What Happens if You Violate OFAC Regulations? Penalties, Investigations, and Next Steps

Violating regulations administered by the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) can lead to substantial financial penalties, criminal prosecution, blocked property, and lasting business consequences. A violation may occur even when a person or company did not know that a transaction involved a sanctioned party. The outcome depends on the sanctions program, the facts, and how the organization responds. Understanding how OFAC investigates and penalizes violations can help businesses and individuals reduce risk and act quickly when a problem is found.

What Counts as an OFAC Violation?

OFAC administers U.S. economic and trade sanctions. These sanctions can restrict dealings with certain countries, governments, organizations, companies, and individuals. The rules vary by sanctions program, so a transaction permitted under one program may be prohibited under another.

Common violations include:

• Sending or receiving funds for a person or entity on OFAC’s Specially Designated Nationals and Blocked Persons List, often called the SDN List.
• Providing services, goods, or financial support prohibited by a sanctions program.
• Dealing in property that must be blocked, or failing to block it when required.
• Processing a prohibited payment through a U.S. bank or another U.S. person.
• Exporting or reexporting goods or technology in a way that violates sanctions.
• Causing, facilitating, or helping another party evade U.S. sanctions.
• Failing to follow applicable reporting, recordkeeping, or licensing requirements.

U.S. sanctions can apply to U.S. citizens and permanent residents, wherever they are; companies organized under U.S. law and their foreign branches; and people or entities in the United States. Some sanctions also affect non-U.S. parties, including through restrictions on transactions that pass through the U.S. financial system or through sanctions targeting certain foreign conduct. The scope depends on the relevant law and program.

Can Someone Violate OFAC Rules Without Knowing?

Yes. Many OFAC civil enforcement cases use a strict-liability standard. That means OFAC generally does not have to prove that a person knew a transaction was prohibited to find a civil violation. A company may face a civil penalty even if an employee, customer, or intermediary caused the transaction and the company did not intend to break the law.

Knowledge and intent still matter. OFAC considers what the parties knew, whether they ignored warning signs, and how carefully they investigated. A knowing or willful violation can lead to a criminal referral, while a well-designed compliance program and prompt response may weigh favorably in a civil case. Strict liability does not mean every screening mistake automatically results in a penalty: OFAC evaluates the specific conduct and the applicable legal requirements.

What Penalties Can OFAC Impose?

Consequences can include civil monetary penalties, criminal prosecution, the blocking or rejection of transactions, and other restrictions. The legal maximum depends on the statute and sanctions program involved, and penalty limits can change with inflation adjustments. For violations under the International Emergency Economic Powers Act (IEEPA), the civil maximum is generally the greater of an inflation-adjusted amount—$377,700 under the adjustment in effect in 2026—or twice the value of the underlying transaction. The applicable amount should be checked against current law and OFAC guidance.

For willful IEEPA violations, criminal penalties can include fines of up to $1 million and imprisonment for up to 20 years. Criminal charges are handled through the Department of Justice, not imposed by OFAC alone. Other statutes and sanctions programs can carry different penalties, so the IEEPA limits should not be treated as a universal cap.

In civil cases, OFAC uses its Economic Sanctions Enforcement Guidelines to evaluate the facts and calculate potential penalties. Factors include the transaction’s value, whether the conduct was egregious, whether the party voluntarily disclosed the violation, and the quality of its compliance controls. The statutory maximum is not the same as the penalty OFAC will impose. Actual outcomes range from a warning or no-action decision to a negotiated settlement or a substantial civil penalty.

How OFAC Calculates and Resolves Civil Cases

OFAC may begin by sending a request for information, subpoena, or notice of apparent violation. A notice of apparent violation identifies conduct OFAC believes may have breached sanctions rules and gives the recipient a chance to respond. It is not, by itself, a final finding or penalty.

In assessing a case, OFAC may consider whether the conduct was egregious, the transaction value, the parties’ compliance history, cooperation with investigators, and steps taken to correct the problem. A voluntary self-disclosure made before OFAC or another relevant agency has contacted the party can significantly affect the penalty calculation. It does not erase a violation or guarantee a particular result.

Possible outcomes include:

• No action: OFAC closes the matter without a formal enforcement action.
• Cautionary or finding letter: OFAC communicates concerns or findings without imposing a civil monetary penalty.
• Penalty notice: OFAC proposes a civil penalty, allowing the recipient to respond before a final determination.
• Settlement: The parties resolve the matter through an agreed payment and, in some cases, compliance commitments.
• Criminal referral: OFAC refers potential criminal conduct to the Department of Justice or another law enforcement agency.

Business Consequences Beyond Fines

The financial penalty is only one possible cost. A company may need to investigate transactions, preserve records, respond to government requests, remediate systems, and retain outside counsel or compliance specialists. Customers, suppliers, banks, and investors may pause or end relationships while the facts are assessed.

OFAC enforcement actions are often public. The resulting attention can affect reputation, access to banking, financing, insurance, and international markets. A company may also face separate investigations under export-control, anti-money-laundering, or other laws if the same conduct raises concerns under those regimes. Those outcomes are not automatic, but they can add cost and complexity.

For individuals, consequences can include personal civil liability, criminal charges in serious cases, loss of employment, and professional or reputational damage. Business leaders should not assume that only the company can be held responsible. Liability depends on the facts and the laws involved.

What Happens to Blocked or Rejected Transactions?

If a U.S. person holds property in which a blocked person has an interest, the property generally must be blocked rather than returned or transferred, unless a license or other authorization permits the transaction. A blocked transaction is typically placed in a separate, interest-bearing account and cannot be moved or used without OFAC authorization.

Some prohibited transactions must be rejected instead of blocked. For example, a payment may be rejected when it involves prohibited conduct but no blocked person has an interest in the funds. Whether a transaction must be blocked or rejected depends on the relevant sanctions rules and the facts.

OFAC regulations generally require reports about blocked property and rejected transactions within 10 business days. Persons holding blocked property also generally have an annual reporting obligation. Reporting rules, forms, and deadlines can vary, and they may change; parties should consult the applicable regulations and OFAC’s current reporting instructions. Missing a required report can create a separate compliance issue.

What to Do if a Possible Violation Is Discovered

1. Stop or contain the activity. Pause the transaction or related processing where legally appropriate. Do not release, return, or transfer property that may need to be blocked without confirming the correct treatment.
2. Preserve records. Keep payment data, screening results, messages, contracts, shipping documents, and relevant system logs. Avoid altering or deleting information.
3. Assess the facts and applicable rules. Identify the parties, locations, goods, services, payment routes, dates, and any licenses or exceptions that may apply. Screening results should be reviewed carefully; a name match alone does not always establish that a party is sanctioned.
4. Meet reporting duties. Determine whether OFAC reporting is required and track the applicable deadlines. Do not assume that a report to a bank or another agency satisfies an OFAC obligation.
5. Get qualified advice. Sanctions rules can be highly program-specific. A lawyer experienced in U.S. sanctions can help assess exposure, reporting, licensing, and communications with government agencies.
6. Correct the underlying control weakness. Review screening, escalation, training, payment review, and recordkeeping procedures. A fix should address why the transaction was able to proceed, not just the individual error.

Organizations considering voluntary self-disclosure should make that decision after a prompt, careful review. A disclosure may improve the enforcement outcome, but inaccurate, incomplete, or premature statements can create additional problems. OFAC’s guidelines distinguish voluntary self-disclosure from disclosure made after an agency has already contacted the party about the conduct.

How Businesses Can Reduce OFAC Risk

A risk-based sanctions compliance program helps identify prohibited parties and transactions before they are processed. OFAC’s published compliance framework emphasizes five components: management commitment, risk assessment, internal controls, testing and auditing, and training. The program should reflect the organization’s size, operations, customers, products, and exposure to international transactions.

Practical safeguards include screening relevant customers, owners, counterparties, vessels, and financial institutions; checking for sanctions-program restrictions beyond the SDN List; reviewing potential matches before releasing payments or goods; and documenting how alerts were resolved. Screening tools are useful, but they do not replace human review or a clear escalation process.

Businesses should also monitor changes to sanctions lists and regulations, maintain records, train staff who handle payments or international business, and periodically test controls. Banks and other intermediaries may apply their own restrictions, which can be stricter than the minimum legal requirements for a particular transaction. A company should distinguish those contractual or risk policies from the legal requirements themselves.

Where to Verify OFAC Requirements

OFAC’s website provides current sanctions lists, sanctions program information, licensing resources, enforcement guidance, and reporting instructions at ofac.treasury.gov. The Civil Penalties and Enforcement Information page links to the enforcement guidelines and penalty notices. For an apparent violation, the exact regulations and facts matter; general web guidance cannot determine whether a particular transaction is lawful.