U.S. Sanctions Risk: How OFAC Works and What It Means for Companies and Governments

Close-up of the engraved Treasury Building on U.S. currency — The Treasury Building, engraved on the currency that gives U.S. sanctions their reach. Photo: Envato.

Economic sanctions are now one of the main tools of statecraft. Rather than engage in kinetic military operations, Washington often reaches first for the Treasury Department to pressure a government or isolate a network. Treasury’s own 2021 review said that after September 11, sanctions “became a tool of first resort to address a range of threats” (Treasury 2021 Sanctions Review). For a company, that means the risk can arrive overnight, as a listing that turns a customer, supplier, lender, or shareholder into a blocked person. It also means the risk can be forecast, because designations follow policy, and policy is often preceded by legible signals.

This page explains how U.S. Treasury sanctions work, how they became central to geopolitics, what enforcement looks like, and what executives and the officials who advise exporters should do about it. It opens a series on enforcement risk; export controls, investment screening, foreign agent registration, foreign bribery, forced-labor import bans, and data security get their own pages.

This is a general overview of public law and agency records, not legal advice. Anyone facing a specific question should talk to sanctions counsel.

U.S. sanctions at a glance

Legal basis: most programs rest on the International Emergency Economic Powers Act of 1977 (IEEPA), which lets the President regulate transactions after declaring a national emergency over an “unusual and extraordinary threat” from abroad (50 U.S.C. § 1701). The older Trading with the Enemy Act of 1917 still underpins the Cuba embargo (Congressional Research Service). Congress adds program-specific statutes, such as the Countering America’s Adversaries Through Sanctions Act of 2017 (CAATSA).
Who runs it: Treasury’s Office of Foreign Assets Control (OFAC) designates targets, writes regulations, issues licenses, and enforces. The State Department’s Office of Economic Sanctions Policy and Implementation “provides foreign policy guidance to the Department of Treasury and Commerce on sanctions implementation,” and OFAC issues licenses “in coordination with the Department of State” (State Department).
The lists: the Specially Designated Nationals and Blocked Persons (SDN) List is the core. Property of an SDN in U.S. jurisdiction is frozen, and U.S. persons may not deal with it. OFAC also keeps narrower lists, such as the Sectoral Sanctions Identifications List for parts of the Russian economy and the CAPTA List for foreign banks (OFAC).
The 50 Percent Rule: an entity owned 50 percent or more, directly or indirectly, individually or in the aggregate, by blocked persons is itself blocked, even if it is not named on a list. OFAC’s guidance says the rule “speaks only to ownership and not to control,” but warns companies to be cautious where blocked persons hold smaller stakes or control an entity by other means (OFAC FAQ 398; OFAC 2014 guidance).
Primary and secondary sanctions: primary sanctions bind U.S. persons and transactions with a U.S. nexus. Secondary sanctions threaten non-U.S. companies and banks with penalties, such as loss of access to the U.S. financial system, for certain dealings that involve no U.S. nexus at all. Executive Order 14114 (December 2023), for example, exposed foreign financial institutions to sanctions for facilitating significant transactions for Russia’s military-industrial base (EO 14114).
Who is covered: U.S. citizens and permanent residents wherever they are, companies organized in the United States and their foreign branches, and anyone in the United States. Under the Cuba and Iran programs, foreign entities owned or controlled by U.S. persons are also covered (31 C.F.R. § 560.215). Non-U.S. companies are reached through U.S. persons, U.S. territory, some U.S.-origin goods, or the U.S. banking system. The statute makes it unlawful to “violate, attempt to violate, conspire to violate, or cause a violation” (50 U.S.C. § 1705). “Causing” a U.S. bank to process a dollar payment for a sanctioned party is a common route to a foreign company’s liability.
Licenses: general licenses authorize a category of activity for everyone, often a wind-down; specific licenses authorize a named applicant’s transaction.
Civil penalties: liability is strict; OFAC need not prove the company knew. Under IEEPA the maximum is the greater of a set amount or twice the value of the transaction (§ 1705(b)). The inflation-adjusted figure, effective January 15, 2025, is $377,700 per violation; it is $111,308 under the Trading with the Enemy Act (Federal Register). There was no 2026 adjustment: the Office of Management and Budget told agencies on April 17, 2026, that they “will continue using the 2025 civil monetary penalty levels” (OMB M-26-11; Baker McKenzie).
Criminal penalties: willful violations carry fines of up to $1 million and, for individuals, up to 20 years in prison (§ 1705(c)). The Justice Department prosecutes.
Ten-year look-back: the 21st Century Peace through Strength Act, signed April 24, 2024, “extended from five years to 10 years the statute of limitations for civil and criminal violations” of IEEPA and the Trading with the Enemy Act. OFAC extended its recordkeeping requirement to 10 years to match, effective March 21, 2025 (Federal Register).
How OFAC sets penalties: its Enforcement Guidelines sort cases by whether they are “egregious” and whether they were voluntarily self-disclosed. A voluntary self-disclosure halves the base penalty; an egregious case without one starts at the statutory maximum. Willfulness, harm to the program, compliance, remediation, and cooperation move the number (31 C.F.R. part 501, app. A). OFAC’s Framework for OFAC Compliance Commitments names five elements it expects: management commitment, risk assessment, internal controls, testing and auditing, and training.

How sanctions became a primary instrument

Timeline of U.S. sanctions law from the Trading with the Enemy Act of 1917 to OFAC’s 2026 sham-transaction guidance — From wartime trade controls to a primary instrument of statecraft. Chart: Competitive Futures.

The modern system began with war. “Congress passed TWEA in 1917 to regulate international transactions with enemy powers,” and presidents later used a 1950 Korean War emergency under it to sanction China, North Korea, Vietnam, Cuba, and Cambodia (Congressional Research Service). In 1977 Congress enacted IEEPA “to limit the emergency economic powers” of the presidency. By September 2025, presidents had declared 77 national emergencies invoking IEEPA, 46 of them still in effect, according to the same report.

“Since the 1990s, Presidents have expanded the scope of their declarations to include groups” and individuals, the CRS report notes, shifting sanctions from whole countries toward named people, companies, ships, and networks. After September 11, 2001, Treasury turned to terrorist financing, designating more than 1,600 terrorist entities and individuals (Treasury 2021 Sanctions Review). The same review referred to “over 12,000 OFAC designations” across programs.

Iran made secondary sanctions routine. The Iran Sanctions Act of 1996 (Pub. L. 104-172) and the Comprehensive Iran Sanctions, Accountability, and Divestment Act of 2010 (Pub. L. 111-195) put foreign companies and banks to a choice between Iran and the U.S. market. Europe answered the 1996 measures with its Blocking Statute, discussed below.

Russia brought sanctions to a scale once reserved for small economies. In 2014, after the annexation of Crimea, OFAC created “sectoral” restrictions on Russian finance, energy, and defense firms under Executive Order 13662 (OFAC). On February 28, 2022, Treasury prohibited U.S. persons from transactions with the Central Bank of the Russian Federation (Treasury). On December 5, 2022, OFAC published its price cap determination for Russian-origin seaborne crude, set at $60 a barrel with G7 and other partners (OFAC; Morgan Lewis). Russia’s largest oil producers are now all designated: Gazprom Neft and Surgutneftegaz on January 10, 2025 (OFAC; Baker McKenzie), and Rosneft and Lukoil on October 22, 2025, along with dozens of subsidiaries; Treasury noted that “All entities owned 50 percent or more, directly or indirectly, by Rosneft and Lukoil are blocked” (Treasury).

What the risk looks like in practice

Bar chart of OFAC civil penalties in selected cases, from BNP Paribas in 2014 to Adani Enterprises in 2026 — OFAC civil penalties in selected cases; combined U.S. resolutions were larger in several. Chart: Competitive Futures.

The cases below run in date order. Most are civil settlements of what OFAC calls “apparent violations”; guilty pleas and imposed penalties are noted. Several involve non-U.S. companies or non-banks, the firms most likely to underestimate their exposure.

BNP Paribas (2014): the dollar is the jurisdiction

The French bank pleaded guilty in June 2014 to conspiring to violate IEEPA and the Trading with the Enemy Act by moving more than $8.8 billion through the U.S. financial system from about 2004 to 2012 on behalf of Sudanese, Iranian, and Cuban parties. It agreed to pay about $8.97 billion in forfeiture and fines; OFAC’s $963 million penalty was satisfied within that total. The attorney general said the bank “went to elaborate lengths to conceal prohibited transactions, cover its tracks, and deceive U.S. authorities” (Justice Department). Lesson: a non-U.S. bank that clears dollars for sanctioned parties faces U.S. criminal liability, and concealment turns a compliance failure into a crime.

ZTE (2017): third parties do not hide the end user

The Chinese telecom maker agreed in March 2017 to pay about $1.19 billion to Treasury, Commerce, and Justice, including $100,871,266 to OFAC, over a scheme that “utilized third-party companies to conceal and facilitate ZTE’s illegal business with Iran.” Treasury said that under its leadership’s direction ZTE “deleted evidence and provided the U.S. government with altered information.” ZTE pleaded guilty to the criminal charges (Treasury; OFAC). Lesson: intermediaries do not hide the end user, and obstruction compounds the penalty.

British American Tobacco (2023): indirect dealing still counts

BAT paid OFAC $508,612,492, the statutory maximum, over a scheme that kept effective control of a North Korean joint venture while appearing to exit, with profits moving through U.S. banks from 2009 to 2016. Treasury warned that “Firms that deal with blocked persons, even indirectly, will be penalized” (Treasury). In total BAT agreed to pay more than $629 million under a deferred prosecution agreement, and its Singapore subsidiary pleaded guilty. BAT’s chief executive said the company regrets “the misconduct arising from historical business activities” (NPR via OPB). Lesson: a paper divestment that leaves real control in place is not an exit.

Binance (2023): platforms answer for their users

The world’s largest virtual currency exchange settled 1,667,153 apparent violations with OFAC for $968,618,825 (OFAC). Treasury said the trades, from 2017 to 2022, matched U.S. persons with users in Iran, North Korea, Syria, and the Crimea region of Ukraine (Treasury). Binance pleaded guilty to Bank Secrecy Act and IEEPA-related charges, admitting it “willfully caused over $898 million in trades between U.S. users and users ordinarily resident in Iran,” in a resolution of more than $4.3 billion (Justice Department). Lesson: a platform that serves U.S. customers imports U.S. sanctions into everything it does.

GVA Capital (2025): the proxy is not a shield

OFAC imposed a $215,988,868 penalty, the statutory maximum, on a San Francisco venture capital firm that kept managing a $20 million investment for Suleiman Kerimov after his 2018 designation, dealing through a relative it knew was his proxy, and that answered an OFAC subpoena late and incompletely. This was a penalty notice, not a settlement. OFAC wrote that U.S. persons who know a sanctioned person retains control “cannot claim ignorance” (OFAC). The firm’s cofounder could not be reached for comment (San Francisco Standard). OFAC settled a related matter with IPI Partners for $11,485,352 in December 2025 (OFAC). Lesson: the 50 Percent Rule is a floor; knowledge of real control defeats a clean ownership chart.

Fracht FWO (2025): logistics firms touch blocked property

A Houston freight forwarder settled for $1,610,775 after executives, rushing in 2022, chartered a Mexico-to-Argentina cargo flight from EMTRASUR, a blocked subsidiary of Venezuela’s state airline, on a former Mahan Air aircraft still identified on the SDN List, without sanctions screening or legal review. OFAC found the case egregious, credited Fracht’s remediation and cooperation, and wrote: “Compliance may at times come at the expense of convenience” (OFAC). Lesson: screening must cover vessels, aircraft, and carriers, not only counterparties’ names, and it must survive urgency.

Adani Enterprises (2026): the non-U.S. importer and the dollar payment

On May 18, 2026, OFAC announced a $275 million settlement with the India-based conglomerate over 32 apparent violations of the Iranian Transactions and Sanctions Regulations. OFAC said the company bought Iranian liquefied petroleum gas, documented as Omani or Iraqi, through a Dubai-based trader from November 2023 to June 2025, and “caused U.S. financial institutions to process 32 U.S. dollar (USD) denominated payments” worth about $192.1 million. OFAC judged the case egregious, cited ignored red flags such as low prices and vessel behavior, credited cooperation, and warned that “if a deal is too good to be true, it probably is” (OFAC). Adani Enterprises told Indian exchanges that “This settlement is without admitting the allegations made by OFAC” (NSE filing). Lesson: paying in dollars brings a non-U.S. trade under OFAC, and certificates of origin are not diligence on their own.

These cases are the large ones. OFAC’s 2025 enforcement page lists 14 actions totaling $265,746,819, and through late October its 2026 page lists 10 totaling $297,513,285, most of them small (OFAC). The routine cases involve logistics, software, education, brokerage, and manufacturing firms.

What it means for companies

Screening is necessary and not sufficient. The cases above turned on ownership, control, origin, routing, and pressure, not a missed name match.

Oil tanker at sea, a frequent focus of U.S. sanctions on shipping — Tankers, cargoes, and their owners are a frequent focus of U.S. sanctions, so screening must cover vessels and carriers, not just counterparties. Photo: Envato.

Screen ownership and control, not names. Aggregate the stakes of all blocked owners under the 50 Percent Rule, then ask who actually directs the business. OFAC’s March 31, 2026, guidance on sham transactions says “sham transactions do not terminate a blocked interest in property” and lists red flags such as transfers to family members or close associates, transfers near the time of a designation, and needlessly complex structures in higher-risk jurisdictions (OFAC; WilmerHale).
Look one layer further out. Your counterparty’s supplier, shipper, bank, or customer may be the exposure. Verify origin, vessel history, and payment routes for high-risk goods.
Map your nexus. List every U.S. touchpoint: dollar clearing, U.S. banks and insurers, U.S. staff or directors approving deals, U.S. software, and U.S.-origin components.
Write sanctions into contracts. Use representations on ownership and listing status, a duty to notify of designation, information rights, and termination on designation, checked against governing law and, in the EU, the Blocking Statute.
Plan the wind-down before you need it. When OFAC designates a major company, it often issues short, time-limited general licenses for winding down existing dealings. After Lukoil’s designation, OFAC issued and repeatedly extended a general license for negotiations over the sale of its foreign assets, with any sale still subject to separate OFAC approval (Ship & Bunker).
Scenario-plan designation of a market or partner. Ask what happens if your distributor, partner, bank, or a whole sector in a key market is listed next quarter, and set exit triggers now.
Disclose early when something goes wrong. A voluntary self-disclosure halves the base penalty, but only if it reaches OFAC before the government learns of the problem another way, as Fracht found. With a 10-year statute of limitations, legacy conduct stays live.

Forecasting designation risk

Designations are policy outputs, and policy is visible before it is final. That is where competitive intelligence and foresight earn their place. Useful signposts include OFAC and FinCEN advisories naming typologies or sectors; allied designations that the United States has not yet matched, or the reverse; congressional bills and hearings naming companies; enforcement releases describing evasion patterns; designations of a target’s affiliates, vessels, or banks; and shifts in negotiations that make pressure more or less likely. A disciplined program assigns indicators to each key counterparty and market and states in advance what would change its assessment. The goal is not to predict every listing; it is not to be the last company holding the contract when one comes.

What it means for governments advising their companies

Trade ministries, export-promotion agencies, and embassy commercial sections hear one question from exporters more and more: does U.S. law apply to us? Often it does, through a specific nexus.

European Union flags outside an EU building, representing the EU Blocking Statute response to U.S. sanctions — The EU Blocking Statute is Europe’s legal answer to the reach of U.S. sanctions; it can raise a company’s risk at home without lowering it in the United States. Photo: Envato.

Nexus decides most cases. A company in a third country can be liable under primary sanctions if it causes a U.S. person, including a U.S. bank processing a dollar payment, to violate the rules, as the BNP Paribas and Adani matters show. Secondary sanctions go further, reaching some dealings with no U.S. nexus at all. OFAC’s compliance framework notes that “Many non-U.S. persons have engaged in violations of OFAC’s regulations by processing financial transactions” through the U.S. system (OFAC).

Blocking statutes have limits. The European Union’s Council Regulation (EC) No 2271/96 of November 22, 1996 (EUR-Lex) “prohibits compliance by EU operators with any requirement or prohibition” in the listed foreign laws, nullifies foreign court rulings based on them in the EU, and lets operators sue for damages; its annex covers U.S. measures on Cuba and Iran and was updated in August 2018 after the United States reimposed Iran sanctions (European Commission). In Bank Melli Iran v Telekom Deutschland (Case C-124/20, December 21, 2021), the Court of Justice held that the prohibition applies even without a U.S. order, that an EU company need not give reasons for ending a contract with a listed party but bears the burden of showing it was not complying with U.S. sanctions if challenged, and that national courts must weigh the economic consequences of keeping such a contract in force (EUR-Lex; White & Case). A blocking statute can raise a company’s risk at home without lowering it in the United States, so exporters need advice on both, including whether to seek a Commission authorization.

Allied regimes overlap but do not match. The United Kingdom’s Office of Financial Sanctions Implementation can impose civil penalties without proving knowledge, since legislation “removed the requirement for OFSI to demonstrate that a person had knowledge or reasonable cause to suspect,” with a maximum of “the greater of £1 million or 50% of the estimated value” of a breach (OFSI guidance). Canada acts under the United Nations Act, the Special Economic Measures Act, and the Justice for Victims of Corrupt Foreign Officials Act (Global Affairs Canada). Japan’s measures are “mainly implemented within the framework” of its Foreign Exchange and Foreign Trade Act (Hogan Lovells). Lists, ownership tests, licenses, and timing differ among these systems, so a company compliant in one may be exposed in another.

How good briefings work. Useful advice to exporters is concrete: which programs matter for their sectors and markets, where the dollar and U.S.-person nexus points are, where allied and U.S. lists diverge, how to seek a license or home-country authorization, and that home-country legality does not settle U.S. exposure. That service is useful whatever view a government takes of a given program.

Frequently asked questions

Can a non-U.S. company be penalized by OFAC?

Yes. A non-U.S. company is liable when it causes a violation by U.S. persons, most often by routing dollar payments for sanctioned parties through U.S. banks, as in the 2026 Adani Enterprises settlement. It may also face secondary sanctions, which can include designation, for certain dealings that involve no U.S. nexus.

What is the maximum OFAC civil penalty?

Under IEEPA, the greater of $377,700 per violation or twice the value of the underlying transaction, the level set effective January 15, 2025. Because the Office of Management and Budget canceled the 2026 inflation adjustment, the 2025 levels remain in effect. Willful violations can also be prosecuted criminally.

Is a company blocked if a sanctioned person owns 40 percent of it?

Not automatically under the 50 Percent Rule, which applies at 50 percent or more owned by one or more blocked persons in the aggregate. But OFAC advises caution with significant minority stakes or control by other means, and the GVA Capital penalty shows that knowing a blocked person’s real interest creates liability whatever the percentage on paper.

How far back can OFAC go?

Ten years, up from five, under the 21st Century Peace through Strength Act of April 24, 2024. OFAC’s recordkeeping requirement is also now 10 years.

Does the EU Blocking Statute protect European companies from U.S. sanctions?

It protects them inside the EU, by barring compliance with listed U.S. measures on Cuba and Iran and allowing damages claims. It does not change U.S. law or stop U.S. enforcement, and it can put a European company between conflicting obligations.