How OFAC Sanctions Penalties Are Assessed

Violating regulations from the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) carries crushing consequences. Civil penalties can reach well into six figures per violation. For willful conduct, criminal penalties may include multi-million dollar fines and up to 30 years in prison. These are not just risks for large financial institutions. They are a daily reality for any U.S. person or company involved in international trade, technology, shipping, or even simple e-commerce.

This article cuts through the legal jargon. We'll explain the critical differences between OFAC's civil and criminal penalties, show how these fines are calculated, and walk through the enforcement process from the first sign of an investigation to its resolution.

What Are OFAC Sanctions and Who Must Comply?

The Office of Foreign Assets Control (OFAC) is a powerful U.S. Treasury agency. It administers and enforces U.S. economic and trade sanctions rooted in foreign policy and national security goals. Its core mission is to cut off targeted countries, entities, and individuals from the U.S. financial system.

Compliance is not optional for "U.S. persons," a term that is broader than many realize. It includes:

• U.S. citizens and permanent resident aliens, no matter where they are in the world.
• All companies and organizations formed under U.S. law, including their foreign branches.
• Anyone—person or entity—physically located in the United States.

In some sanctions programs, U.S. parent companies can even be held liable for the actions of their foreign subsidiaries. And any transaction, even one between two non-U.S. persons, can fall under OFAC's jurisdiction if it is processed through the U.S. financial system.

OFAC’s main weapon is the Specially Designated Nationals and Blocked Persons (SDN) List. U.S. persons are strictly forbidden from doing almost any business with anyone on this list, and any assets they control must be blocked.

What's the Difference Between OFAC's Civil and Criminal Penalties?

The key distinction between civil and criminal penalties is intent. Civil penalties, the most common type, are based on "strict liability." This means you can be fined even if the violation was a complete accident. Criminal penalties, however, are reserved for willful violations, where the government must prove you knew your actions were illegal.

These penalties are primarily authorized by the International Emergency Economic Powers Act (IEEPA) and the Trading With the Enemy Act (TWEA).

• Civil Penalties (Strict Liability): OFAC can impose these directly, without going to court. The focus is on the act itself, not your motive. A simple mistake—like a software glitch failing to screen a customer or a junior employee processing a small payment without checking—is enough to trigger a civil penalty.

• Criminal Penalties (Willful Violations): These cases are a different beast. Investigated by OFAC but prosecuted by the Department of Justice (DOJ), they require proof beyond a reasonable doubt that the violator knew they were breaking the law. A conviction under IEEPA can bring fines up to $1 million and up to 20 years in prison. Penalties under other laws, like the Foreign Narcotics Kingpin Designation Act (FNKDA), are even steeper, with potential imprisonment of up to 30 years.

OFAC violations examples

What does a violation look like in practice? Here are common actions that lead to significant penalties:

• Prohibited Transactions: Processing a wire transfer for, extending credit to, or providing any financial services to someone on the SDN List.
• Prohibited Trade: Exporting goods, software, or technology to a comprehensively sanctioned country like Iran, North Korea, or Cuba without a specific OFAC license.
• Facilitation: This is a major trap. A U.S. person cannot approve, finance, or even refer a transaction by a foreign person that they would be prohibited from doing directly. For example, a U.S. manager cannot simply tell a European colleague, "I can't approve your deal with that sanctioned Iranian company, but you go ahead."
• Evasion: Any attempt to actively hide the involvement of a sanctioned party. This includes things like stripping a sanctioned bank's name from wire transfer details or using shell companies to obscure who really owns an asset.

How Does OFAC Calculate Civil Penalties?

OFAC doesn't just pull numbers out of a hat. The agency uses a detailed framework, its Economic Sanctions Enforcement Guidelines, to determine the civil penalty. The process follows a specific matrix based on several key factors.

First, OFAC determines if the violation was "egregious" or "non-egregious."

• An Egregious Violation is a serious breach. OFAC weighs factors like willfulness or recklessness, how high up the management chain the awareness went, the harm caused to U.S. sanctions goals, and the company's size and sophistication.
• A Non-Egregious Violation is typically a less severe, often inadvertent mistake where the more serious aggravating factors aren't present.

The base penalty is then calculated from this finding and, crucially, whether the company voluntarily self-disclosed the violation to OFAC. A Voluntary Self-Disclosure (VSD) can dramatically reduce the potential fine.

Aggravating factors like a history of prior violations, management's involvement, and causing significant harm will push the penalty up. Mitigating factors, such as the quality of a company's compliance program, remedial actions taken, and full cooperation with the investigation, will bring it down.

What is the OFAC civil penalties maximum?

The maximum civil penalty is set by law and adjusted for inflation. Under the widely used IEEPA, the current maximum civil penalty for 2026 is the greater of approximately an annually adjusted amount or twice the value of the underlying transaction. For violations under other acts, such as the Foreign Narcotics Kingpin Designation Act (FNKDA), civil penalties can exceed several million dollars per violation.

A person who violates an OFAC regulation can face a civil money penalty of up to?

For a single violation under most IEEPA-governed programs, a person can face a civil penalty of up to the greater of an annually adjusted statutory maximum or twice the transaction's value. The critical thing to understand is that this is a per-violation figure. A series of 10 prohibited payments isn't one mistake; it's 10 separate violations, potentially pushing the total penalty into the millions.

What Is the OFAC Enforcement Process?

The enforcement process follows a clear administrative path, giving the subject of the investigation a chance to respond before a final penalty is locked in.

1. Investigation: It all starts when OFAC learns of an apparent violation. This could come from a company's own Voluntary Self-Disclosure, a report from a bank, a tip from a competitor or whistleblower, or OFAC's own targeted inquiries.
2. Pre-Penalty Notice (PPN): If the investigation concludes a violation occurred and a fine is warranted, OFAC issues a Pre-Penalty Notice. This document is the formal accusation. It lays out the alleged violation, OFAC's legal and factual reasoning, and the proposed penalty, detailing the aggravating and mitigating factors considered.
3. Response: The recipient has a right to respond, usually within 30 days (though extensions are often granted). Missing this deadline without an extension is disastrous; it's treated as a waiver of your right to reply, and OFAC will proceed to a final decision based only on the information it already has. This response is your single most important chance to present counter-arguments, challenge factual findings, and emphasize mitigating factors to argue for a reduced penalty.
4. Penalty Notice (PN): After reviewing the response, OFAC makes its final call. It might issue a "No Action" letter, a "Finding of Violation" (a formal warning without a fine), or a final Penalty Notice. The PN states the final penalty amount and is considered a final agency action.
5. Resolution: At this point, you can either pay the penalty or challenge OFAC's decision by filing a lawsuit in federal court. But the vast majority of cases end in a settlement agreement with OFAC, often for an amount lower than the one proposed in the PPN and almost always including a commitment to enhance compliance measures.

This article is for informational purposes only and does not constitute legal advice. It is published by an independent law firm and does not represent or claim affiliation with any government body, international organization, or official authority.