In an increasingly interconnected world, mastering OFAC regulations has become essential for any attorney practicing sanctions law. The Office of Foreign Assets Control (OFAC) operates one of the most complex regulatory frameworks in U.S. law — one that combines executive authority, statutory mandates, and dynamic list-based targeting. For sanctions lawyers and legal professionals, a surface-level understanding is no longer sufficient. This guide provides the deep-dive practitioners need to advise clients effectively, navigate enforcement actions, and build winning compliance strategies in 2026.
The Statutory and Executive Framework Underlying OFAC Authority
OFAC derives its authority from a layered set of statutes and presidential executive orders. Understanding the legal foundation is the starting point for any OFAC attorney advising on regulatory exposure.
The International Emergency Economic Powers Act (IEEPA), enacted in 1977, is the primary statutory basis for most modern sanctions programs. IEEPA grants the President broad authority to regulate international commerce and freeze foreign assets during a declared national emergency. It covers transactions involving foreign countries, nationals, and entities. Most country-specific programs — including Russia, Iran, North Korea, and Venezuela — are grounded in IEEPA-based executive orders.
The Trading With the Enemy Act (TWEA), enacted in 1917, predates IEEPA and continues to underpin the Cuba sanctions program — one of the most comprehensive embargo regimes still in force. Unlike IEEPA, TWEA applies both in peacetime and wartime, though its modern application is largely limited to Cuba following the 1977 enactment of IEEPA.
Key executive orders that sanctions lawyers must know include:
- EO 13694/13757 — Cyber-related sanctions
- EO 13846 — Iran sanctions reimposed after JCPOA withdrawal
- EO 14024 — Russia sanctions relating to harmful foreign activities
- EO 13818 — Global Magnitsky (human rights and corruption)
- EO 13848 — Foreign interference in elections
Each executive order defines the scope of prohibited conduct, the categories of blocked persons, and any sector-specific restrictions. Reading EOs carefully — particularly their annexes and accompanying agency guidance — is critical for accurate client advice. Our sanctions law firm regularly monitors these changes as they are issued.
The SDN List: Mechanics, Scope, and the 50% Ownership Rule
The SDN list (Specially Designated Nationals and Blocked Persons List) is the operational core of OFAC’s list-based enforcement. An SDN designation means that the person or entity’s assets within U.S. jurisdiction are blocked, and U.S. persons are generally prohibited from dealing with them.
SDN entries contain the designated party’s name, date of birth, aliases, addresses, identifying numbers, and often vessel or aircraft information for transportation-related designations. Attorneys must understand that SDN list entries are not exhaustive — partial name matches and similar-sounding aliases routinely trigger compliance issues.
The 50% Ownership Rule is one of the most operationally significant — and least understood — aspects of SDN compliance. Under this rule, any entity owned 50% or more (directly or indirectly, individually or in aggregate) by one or more SDNs is itself treated as blocked, even if that entity does not appear on the SDN list by name. This has profound implications for corporate due diligence:
- A company may be fully SDN-equivalent without appearing on any list
- Chains of ownership must be traced through complex corporate structures
- OFAC’s 2014 guidance and subsequent FAQs clarify that the rule aggregates ownership across multiple SDN co-owners
- In 2026, OFAC issued updated guidance following enforcement actions targeting companies that obscured blocked-person interests behind nominee shareholders
Beyond the SDN list, practitioners must also track the Sectoral Sanctions Identifications (SSI) List, the Foreign Sanctions Evaders (FSE) List, the Non-SDN Menu-Based Sanctions (NS-MBS) List, and the CAPTA List (Correspondent Account or Payable-Through Account). Each list carries distinct prohibitions and requires separate compliance analysis. Skilled OFAC attorneys know which list applies and what conduct it prohibits.
Blocking vs. Rejection: Two Distinct Compliance Obligations
A critical distinction in OFAC compliance — one that practitioners must explain clearly to clients — is the difference between blocking and rejecting a transaction.
Blocking occurs when a transaction involves property in which a blocked person (e.g., an SDN) has an interest. The funds or property must be frozen in a segregated, interest-bearing account on the books of the institution holding them. Blocked funds cannot be returned to the sender, transferred, or otherwise dealt with without an OFAC license. The blocking must be reported to OFAC within 10 business days, and annual reports are required thereafter. If your client has encountered this situation, our team handles blocked assets matters regularly.
Rejecting (or “rejecting without blocking”) applies when a transaction is prohibited but the transaction does not involve property of a blocked person — for example, a transaction that would facilitate a prohibited activity but where no SDN’s property is at stake. In this case, the transaction is simply declined and returned to the originator. It must still be reported to OFAC within 10 business days.
Confusing blocking with rejection — or failing to block when blocking is required — is a common compliance failure that draws OFAC scrutiny. Legal counsel assisting financial institutions must ensure their clients have clear internal policies differentiating these two responses.
OFAC Licensing: General Licenses vs. Specific Licenses
When a proposed transaction is otherwise prohibited, an OFAC license may authorize it. OFAC issues two categories of licenses:
General Licenses (GLs) are pre-published authorizations that allow a defined category of transactions without individual application. They are program-specific (each sanctions program has its own GLs) and self-executing — if a party qualifies, they may rely on the GL without notifying OFAC. Examples include GLs authorizing journalistic activity in sanctioned countries, personal remittances, emergency medical services, and legal representation fees. In 2026, OFAC issued updated GLs under the Russia program (GL 128C and GL 130A) extending authorization for Lukoil-affiliated retail operations through October 2026.
Specific Licenses (SLs) are individually granted authorizations issued in response to a formal application. They are fact-specific, apply only to the named applicant, and do not set precedent. Common SL applications include:
- Unblocking and returning funds held in a blocked account
- Authorizing business operations with a sanctioned counterparty for humanitarian purposes
- Permitting legal services to SDN-designated clients
- Allowing wind-down of pre-existing contracts
OFAC’s SL application process requires detailed factual submissions, supporting documentation, and often a legal memorandum explaining why the requested activity serves U.S. policy interests or falls within an established licensing policy. Turnaround times can range from weeks to months. A /ofac-licensing/ strategy must be built into the client’s overall compliance plan from the outset. Our OFAC compliance lawyers regularly assist clients in preparing and submitting license applications.
Civil Enforcement Process: From Investigation to Settlement
OFAC’s civil enforcement process follows a structured path that sanctions attorneys must be prepared to navigate. Understanding each stage is essential for advising clients and managing risk.
Stage 1 — Pre-Penalty Notice (PPN). OFAC issues a PPN setting out the alleged violations and the proposed penalty amount. The respondent has 30 days to respond (extendable). This is the critical window for presenting mitigating arguments, factual corrections, and legal defenses.
Stage 2 — Response and Negotiation. The respondent’s response to the PPN is often the most important document in the enforcement proceeding. It should address the facts, applicable regulations, and all statutory mitigating factors. Voluntary cooperation and remedial measures demonstrated here can significantly reduce the final penalty.
Stage 3 — Final Penalty Notice (FPN) or Settlement. After reviewing the response, OFAC issues either an FPN or a settlement offer. Most matters are resolved through settlement, which may include an agreed civil monetary penalty plus compliance commitments.
Knowing when to challenge an FPN — which can be appealed to an administrative law judge — versus accepting a settlement requires experienced judgment. Our OFAC enforcement defense team has resolved matters at all stages of this process.
Penalty Calculation: Base Penalty, Aggravating and Mitigating Factors
OFAC’s civil monetary penalties are determined through a multi-factor analysis set out in OFAC’s 2009 Economic Sanctions Enforcement Guidelines (31 C.F.R. Part 501, Appendix A). Understanding this framework allows attorneys to estimate exposure and develop strategies to minimize it.
The base penalty for non-egregious violations resolved through voluntary self-disclosure is one-half of the transaction value, capped at applicable statutory maximums. For egregious violations without VSD, the base penalty can equal the full statutory maximum — which in 2026 stands at $368,136 per violation (adjusted annually for inflation under the Federal Civil Penalties Inflation Adjustment Act).
Aggravating factors that increase penalties include:
- Willful or reckless conduct
- Senior management awareness or involvement
- Large transaction values
- Harm to U.S. sanctions program objectives
- Concealment of the violation
- Prior sanctions history
Mitigating factors that reduce penalties include:
- Voluntary self-disclosure prior to OFAC investigation
- Cooperation during the investigation
- No prior OFAC history
- Remedial compliance measures implemented promptly
- Minimal harm to sanctions program objectives
- Isolated occurrence rather than pattern of violations
In 2025, OFAC completed 14 public enforcement actions, including a February 2026 action against a Florida educational institution for cartel-related SDN transactions — demonstrating that domestic businesses face the same scrutiny as financial institutions. Our OFAC enforcement actions page tracks current cases.
Voluntary Self-Disclosure: Strategy and Timing
Voluntary self-disclosure (VSD) to OFAC is one of the most powerful tools available to a sanctions attorney managing a discovered violation. When properly executed, VSD can reduce the base penalty by 50% and shift the characterization of a violation from egregious to non-egregious. However, timing and execution are everything.
A VSD should be filed promptly after discovery — delay can undermine the mitigating value and, in the worst case, allow OFAC to open its own investigation first. The VSD process involves:
- Initial notification: A letter to OFAC within 60 days of discovery identifying the apparent violation
- Complete report: A comprehensive factual submission within 180 days (extendable) detailing the transaction(s), root cause analysis, and remedial actions
- Compliance enhancements: Documentation of specific improvements to policies, procedures, and training
OFAC also has a mechanism — akin to a no-action letter — whereby parties may request a specific license or seek informal guidance before undertaking a transaction. While OFAC does not formally issue “no-action” letters, it provides guidance through its licensing process and FAQ publications. Experienced OFAC legal counsel know how to use these channels effectively.
Representing Clients Before OFAC: Practical Considerations
Representing a client in an OFAC matter — whether in an enforcement proceeding, a license application, or a delisting petition — requires specialized skills that go beyond traditional litigation. Key considerations include:
SDN List Removal: If a client has been designated, pursuing SDN list removal requires filing a comprehensive administrative petition demonstrating that the designation criteria are no longer met or were never satisfied. The petition must address every factual basis for designation and present affirmative evidence of compliance. OFAC has 180 days to respond. A successful outcome may also require parallel litigation in federal court under the Administrative Procedure Act.
Compliance Counseling: Proactive advice on OFAC compliance program design — including screening protocols, customer due diligence, training programs, and escalation procedures — is one of the most valuable services a sanctions attorney can provide. An OFAC compliance checklist tailored to the client’s risk profile is an effective starting point.
Screening Reviews: Clients in high-risk industries benefit from a professional OFAC screening review to identify false positive hits, tune matching thresholds, and ensure that screening covers all required databases including the SDN, CAPTA, NS-MBS, and Consolidated Sanctions lists.
Blocked Funds Recovery: Clients whose funds have been blocked may have avenues to release blocked funds through a specific license application, a VSD process, or, in appropriate cases, an administrative or judicial challenge to the blocking decision itself.
2026 Regulatory Landscape: What Sanctions Lawyers Need to Know
The sanctions environment in 2026 continues to evolve at a rapid pace. Key developments that every sanctions attorney should monitor:
- Russia program expansion: OFAC designated Rosneft and Lukoil to the SDN list in October 2025, triggering the 50% rule analysis for hundreds of downstream affiliates. GLs 128C and 130A were issued to provide wind-down relief.
- Gatekeeper enforcement: OFAC’s 2025-2026 enforcement priorities emphasize accountability for accountants, attorneys, and compliance officers who facilitate sanctions evasion — not just transactional parties.
- Iran maximum pressure: The Trump administration reimposed maximum pressure measures in 2025, targeting shadow fleet operators, Chinese teapot refineries, and financial intermediaries. Over 460 non-Iranian persons were designated under Iran authorities in 2025 alone.
- Venezuela mineral sector: March 2026 general licenses expanded authorization in the minerals sector, modifying prior gold-sector restrictions.
- Crypto sanctions: OFAC continues to expand crypto sanctions enforcement, with new guidance on decentralized finance and blockchain-based evasion schemes.
Staying current requires monitoring OFAC’s Recent Actions page, reading every new FAQ, and engaging with the broader community of top sanctions law firms that publish regulatory updates. Understanding what it means to be sanctioned from the client’s perspective helps attorneys communicate risk more effectively.
Building and Auditing an Effective OFAC Compliance Program
OFAC’s 2019 Framework for Compliance Commitments outlines five essential components of a sound compliance program: (1) management commitment, (2) risk assessment, (3) internal controls, (4) testing and auditing, and (5) training. These remain the benchmark in 2026.
For sanctions lawyers advising institutional clients, the risk assessment is the most critical starting point. It must account for the client’s geographic exposure, counterparty risk, product and service lines, transaction channels, and industry-specific vulnerabilities. A financial institution processing dollar-denominated correspondent transactions faces fundamentally different risks than a technology exporter or a professional services firm.
Internal controls should include automated screening against all relevant OFAC lists, escalation protocols, transaction monitoring, and clear procedures for blocking and rejecting transactions. Testing and auditing must be independent and documented. AML and OFAC compliance functions are increasingly integrated in financial institutions, as regulators view them as overlapping risk categories.
Frequently Asked Questions
What is the 50% ownership rule under OFAC?
The 50% ownership rule provides that any entity owned 50% or more — directly or indirectly — by one or more SDN-designated persons is itself treated as blocked, even if it does not appear on the SDN list. Attorneys must trace ownership chains thoroughly and account for aggregated SDN ownership across multiple co-owners.
What is the difference between blocking and rejecting a transaction?
Blocking requires freezing property in which an SDN has an interest into a segregated account and reporting to OFAC within 10 business days. Rejecting applies to prohibited transactions not involving blocked property — the transaction is declined and returned, with a separate 10-day reporting obligation. Confusing the two is a common compliance failure.
How does voluntary self-disclosure affect OFAC penalties?
A timely and complete voluntary self-disclosure reduces the base penalty by 50% for non-egregious violations and signals cooperation, which OFAC weighs as a significant mitigating factor. VSD should be filed promptly after discovery with an initial notification within 60 days and a complete report within 180 days.
What is the maximum civil penalty for an OFAC violation in 2026?
As of 2026, the maximum civil monetary penalty per violation is $368,136 (adjusted for inflation). For egregious violations, the penalty can reach the greater of this amount or twice the value of the underlying transaction. Criminal penalties for willful violations can include up to 20 years imprisonment.
How can an SDN-designated client be removed from the list?
An SDN can pursue how to get off the OFAC list through an administrative reconsideration petition filed directly with OFAC. The petition must demonstrate that the designation criteria are no longer satisfied or were erroneous. OFAC has 180 days to respond. Parallel federal court litigation under the APA may also be available. Our team specializes in OFAC delisting proceedings.