well your employees are trained with regards to OFAC compliance and how seriously their managers take their compliance obligations. Conducting an audit is the best way to give yourself a good idea of what is needed to move towards a safer, more compliant company that is unlikely to face the severe penalties of an OFAC violation.