The U.S. Treasury’s Office of Foreign Assets Control (OFAC) administers and enforces economic sanctions programs that restrict a remarkably broad range of services. Many businesses assume that sanctions only affect banks and financial institutions, but the reality is far more expansive. If you are a consultant, lawyer, insurer, software vendor, shipping operator, or real estate professional, your services may be directly regulated — or outright prohibited — under OFAC rules. Understanding which services are covered is the first step toward building an effective OFAC compliance program and avoiding potentially ruinous penalties.
The Scope of OFAC’s Service Restrictions
OFAC’s jurisdiction is triggered whenever a U.S. person provides services — directly or indirectly — to a sanctioned party, a Specially Designated National, or to a country subject to a comprehensive embargo. A “U.S. person” includes U.S. citizens, permanent residents, U.S.-incorporated entities, and their foreign branches. The Specially Designated Nationals list alone contains more than 12,000 entries, and entities owned 50% or more by a designated party are treated as blocked even if they never appear on the list themselves. This so-called 50% Rule dramatically expands the universe of prohibited counterparties. Experienced OFAC compliance lawyers can help businesses map their exposure across all relevant sanctions programs.
Financial Services
Financial services are the most heavily regulated category under OFAC. Banks, credit unions, money services businesses, broker-dealers, and payment processors are all prohibited from opening or maintaining accounts, processing wire transfers, issuing letters of credit, extending loans, or clearing transactions that involve a sanctioned person or country. This applies regardless of whether the sanctioned party is the account holder, a beneficial owner, an intermediary, or even the ultimate beneficiary of a payment. A U.S. correspondent bank that processes a USD-denominated payment on behalf of a foreign bank must screen every party in the transaction chain. Institutions that fail this obligation face severe civil monetary penalties — in some enforcement cases exceeding hundreds of millions of dollars.
Advisory and Consulting Services
Management consulting, business advisory, strategic planning, and financial advisory services are prohibited when provided to sanctioned parties. A U.S. consultant cannot advise an SDN-listed company on market entry, corporate restructuring, or investment strategy — even if no money changes hands through a U.S. bank. The mere provision of expertise constitutes a “service” under OFAC rules. This applies equally to foreign nationals employed by U.S. consulting firms working abroad, and to U.S.-based consultants advising foreign clients remotely. One of the most common compliance failures occurs when companies acquire a client without performing adequate due diligence screening — OFAC enforcement actions have repeatedly targeted advisory firms for exactly this oversight.
Legal Services
Legal services occupy a nuanced position under OFAC regulations. As a general rule, providing legal advice, representation, or transactional services to an SDN-listed person or entity is prohibited without a specific license. However, OFAC has carved out a narrow exception: U.S. lawyers may provide sanctions compliance counseling to persons who are covered under sanctions programs — meaning they may help clients understand their obligations, even if those clients are connected to sanctioned jurisdictions. What remains prohibited is general legal representation that would benefit a blocked party — drafting contracts, executing property transfers, or facilitating business arrangements that inure to a sanctioned person’s benefit. If you are a law firm operating internationally, consulting with a sanctions law firm that specializes in OFAC matters is advisable before accepting high-risk client engagements.
Insurance and Reinsurance Services
Insurance is a service industry frequently overlooked in sanctions analysis. OFAC regulations prohibit U.S. insurers and reinsurers from providing property, casualty, marine, aviation, life, or any other insurance coverage that would benefit a sanctioned person or entity. This means that issuing a policy on property owned by an SDN, providing liability coverage for a vessel flagged to a sanctioned country, or extending marine cargo insurance on a shipment to Iran or North Korea all constitute prohibited transactions. The 50% Rule applies here as well: if a policyholder is owned or controlled by a blocked entity, covering their assets constitutes a violation. Blocked assets cannot be insured without an OFAC license, and violations can result in both civil and criminal liability.
Technology and Software Services
Technology services are one of the most rapidly evolving areas of OFAC enforcement. Software licensing, cloud computing, SaaS subscriptions, cybersecurity services, IT consulting, and even providing access to online platforms can trigger sanctions liability. OFAC has taken the position that making software available — including via automatic download or app store distribution — to a person in a sanctioned country may constitute a prohibited export of services. This is particularly relevant for crypto sanctions enforcement: blockchain companies, cryptocurrency exchanges, and DeFi protocol operators are now subject to the same screening obligations as traditional financial institutions. Technology companies with global user bases must geofence sanctioned jurisdictions and screen users at onboarding. Some humanitarian technology exceptions exist under general licenses, but their scope is narrow.
Maritime and Shipping Services
Maritime services face particularly intense scrutiny under Iran sanctions and Russia sanctions programs. Vessel chartering, ship management, crewing, port services, maritime insurance (P&I), ship repair, bunkering, and freight forwarding services are all prohibited when the ultimate beneficiary is a sanctioned party or when a sanctioned vessel is involved. OFAC maintains a list of blocked vessels, and transacting with any of them — providing fuel, spare parts, crew, or anchorage — is prohibited for U.S. persons. Foreign shipping companies that conduct significant transactions involving sanctioned Iranian or Russian crude oil also risk secondary sanctions exposure, even without any direct U.S. nexus. Understanding economic sanctions in the maritime context requires specialized counsel familiar with vessel tracking, ownership structures, and flag state rules.
Real Estate Services
Real estate transactions involving sanctioned parties require careful analysis. Providing brokerage services, property management, leasing, title insurance, escrow services, or construction and renovation services to or for the benefit of a blocked person violates OFAC regulations. The analysis becomes complex when a sanctioned individual owns U.S. real property through multiple layers of shell companies — OFAC’s 50% Rule means that property owned by a chain of entities controlled by a blocked person is itself subject to blocking, even if the SDN’s name does not appear on the deed. Lawyers and title companies have a duty to screen all parties in a real estate transaction. Failure to do so can result in facilitating the holding or transfer of blocked property, exposing the professional to significant liability. Firms that discover they are holding blocked property in escrow should immediately seek guidance on their reporting and blocking obligations.
Professional Services (Accounting, PR, Recruiting)
Accounting services, auditing, public relations, advertising, recruitment, and staffing services are all subject to OFAC prohibitions when provided to sanctioned parties. An accounting firm cannot audit the books of an SDN-listed company. A public relations agency cannot run campaigns for a sanctioned government entity. A recruiting firm cannot place staff with a blocked organization. These restrictions apply even when the professional service provider has no reason to suspect the client relationship would create sanctions exposure — which is precisely why robust onboarding due diligence and periodic re-screening of the client base are essential components of any OFAC compliance program. When a violation is discovered after the fact, timely voluntary self-disclosure to OFAC can significantly mitigate potential penalties.
Exemptions and General Licenses
Not all services to sanctioned jurisdictions are prohibited. OFAC issues general licenses that authorize specific categories of otherwise-prohibited activity without requiring individual case-by-case approval. Common general license authorizations include: services provided to or for the benefit of official U.S. government activities; services provided by international organizations such as the United Nations; journalistic and news-gathering activities in sanctioned countries; personal communications (non-commercial phone and internet services); remittances from blocked accounts for the personal maintenance of individuals; export of food, medicine, and certain medical devices; and some educational and informational materials. Businesses may also apply for a specific license when their particular transaction does not fall within a general license but may qualify for case-by-case authorization. An experienced OFAC attorneys can help assess whether a contemplated service qualifies under an existing general license or warrants a specific license application.
The Importance of Export Controls
OFAC sanctions frequently overlap with export controls administered by the Commerce Department’s Bureau of Industry and Security (BIS) and the State Department’s Directorate of Defense Trade Controls (DDTC). A business may be compliant with OFAC rules but still violate export control regulations — and vice versa. This intersection is particularly common in technology services, software licensing, and defense-related consulting. Companies that provide services with a dual-use technology component must conduct a layered compliance review that covers both OFAC sanctions and applicable export control regimes. The penalties for violations under both frameworks can be compounded, making integrated compliance planning essential.
Understanding What It Means to Be Sanctioned
For service providers, it is not enough to screen only direct counterparties. You must also screen the ultimate beneficiaries of your services — including hidden beneficial owners, controlling shareholders, and downstream recipients. Understanding what it means to be sanctioned helps compliance officers appreciate why the net must be cast wide. A sanctioned person effectively loses access to the U.S. financial system and any services provided by U.S. persons. For service businesses, this means that accepting a sanctioned party as a client is not merely a legal risk — it is a direct contribution to harm that OFAC enforcement is designed to prevent.
Frequently Asked Questions
Can a U.S. law firm represent a sanctioned client?
Generally, no. U.S. lawyers are prohibited from providing most legal services to SDN-listed parties without an OFAC license. A narrow exception allows sanctions compliance counseling, but general representation — including transactional work, litigation support, or advice that benefits a blocked party — requires a specific license from OFAC.
Are technology services treated the same as financial services under OFAC?
Yes, in many respects. OFAC treats the provision of software, cloud platforms, and online services to sanctioned jurisdictions or persons as prohibited “exports of services.” Technology companies must implement geofencing, user screening, and sanctions compliance programs just as financial institutions do.
What is the 50% Rule and how does it affect service providers?
Under the 50% Rule, any entity owned 50% or more (directly or indirectly) by one or more SDN-listed persons is treated as blocked — even if that entity does not appear on the SDN list itself. Service providers must therefore screen not only direct counterparties but also their ownership structures to identify beneficial owners who may be sanctioned.
Does OFAC regulate services provided entirely outside the United States?
Yes. U.S. persons are subject to OFAC regulations regardless of where they are physically located. A U.S. citizen consulting abroad, or a U.S. company’s foreign branch, must comply with OFAC rules. Additionally, some sanctions programs — notably those for Cuba and North Korea — apply to foreign subsidiaries of U.S. companies.
What should a business do if it discovers it has been providing services to a sanctioned party?
The business should immediately cease the prohibited service, retain qualified legal counsel, block any property or interests of the sanctioned party in its possession, and evaluate whether to make a voluntary self-disclosure to OFAC. Prompt disclosure and remediation are the most effective tools for mitigating penalties in an enforcement proceeding.