OFAC Screening Requirements: Compliance

A Miami-based export company processed a $120,000 wire transfer to a Dubai supplier in February 2026. Three days later, federal investigators contacted the firm—the recipient’s name matched an entry on the OFAC Specially Designated Nationals List. The company faced civil penalties exceeding $250,000 and a compliance audit that revealed systematic screening failures across 18 months of international transactions.

OFAC screening requirements dictate that businesses must cross-reference clients, transactions, and beneficial owners against US sanctions lists to prevent doing business with blocked entities. Compliance is strictly mandatory for all US persons, any global entity conducting transactions in US dollars, and foreign businesses looking to avoid severe secondary sanctions.

The Office of Foreign Assets Control operates under statutory authority granted by the International Emergency Economic Powers Act (50 U.S.C. §§ 1701–1706) and the Trading with the Enemy Act (50 U.S.C. § 4301 et seq.) to administer and enforce economic sanctions programs targeting specific foreign governments, individuals, groups, and entities.

Compliance obligations are broader than they appear. They apply to all U.S. persons—a term encompassing U.S. citizens and permanent residents regardless of physical location worldwide, all individuals and entities physically present in the United States, and all entities incorporated under U.S. law including their foreign branches. A U.S. citizen living abroad remains bound by OFAC rules. A foreign subsidiary of a Delaware corporation must comply. Even temporary presence in U.S. territory triggers obligations.

Financial institutions bear specific obligations under the Bank Secrecy Act (31 U.S.C. § 5318(h)) to integrate OFAC screening into their Anti-Money Laundering programs. Non-financial businesses conducting international transactions—manufacturers, exporters, importers, logistics providers, professional services firms—must also implement screening procedures when their operations involve U.S.-origin goods, services, or financial system access. Foreign entities that process U.S. dollar transactions, utilize correspondent banking relationships with U.S. institutions, or conduct business with U.S. persons fall within OFAC’s jurisdictional reach even when operating entirely outside the United States.

That said, the scope extends further. Organizations must screen beneficial owners, intermediaries in payment chains, vessel ownership structures in maritime commerce, and any party that could trigger a sanctions violation through indirect dealing. According to OFAC’s published guidance, the agency evaluates compliance programs based on whether organizations adopt a risk-based approach tailored to their specific sanctions exposure profile.

Initial screening must happen before any business relationship commences or any transaction processes. This requirement is established by enforcement precedent under Title 31 U.S.C. § 1705. Financial institutions must screen prospective customers at account opening, capturing sufficient identifying information to conduct meaningful name matching against sanctions lists. This extends to beneficial ownership screening mandated by 31 CFR 1010.230, which requires identifying and verifying individuals owning 25 percent or more of legal entity customers.

Your ongoing screening frequency should depend on customer risk classification. High-risk customers—those operating in sanctioned jurisdictions, dealing in industries subject to sectoral sanctions, or exhibiting transaction patterns associated with sanctions evasion—warrant continuous or monthly rescreening against updated lists. Medium-risk customers typically require quarterly reviews. Low-risk domestic customers with predictable patterns may be rescreened annually. Whatever schedule you choose, document it in written policies. Examiners will ask.

Know Your Customer data quality directly determines screening accuracy. Insufficient information means more false positives consuming investigation resources—and more dangerously, potential true matches might slip through. Capture full legal names, all known aliases and former names, complete addresses including jurisdiction, date of birth or incorporation date, citizenship or jurisdiction of organization, and government-issued identification numbers. The difference between properly matching a sanctioned Syrian national and incorrectly flagging a U.S. citizen of Syrian descent with a similar name lies entirely in KYC data completeness.

Transaction screening must occur before processing payments, wire transfers, trade finance instruments, or any fund movement. Payment processing systems should automatically compare sender, beneficiary, and intermediary bank information against current sanctions lists before releasing funds. When screening technology identifies a potential match above your configured threshold, suspend the transaction pending manual investigation. Determine whether a true sanctions hit exists or the alert represents a false positive that can be cleared and processed.

You’ve found a potential match. Stop. Suspend all transactions involving that party immediately and escalate to your compliance officers trained in sanctions investigation. Now comes the detailed work: pull every identifying detail you have—names, addresses, dates of birth, passport numbers, business registration info—and compare it against the SDN or consolidated list entry. The goal is simple but critical: determine whether this is a real match or a false positive. Document each step of your investigation: what data points you compared, where you looked, why you reached your conclusion.

If the investigation confirms a genuine match—a customer, transaction party, or business partner actually appears on OFAC sanctions lists—you must act immediately. Block all transactions. Freeze all assets. Those blocked assets go into interest-bearing accounts kept separate from your other funds. You cannot release a single dollar without OFAC’s written permission. Within 10 business days of blocking, if the blocked amount reaches $10,000 or more, file a Blocked Assets and Rejected Transaction Report (Form OFAC 308) through the OFAC portal. That report needs the blocking date, the blocked party’s name and address, which OFAC list entry triggered the block, a description of what you blocked, and the dollar amount.

False positives still require thorough documentation—even though no blocking or reporting happens. Your file should explain exactly why the match doesn’t represent a violations—for instance, showing that “Mohammed Ali Hassan” opening an account is a U.S.-born software engineer, not the Syrian national with the same name on the SDN List. Keep all false positive records. Examiners want to see that you investigated alerts thoughtfully rather than clearing them automatically.

Navigating complex screening situations or building your OFAC program from scratch? Our sanctions compliance legal team has worked across financial services, international trade, and cross-border transactions.

Start with written policies. These form your regulatory foundation. Define what activities and transaction types require OFAC review. List the specific sanctions lists you screen against. Set screening frequency based on customer risk tier. Document your matching thresholds and technology. Outline how you investigate potential matches. Specify who escalates confirmed hits and to whom. Assign a named officer responsibility for oversight with real authority. All of this must align with 31 CFR Chapter V, and you should review annually as your business operations or sanctions programs change.

Annual independent audits prove your program actually works—something regulators expect for financial institutions under the Bank Secrecy Act. Auditors should verify that screening happens at every required point (account opening, transaction processing, etc.), test alert quality by sampling investigations, measure false positive rates to check if your thresholds are realistic, confirm staff training completion, and check that you’re using current list versions and updating promptly. Written audit reports to senior management and the board matter as much as the audit itself.

Retention rules are strict. Keep screening logs showing every customer and transaction screening event with date, time, and result. Maintain investigation files for all matches—including false positives with documentation explaining why you cleared them. Preserve blocked transaction reports and all OFAC correspondence. File training records showing who attended, when, and what topics. Retain copies of every sanctions list version you used so you can prove you worked from current data. Federal regulations require five-year minimum retention under 31 CFR 1010.430, though many organizations keep records longer to protect against multi-year OFAC investigations.

Strengthening your OFAC infrastructure or preparing for examination? Our compliance legal team conducts program assessments, develops policies, and prepares organizations across financial services and international trade for regulatory review.