What Is OFAC Compliance? A Complete Guide for Fintechs

OFAC — the Office of Foreign Assets Control — is the U.S. Treasury Department agency responsible for administering and enforcing economic sanctions programs. OFAC compliance is the obligation to screen customers, transactions, and business counterparties against OFAC's sanctions lists and to ensure that no transactions facilitate business with sanctioned parties, countries, or regimes.

For fintechs, OFAC compliance is not optional and is not limited to large institutions. OFAC's sanctions apply to all U.S. persons and U.S.-based businesses — including fintech startups — regardless of size or transaction volume.

What Is OFAC?

The Office of Foreign Assets Control is a division of the U.S. Department of the Treasury that administers over 30 sanctions programs targeting specific countries, regimes, individuals, and entities that threaten U.S. national security or foreign policy interests. OFAC uses sanctions as an economic tool — restricting financial transactions involving sanctioned targets to pressure them toward policy change.

OFAC's authority is broad: it applies to all U.S. persons, all U.S.-incorporated entities, and all transactions that touch the U.S. financial system — regardless of where the parties are located.

The SDN List and Other Sanctions Lists

OFAC maintains several sanctions lists. The most important for most fintechs is the Specially Designated Nationals and Blocked Persons List — the SDN List. This list contains the names of individuals, entities, and vessels that U.S. persons are prohibited from doing business with. SDN List property and property interests must be blocked, and transactions with SDN-listed parties must be refused.

In addition to the SDN List, OFAC administers country-based sanctions programs that prohibit most or all transactions with specific countries — including Cuba, Iran, North Korea, Syria, and Russia in designated sectors. These comprehensive sanctions programs apply regardless of whether a specific counterparty appears on the SDN List.

For a step-by-step guide to operationalizing sanctions screening, see our guide on OFAC sanctions screening and our practical guide on how to conduct OFAC screening.

What OFAC Compliance Requires in Practice

Sanctions Screening at Onboarding

All new customers must be screened against the SDN List and other applicable sanctions lists as part of the onboarding process. Screening must use fuzzy matching — not just exact name matching — because SDN-listed parties may use name variations, transliterations, aliases, and spelling variants. Relying on exact-name-only matching creates significant gaps in sanctions screening effectiveness.

Transaction Screening

For payment fintechs, sanctions screening must also occur at the transaction level — screening both the originator and the beneficiary of transactions as they are processed. This is particularly important for wire transfers, ACH payments, and international transactions where counterparty information is available.

Ongoing Re-Screening

OFAC sanctions lists update frequently — sometimes multiple times per week. Existing customers who were clean at onboarding can be added to the SDN List during the customer relationship. Ongoing re-screening of the existing customer base against updated lists is required. Automated re-screening through compliance technology platforms is standard practice for any fintech with significant customer volumes.

Blocking and Reporting Requirements

When an OFAC match is confirmed — a customer or transaction counterparty is verified to be on the SDN List or otherwise sanctioned — specific actions are required. Transactions must be blocked or rejected depending on the applicable sanctions program. Blocked property must be reported to OFAC within 10 business days. Rejected transactions must be reported to OFAC within 10 business days. Maintaining records of all blocked and rejected transactions is required.

OFAC and AML — How They Relate

OFAC compliance and BSA/AML compliance are related but distinct requirements. BSA/AML compliance is required by the Bank Secrecy Act and focuses on detecting and reporting money laundering and financial crime. OFAC compliance is required by Executive Orders and statutory authority and focuses on preventing transactions with sanctioned parties. AML screening — the broader practice of checking customers against multiple risk databases — typically includes sanctions screening as one component but also includes PEP screening and adverse media. However, the two programs have separate regulatory bases, separate enforcement authorities, and separate penalties for violations.

OFAC Penalties

OFAC enforcement is serious. Civil penalties for sanctions violations can reach the greater of $330,947 per violation or twice the transaction value for most sanctions programs. Egregious violations can result in significantly higher penalties. Criminal penalties under some sanctions programs can include imprisonment. OFAC also considers the self-disclosure of violations and the adequacy of the compliance program as factors in penalty calculations — companies with strong compliance programs that self-disclose violations typically receive more favorable treatment than companies that fail to maintain compliance programs and have violations discovered by OFAC.

Frequently Asked Questions

Does OFAC compliance apply to crypto transactions?

Yes. OFAC's authority applies to cryptocurrency transactions involving U.S. persons or that touch the U.S. financial system. OFAC has designated specific cryptocurrency addresses on the SDN List and requires that cryptocurrency businesses not process transactions to or from those addresses. Blockchain analytics tools that identify transactions with SDN-listed addresses are standard for cryptocurrency businesses.

What is the difference between OFAC compliance and AML screening?

OFAC compliance focuses specifically on sanctions — screening against OFAC's specific lists and complying with specific sanctions programs. AML screening is broader — it covers sanctions screening plus additional risk screening such as PEP databases and adverse media. A complete compliance program includes both, though they can overlap in practice since many compliance technology platforms integrate sanctions screening as part of their broader AML screening capability.

Can a fintech rely on its sponsor bank for OFAC compliance?

No. Fintechs in sponsor bank relationships cannot rely solely on the bank's OFAC compliance program to satisfy their own OFAC obligations. Both the bank and the fintech program manager must maintain OFAC compliance programs appropriate to their respective roles in the transaction flow. The bank's compliance does not substitute for the fintech's obligations.

How ComplyOne Helps

ComplyOne helps fintechs build OFAC compliance programs — from implementing sanctions screening technology to designing blocking and reporting procedures to assessing compliance program gaps against OFAC regulatory expectations — through advisory services, compliance technology, or both.

Talk to the ComplyOne team to get started.

The information in this article is for general educational purposes and does not constitute legal or regulatory advice. OFAC sanctions programs change frequently. Consult qualified legal counsel for guidance specific to your sanctions compliance obligations.