OFAC penalties can be severe — millions of dollars per violation, even without intent. This guide explains how OFAC calculates civil penalties, what factors affect the outcome, and how voluntary self-disclosure can reduce your exposure.
OFAC Penalties — What Happens If You Violate Sanctions?
OFAC sanctions violations are among the most serious compliance failures a fintech can face. Unlike many regulatory violations where intent matters significantly, OFAC operates on a strict liability standard for civil penalties — meaning you can be penalized even if you didn't know you were violating sanctions.
Here's how OFAC penalties work and what you can do to minimize your exposure.
OFAC's Strict Liability Standard
Under the International Emergency Economic Powers Act (IEEPA) and the Trading With the Enemy Act (TWEA), OFAC can impose civil penalties for sanctions violations regardless of whether the violation was intentional. You don't need to have known the transaction was prohibited. If the transaction occurred, a violation may have occurred.
This strict liability standard makes an effective sanctions compliance program not just a best practice — it's your primary legal protection.
Types of Violations
OFAC distinguishes between two categories of violations:
Apparent Violations
Transactions that appear to violate OFAC regulations based on available information. Most OFAC enforcement cases begin as apparent violations pending investigation.
Egregious Violations
Violations that involve reckless disregard for sanctions obligations, willful conduct, or involvement in conduct with serious national security implications (terrorism financing, WMD proliferation, etc.). Egregious violations face significantly higher penalties and are more likely to result in criminal referral.
Civil Penalty Framework
OFAC published its Economic Sanctions Enforcement Guidelines (31 C.F.R. Part 501, Appendix A), which describe how civil penalties are calculated.
Base Penalty
The base civil penalty is the greater of:
- The statutory maximum per transaction (currently $368,136 per violation, adjusted annually for inflation — verify current amount at treasury.gov)
- Twice the value of the underlying transaction
For egregious violations, the base penalty is the statutory maximum per transaction.
Adjusting Factors: Mitigation and Aggravation
OFAC applies both mitigating and aggravating factors to arrive at the final penalty:
Mitigating factors (reduce penalties):
- Voluntary self-disclosure (most significant — can reduce penalty by up to 50%)
- Remedial steps taken after discovery
- No prior sanctions history
- Small transaction value
- License eligibility — the transaction could have been authorized under an OFAC general or specific license
- Cooperation during the investigation
- Compliance program in place at time of violation
Aggravating factors (increase penalties):
- Willful or reckless conduct
- Pattern of violations or multiple violations
- Senior management involvement
- Significant harm to US sanctions policy objectives
- No compliance program in place
Criminal Penalties for Willful Violations
Civil penalties are the more common enforcement tool. But willful violations can result in criminal prosecution:
- Up to $1,000,000 in fines per violation
- Up to 20 years in prison under IEEPA
Criminal prosecution is rare but reserved for the most egregious cases — typically involving deliberate circumvention of sanctions for significant amounts or in connection with terrorism, WMD proliferation, or similar threats.
Recent OFAC Enforcement in Fintech and Crypto
OFAC has significantly expanded its enforcement reach into fintech and cryptocurrency:
- Bittrex (2022) — $29 million penalty for apparent sanctions violations involving users in sanctioned jurisdictions
- BitPay (2021) — $507,375 for allowing users in sanctioned jurisdictions to transact
- Kraken (2022) — $362,158 for apparent violations involving Iranian users
- Poloniex (2019) — $98,830 for similar apparent violations
These cases share a common theme: inadequate controls to detect customers in sanctioned jurisdictions, and insufficient geolocation screening.
What to Do If You Discover a Potential Violation
- Don't panic — but act quickly. Discovery starts a clock on voluntary self-disclosure.
- Preserve all records related to the transaction.
- Contact legal counsel immediately — OFAC violations require specialized legal expertise.
- Consider voluntary self-disclosure — filing before OFAC contacts you is a major mitigating factor.
- Remediate the underlying control failure — OFAC will want to see that you've fixed what went wrong.
Voluntary self-disclosure must be made within a reasonable time after discovery. Contact OFAC's Compliance Division or send a written initial notification describing the apparent violation.
How to Reduce Your OFAC Penalty Risk
The best protection against OFAC penalties is a robust sanctions compliance program:
- Daily sanctions list updates — your screening tool must refresh its database every time OFAC updates the SDN List
- Geolocation screening — detect users in sanctioned countries through IP address, phone number, and document verification
- Complete sanctions screening — screen both customer names and, for crypto, wallet addresses
- Document everything — a well-documented compliance program is a mitigating factor even if a violation occurs
- Annual program testing — identify and fix gaps before they become violations
Frequently Asked Questions
Can a fintech face OFAC penalties even with a compliance program in place?
Yes — a compliance program is a mitigating factor, not a complete defense. But the quality of your program matters significantly in how OFAC evaluates the violation and sets the penalty.
Does OFAC penalize each transaction separately?
Yes. Each transaction that violates sanctions is a separate violation with a separate base penalty. Multiple transactions involving the same sanctioned party can result in very large aggregate penalties.
What is the No-Action Letter process?
OFAC issues specific licenses for transactions that would otherwise be prohibited. If you're unsure whether a specific transaction is permitted, you can request a specific license or consult with OFAC's Compliance Hotline before proceeding.
This article is for educational purposes only and does not constitute legal or compliance advice. OFAC penalty amounts are adjusted periodically. Verify current figures at treasury.gov and consult qualified legal counsel for any OFAC compliance matter.
