Penalties for OFAC Violations

OFAC Violation Penalties: What You Need to Know

Violating U.S. sanctions administered by the Office of Foreign Assets Control (OFAC) carries some of the most severe financial and criminal consequences in U.S. regulatory law. OFAC violation penalties can financially destroy businesses and result in prison sentences for individuals — even when the violation was accidental or unknowing.

OFAC enforces economic sanctions under authorities including the International Emergency Economic Powers Act (IEEPA), the Trading with the Enemy Act (TWEA), the Foreign Narcotics Kingpin Designation Act, and numerous other statutes. The range of penalties available to OFAC is broad, and the agency’s enforcement posture has grown increasingly aggressive. In 2026 alone, OFAC has already collected over $6.6 million in civil penalties across just three enforcement actions — and the year is far from over.

Understanding the full spectrum of penalties for OFAC violations — from civil fines to criminal prosecution — is essential for any business or individual that conducts cross-border transactions, international trade, or financial services. Our OFAC lawyers have defended clients across all categories of enforcement action described below.

Civil vs. Criminal OFAC Penalties: Key Differences

OFAC enforcement can result in two fundamentally different types of penalties: civil and criminal. Understanding the distinction is critical because each carries different burdens of proof, consequences, and legal strategies.

Civil penalties are imposed administratively by OFAC itself, without any requirement to prove criminal intent. OFAC applies a strict liability standard — if a prohibited transaction occurred, a civil penalty can be assessed even if the violator had no idea they were dealing with a sanctioned party. Civil penalties are financial in nature and are negotiated through the OFAC settlement process. They do not result in imprisonment, but they can reach tens of millions of dollars for large-scale or repeat violations.

Criminal penalties require proof of willfulness — that the violator knowingly and intentionally engaged in sanctioned activity. Criminal cases are referred by OFAC to the U.S. Department of Justice (DOJ), which prosecutes them in federal court. Conviction can result in up to $1 million per violation in fines and up to 20 years in prison under IEEPA. Corporate criminal liability means companies and their individual executives can face simultaneous prosecution.

High-profile criminal precedents underscore the severity of willful violations. In 2014, BNP Paribas pleaded guilty and paid $8.9 billion — the largest bank fine in history at the time — for processing transactions on behalf of Sudan, Iran, and Cuba while deliberately concealing those transactions from U.S. regulators. In 2019, Standard Chartered Bank entered a $1.1 billion deferred prosecution agreement for similar conduct. These cases illustrate that criminal OFAC enforcement is not theoretical — for institutions that willfully or systemically evade sanctions, criminal prosecution remains an active and well-resourced federal priority.

OFAC Civil Penalty Amounts in 2026

Civil penalties under OFAC are imposed without the need to prove criminal intent. OFAC operates a strict liability standard for many violations — meaning a company can be penalized even if it did not know it was dealing with a sanctioned party. Civil penalties are calculated on a per-transaction basis, meaning each separate violating transaction generates a separate potential fine.

OFAC adjusts its civil penalty caps annually for inflation. The following table reflects the current penalty maximums applicable in 2026 (use our OFAC penalty calculator to estimate your specific exposure):

It is critical to understand that these penalties apply per transaction. A company that processed 100 prohibited transactions with a sanctioned counterpart could theoretically face up to $37.7 million in civil penalties under IEEPA alone. OFAC routinely aggregates violations across multiple transactions when calculating settlement amounts, which is why some enforcement actions reach into the hundreds of millions of dollars.

Criminal Penalties for Willful OFAC Violations

When OFAC violations are deemed willful — meaning the violator knew they were dealing with sanctioned parties and proceeded anyway — criminal prosecution is a real possibility. Criminal cases are handled by the U.S. Department of Justice (DOJ) in coordination with OFAC investigations. Criminal exposure is one of the most serious outcomes of an OFAC enforcement action, and it applies to both individuals and corporate officers.

Criminal penalties for willful OFAC violations include:

• Fines of up to $1 million per violation (IEEPA-based programs)
• Imprisonment of up to 20 years for individuals (IEEPA)
• Both fines and imprisonment, imposed simultaneously
• Corporate debarment from U.S. government contracts
• Disgorgement of all profits derived from sanctioned transactions
• Asset forfeiture of funds and property involved in the violations
• Personal liability for executives and compliance officers who enabled the violations

Criminal prosecution is most likely when OFAC discovers evidence of intentional evasion — for example, stripping payment messages of identifying information, using shell companies to obscure the sanctioned counterpart, or continuing violations after a prior OFAC warning. Banks and financial institutions face particularly acute criminal exposure due to their central role in processing sanctioned transactions.

Recent OFAC Enforcement Actions: 2024–2026

OFAC’s enforcement activity in 2024–2026 demonstrates the agency’s continued focus on financial services, technology platforms, and individual actors. The following are confirmed enforcement actions and major settlements from this period:

The 2026 year-to-date total across just three enforcement actions is $6,607,661 — reflecting OFAC’s active enforcement posture. The $3.77 million individual penalty in February 2026 is exactly 10× the statutory IEEPA base amount, indicating egregious circumstances. The Payoneer case from 2025 is particularly instructive: OFAC credited the company’s robust remedial compliance program in reducing the final settlement amount substantially from the potential maximum exposure across 2,260 violations.

Penalty Mitigation Factors: How to Reduce Your OFAC Exposure

OFAC uses a formal Economic Sanctions Enforcement Guidelines framework (codified at 31 C.F.R. Part 501, Appendix A) to calculate penalties. The guidelines define base penalties for egregious and non-egregious violations, which are then adjusted based on aggravating and mitigating factors. Understanding this framework is essential to predicting and managing your OFAC exposure.

Aggravating Factors (Increase Penalties)

• Willful or reckless conduct — awareness of the violation and proceeding anyway
• Senior management involvement — executives or board members authorizing violating conduct
• History of prior OFAC violations — especially within the past 5 years
• Large transaction value or significant benefit derived from the sanctions program violation
• Concealment of violations — stripping wire transfer references, using front companies, falsifying records
• Harm to sanctions program objectives — transactions that benefit designated terrorist organizations or proliferators
• Obstruction of OFAC’s investigation or failure to cooperate

Mitigating Factors (Reduce Penalties)

• Voluntary Self-Disclosure (VSD) — typically reduces the base penalty by 50%
• Minimal or no harm to sanctions program objectives
• Robust compliance program in place at the time of violation — even if it failed to catch this instance
• No prior OFAC violations in the past 5 years
• Full cooperation with OFAC’s investigation
• Prompt remedial action — implementing systemic fixes after discovering the violation
• Isolated or low-value transaction with no pattern of violations

In practice, the difference between an egregious and non-egregious finding — combined with voluntary self-disclosure — can reduce a theoretical penalty of millions of dollars to a settlement of hundreds of thousands. This is why engaging experienced OFAC sanctions lawyers at the earliest possible stage is so critical.

Voluntary Self-Disclosure: How to Cut Your OFAC Penalty by 50%

One of the most important tools available to businesses facing potential OFAC violations is voluntary self-disclosure (VSD). OFAC’s Enforcement Guidelines treat VSD as a “substantial mitigating factor” and, in practice, consistently use it to reduce base penalty calculations by 50% or more.

For non-egregious violations where VSD is submitted, the base penalty is calculated at half the transaction value (capped at 50% of the applicable statutory maximum), compared to the full transaction value for cases without VSD. For egregious violations, VSD reduces the base penalty from the applicable statutory maximum to 50% of that maximum per transaction.

• Immediate 50% reduction in base penalty calculation
• Demonstrates cooperation, triggering additional mitigating credit
• Reduces likelihood of criminal referral to DOJ
• May result in a “no-action letter” for minor, isolated violations
• Allows the company to control the narrative and framing of the violation
• Protects the company’s banking relationships by demonstrating proactive compliance

VSD must be submitted before OFAC becomes aware of the violation through its own investigation or a third-party referral. Once OFAC opens an investigation, the benefit of VSD is typically lost. The disclosure must also be complete — withholding material facts undermines the self-disclosure and can result in aggravated penalties. Our firm has extensive experience structuring and submitting OFAC voluntary self-disclosures in ways that maximize mitigation credit.

Egregious vs. Non-Egregious OFAC Violations

OFAC’s penalty framework distinguishes sharply between egregious and non-egregious violations, as this determination has a direct multiplier effect on the penalty amount.

Non-egregious violations involve negligent conduct, systemic failures, or unknowing violations where the entity lacked actual knowledge that it was engaging with a sanctioned party. Base penalties for non-egregious cases start at half the transaction value (or half the applicable statutory maximum per transaction) — and are further reduced by mitigating factors including VSD.

Egregious violations involve willful or reckless conduct — the entity knew it was violating sanctions and proceeded anyway, or exhibited reckless disregard for whether its counterparties were sanctioned. OFAC calculates egregious base penalties at or near the statutory maximum per transaction, with potential for criminal referral. Concealment of violations — such as stripping wire references or using intermediaries to obscure sanctioned counterparties — automatically elevates a case toward egregious treatment.

The egregious/non-egregious determination is made by OFAC’s Director based on the General Factors analysis. Engaging legal counsel before OFAC makes this determination — ideally through a self-disclosure or proactive compliance consultation — can significantly influence which category your case falls into. Our OFAC compliance team works with clients to build the evidentiary record supporting non-egregious treatment.

Industries Most at Risk for OFAC Violations

While any business engaged in cross-border commerce can face OFAC exposure, certain industries face disproportionately high risk due to the volume, speed, and opacity of their transactions. OFAC’s recent enforcement record shows a clear pattern of focus on the following sectors:

Banks and Financial Institutions

Banks sit at the center of every dollar-denominated international transaction, making them OFAC’s primary enforcement target. U.S. banks are required to screen all transactions against the OFAC SDN list and block or reject prohibited transactions. Failures in correspondent banking relationships — where a U.S. bank processes transactions on behalf of foreign banks — have resulted in some of the largest OFAC settlements in history. BNP Paribas ($8.9B), Standard Chartered ($1.1B), and HSBC ($665M) are among the institutions that have faced catastrophic penalties for systematic compliance failures. Community banks and regional institutions face the same obligations but often lack the compliance infrastructure to meet them consistently.

Cryptocurrency and Fintech Platforms

OFAC has made cryptocurrency enforcement a strategic priority. Exchanges, DeFi protocols, payment processors, and blockchain analytics firms are all within OFAC’s regulatory reach. The pseudonymous nature of blockchain transactions does not provide a legal defense — OFAC has consistently held that platforms are responsible for screening users’ jurisdictions and wallet addresses against the SDN list. Recent enforcement actions against Poloniex ($7.6M), Kraken ($362K), BitPay ($507K), and Payoneer ($1.5M) reflect OFAC’s view that crypto and fintech platforms must implement the same sanctions controls as traditional financial institutions. Platforms operating across borders without robust geolocation screening and wallet address monitoring face significant exposure.

International Trade, Shipping, and Logistics

Export-oriented businesses — including manufacturers, logistics companies, freight forwarders, and commodities traders — face OFAC risk when goods or services flow through sanctioned jurisdictions or reach sanctioned end-users. The dual-use nature of many industrial goods (technology, chemicals, mechanical equipment) means that exporters must conduct enhanced due diligence on ultimate end-users. Shell company structures and multi-leg shipping routes are common evasion techniques that OFAC actively investigates. The Toll Holdings case ($6.1M settlement) demonstrates that non-U.S. shipping companies can also face OFAC penalties when they process U.S. dollar transactions through U.S. financial institutions for deliveries to sanctioned countries.

Professional and Educational Services

Law firms, accounting firms, consulting practices, and educational institutions can face OFAC penalties for providing services to sanctioned parties. The IMG Academy case ($1.72M in 2026) illustrates this exposure with particular clarity: a sports training institution was penalized for providing training services to a sanctioned individual. Professional services firms should screen all clients and counterparties against OFAC lists before engaging, particularly when serving international clientele in sectors such as sports, entertainment, technology consulting, and financial advisory.

Securities, Investment, and Insurance

Investment funds, broker-dealers, private equity firms, and insurance underwriters all face OFAC exposure through their counterparty and portfolio relationships. Underwriting risks for sanctioned vessels or cargo, investing in entities with SDN-connected beneficial ownership, or distributing returns to sanctioned investors can all trigger penalties. The TradeStation Securities case ($1.1M in 2026) demonstrates that securities platforms face the same screening obligations as banks. Registered investment advisers must also screen their investor base and portfolio companies for OFAC compliance, particularly when managing international capital.

How an OFAC Lawyer Can Help Reduce Your Penalties

When facing potential or actual OFAC enforcement, retaining experienced sanctions counsel is not optional — it is the single most consequential action you can take to protect your business and personal exposure. An OFAC lawyer provides value across every stage of the enforcement lifecycle:

Pre-Violation Compliance Counseling

Before violations occur, OFAC counsel helps businesses design and implement sanctions compliance programs tailored to their specific industry, geographic exposure, and transaction profiles. A robust, documented compliance program is one of OFAC’s most heavily weighted mitigating factors — it can be the difference between a no-action determination and a multi-million dollar penalty. Our lawyers advise on SDN screening procedures, due diligence protocols, vendor risk assessments, and compliance training programs.

Privileged Internal Investigation

When a potential violation is discovered, conducting the internal investigation under attorney-client privilege is critical. Without privilege protection, the investigation’s findings — including any evidence of willfulness or senior management knowledge — could be discoverable by OFAC or the DOJ in subsequent proceedings. Our lawyers structure investigations to maximize privilege protection while building a comprehensive factual record for the regulatory response.

Voluntary Self-Disclosure Strategy

Deciding whether, when, and how to self-disclose to OFAC is among the most consequential decisions a company facing potential violations will make. Our team conducts a careful cost-benefit analysis — weighing the 50% base penalty reduction from VSD against the risk that OFAC would not independently discover the violation, the potential for criminal referral, and secondary reporting obligations to banking regulators. Where VSD is the right course, we draft and submit disclosures that present the facts in the most favorable legal light.

Settlement Negotiation with OFAC

The majority of OFAC civil enforcement actions are resolved through negotiated settlements before any formal penalty is imposed. Our lawyers advocate for non-egregious classification, maximum mitigation credit, and the lowest possible settlement amount — while ensuring the compliance undertakings in the settlement agreement are practical and achievable. We have experience negotiating directly with OFAC’s Enforcement Division on behalf of financial institutions, technology companies, and individuals across a range of sanctions programs.

Blocked Asset Recovery and License Applications

When funds or assets have been blocked by OFAC, specific licenses can be sought to release or utilize those assets. Our team prepares specific license applications and advocates with OFAC’s Licensing Division for authorizations that allow clients to recover blocked funds or continue legitimate business operations. We also handle unblocking petitions for parties who believe they have been erroneously designated or whose assets were improperly blocked in the course of an investigation.

Statute of Limitations for OFAC Violations

Under 28 U.S.C. § 2462, OFAC has a 5-year statute of limitations for civil enforcement actions, running from the date of the apparent violation. For criminal prosecution under IEEPA and TWEA, the standard 5-year federal criminal statute of limitations also applies. However, several practical complications affect how these limits work in practice:

• Continuing violations — if a prohibited business relationship persisted over years, each day of the relationship may constitute a separate violation, restarting the clock
• Discovery of concealed violations — OFAC may argue that the statute of limitations was tolled (paused) if the violation was actively concealed
• Use of historical violations as context — even if time-barred from direct enforcement, OFAC may reference older violations as aggravating factors in current actions
• DOJ criminal investigations move on different timelines — a criminal grand jury subpoena may arrive years after the civil statute has expired

What To Do If You May Have Violated OFAC Sanctions

If you suspect your company has processed transactions with a sanctioned party, the steps you take immediately can make a significant difference in the ultimate penalty you face:

1. Engage experienced OFAC counsel immediately — attorney-client privilege protects your internal investigation from discovery by regulators
2. Conduct a privileged internal investigation — identify the scope, nature, root cause, and full transaction history of the potential violation
3. Assess voluntary self-disclosure — early, complete disclosure to OFAC typically reduces the base penalty by 50%
4. Preserve all relevant records — do not destroy documents, communications, or transaction records related to the issue
5. Implement remedial compliance measures — demonstrate to OFAC that you have fixed the compliance failures that caused the violation
6. Assess secondary exposure — identify whether your banking partners, correspondent banks, or regulators are likely to independently discover the violation

Frequently Asked Questions About OFAC Penalties

What is the maximum OFAC penalty per violation in 2026?

Under IEEPA-based sanctions programs — which cover most major OFAC programs including Russia, Iran, North Korea, and Syria — the maximum civil penalty is $377,700 per violation or twice the transaction value, whichever is greater. For violations of the Foreign Narcotics Kingpin Designation Act, the maximum reaches $1,675,988 per violation. Since each transaction constitutes a separate violation, multi-transaction cases can result in aggregate penalties reaching into the tens or hundreds of millions of dollars.

Can OFAC penalize me if I did not know I was violating sanctions?

Yes. OFAC enforces a strict liability standard for civil penalties — knowledge or intent is not required for a civil penalty to be imposed. However, lack of knowledge or willfulness is a significant mitigating factor that OFAC weighs when determining the final penalty amount. Unknowing violations that involve robust compliance programs, prompt self-disclosure, and no prior violations are frequently resolved at the lower end of the penalty range or through no-action determinations for isolated, low-value transactions.

What is voluntary self-disclosure and should I submit one to OFAC?

Voluntary self-disclosure (VSD) is a formal written notification to OFAC in which a company or individual proactively reports a potential sanctions violation before OFAC becomes aware of it independently. Submitting a VSD typically reduces the base penalty calculation by 50% and demonstrates the cooperation that OFAC credits as a mitigating factor. Whether to submit a VSD requires careful analysis — in some cases the risk of OFAC independently discovering the violation is low enough that disclosure may not be warranted. This is a strategic legal decision that should be made with experienced OFAC counsel.

How long does an OFAC enforcement investigation take to resolve?

OFAC enforcement investigations typically take between 12 and 36 months from the initial subpoena or voluntary disclosure to final resolution. Complex cases involving large transaction volumes, multiple counterparties, or parallel criminal investigations can take significantly longer. During this period, the company or individual under investigation must maintain cooperation with OFAC while carefully managing document preservation and privilege considerations. Having experienced sanctions counsel manage the investigation timeline and all communications with OFAC’s Enforcement Division is essential to achieving the best possible outcome.

Can individuals — not just companies — be penalized by OFAC?

Yes. OFAC can and does impose civil and criminal penalties on individuals, including corporate executives, compliance officers, and private persons who engage in prohibited transactions. The February 2026 enforcement action resulting in a $3.77 million individual penalty illustrates this clearly. Individual criminal prosecution under IEEPA can result in up to $1 million in fines and 20 years imprisonment per willful violation. Individuals who are personally designated to the SDN list face additional consequences including asset freezing, travel restrictions, and reputational damage that can persist for years even after the underlying legal matter is resolved.