Sanctions administered by the Treasury Department's Office of Foreign Assets Control (OFAC) prohibit U.S. persons — and, through the dollar-clearing system, effectively most global companies — from dealing with sanctioned countries, regions, governments, entities and individuals, most prominently those on the Specially Designated Nationals (SDN) List. Liability is strict: a transaction with a listed party violates the regulations regardless of intent, with civil penalties per violation that reached $72,488 in the 2025 inflation adjustment, and criminal exposure for willful violations up to 20 years. The compliance architecture that determines enforcement outcomes is screening, ownership analysis under the 50 Percent Rule, and voluntary self-disclosure when a violation is found.
USA Post publishes information about sanctions law, not legal advice. Companies should build programs with counsel against OFAC's published framework.
Whom do the sanctions reach?
U.S. persons: citizens and residents wherever located, U.S.-organized entities and their foreign branches — fully bound by country programs (Cuba, Iran, North Korea, Syria, Crimea and the occupied Ukrainian territories, and the Russia-related directives). Foreign, non-U.S. companies are bound in two ways: transactions involving U.S. persons, goods or the U.S. financial system (dollar clearing makes nearly every international payment touch U.S. jurisdiction, the theory of the massive BNP Paribas and standard-bank resolutions), and secondary sanctions — measures that sanction non-U.S. persons for specified conduct (much of the Russia and Iran architecture) even with no U.S. nexus, cutting them off from the U.S. market. The 2022-2025 Russia program expanded both dimensions dramatically: sectoral price caps on oil, directives on sovereign debt, hundreds of SDN designations including banks and oligarchs, and secondary-sanctions exposure for foreign financial institutions.
What is the 50 Percent Rule and why does it matter?
OFAC guidance provides that any entity owned 50 percent or more, individually or in the aggregate, by one or more blocked persons is itself blocked — even if unlisted. A joint venture 60 percent owned by two SDNs and 40 percent by an innocent investor is entirely blocked property; dealing with it is dealing with blocked persons. The rule is aggregate and ownership-based, not control-based: OFAC's 2024 updated guidance clarified that entities merely controlled (but under 50 percent owned) by blocked persons are not automatically blocked, while warning that such control can be evidence of a blocked-person nexus and that deals evading ownership thresholds can themselves violate evasion prohibitions. Practical consequence: screening counterparties against the SDN List is necessary but insufficient — a compliance program must resolve each counterparty's ownership chain for hidden blocked aggregate majorities, which is where supply-chain screening services and ownership-mapping software earn their fees.
What does an OFAC compliance program require?
OFAC's published framework, "A Framework for OFAC Compliance Commitments," expects five pillars adapted from criminal-enforcement guidance: management commitment (a designated compliance officer with authority and budget); risk assessment (jurisdictions, products, customers, channels — updated as programs change, which in 2022-2026 has been constant); internal controls (screening at customer onboarding and transaction execution, escalation procedures, documentation); testing and auditing (independent validation that screening actually works, sampling of transactions); and training (role-specific, current on the fast-moving Russia measures). Penalties and resolutions consistently recite the framework's absence: the enforcement precedents — from the bank resolutions to the mid-size corporate settlements in shipping, technology and agriculture — describe the same failures: screening gaps at acquired entities, unaddressed alerts, and screening that missed ownership aggregation.
How do violations get resolved, and what is self-disclosure worth?
Through civil settlements with penalties driven by OFAC's enforcement guidelines: statutory base amounts per violation, aggregated for five-year limitations purposes, adjusted upward for willfulness and management involvement and downward substantially for voluntary self-disclosure, remediation and cooperation. The differential is the program's economics — voluntary disclosure caps the base penalty at half and, combined with remediation, has produced settlements at fractions of nondisclosed-comparable conduct. Criminal referrals follow egregious facts (the conviction record includes banks and individuals for deliberate stripping of payment identifiers to move sanctioned payments through dollar clearing). Where a violation is found: quarantine the transaction, preserve records, investigate quickly, and decide disclosure with counsel — the 2024-2025 interagency enforcement notes emphasize that disclosure decisions made early, with a remediation plan attached, drive the mitigation math.
What should companies do operationally?
- Screen every counterparty, beneficiary and vessel against OFAC's consolidated lists at onboarding and again at execution — lists change weekly.
- Resolve ownership to the 50 Percent Rule standard: aggregate blocked-person ownership across the chain, documenting the analysis.
- Screen for evasion indicators: altered payment routing, third-country intermediaries with no commercial logic, vessels going dark (AIS gaps), and customers refusing end-user statements.
- General licenses are narrow and conditional: read each one's reporting requirements before relying on it, and calendar expirations.
- Re-assess with every program change: the 2022-2026 Russia, Iran and Venezuela measures moved repeatedly; annual risk assessments are already stale.
Where is sanctions enforcement heading?
Toward more of it, with sharper tools. The 2022-2025 period produced record civil settlements, criminal convictions of individuals alongside entities, an interagency task force (Task Force KleptoCapture and its successors), a whistleblower program at the Treasury modeled on the SEC's, and coalition enforcement with the UK, EU and their expanding regimes. The compliance bar is ratcheting: what was best practice in ownership mapping five years ago is the expected floor now, and the companies that fare best treat sanctions screening as infrastructure — continuously updated, independently tested, and owned at the executive level.
For more context, read Export Controls Under the EAR: Licenses, De Minimis Rules and Entity List Risks.
For more context, read de minimis rule imports.
For more context, read customs audit preparation.