Secondary Sanctions: What They Are and Why Non-US Companies Face Real Exposure

In June 2025, the Office of Foreign Assets Control (OFAC) settled with GVA Capital Ltd for $215,988,868 in apparent violations of US sanctions programs, the largest single settlement of the year. GVA Capital is not a US company. This detail carries the entire point.

Secondary sanctions create financial consequences for non-US entities that engage with sanctioned parties, even when the transaction never touches US soil. If your firm clears payments in US dollars or wants to keep access to the US financial system, these rules reach you regardless of where you are incorporated.

This article explains how they work, which programs carry them, and what compliance teams operating outside the US need to do differently from standard primary sanctions screening.

What makes secondary sanctions different from primary sanctions?

Primary and secondary sanctions draw from the same watchlists, but they create different compliance obligations for different actors. Primary sanctions bind US persons, US-incorporated entities, and transactions that pass through US jurisdiction. A US bank cannot process a payment for a Specially Designated National (SDN), and any US person who processes or supports such a transaction faces civil or criminal penalties directly.

Secondary sanctions extend that reach to non-US actors by threatening loss of access to US markets, US dollar clearing, and US correspondent banking for foreign firms that engage in certain prohibited dealings. The mechanism works because even firms with no US operations often process dollar-denominated transactions through US correspondent banks, which brings those transactions briefly into US jurisdiction and within OFAC’s line of sight.

The EU’s position differs sharply. As of June 2024, EU sanctions carry no extraterritorial reach, and the EU’s Blocking Statute (Council Regulation (EC) No 2271/96) actively prohibits EU operators from complying with third-country extraterritorial laws. This creates a direct legal tension for EU-based firms caught between OFAC secondary sanctions obligations and EU regulatory requirements.

Which OFAC programs carry secondary sanctions provisions?

Not every OFAC sanctions program includes secondary sanctions authority. The programs that most frequently generate exposure for non-US firms fall into three main geographies.

Russia, under Executive Order (E.O.) 14024 as amended, gives OFAC authority to designate foreign financial institutions that conduct or take part in significant transactions involving Russia’s military-industrial base. As of April 2026, this covers persons operating in Russia’s technology, defence, construction, aerospace, or manufacturing sectors. In November 2024, OFAC issued a formal alert warning that foreign financial institutions joining Russia’s financial messaging system, the System for Transfer of Financial Messages (SPFS), face designation risk because SPFS is classified as part of Russia’s financial services sector.

Iran carries some of the most extensive secondary sanctions authority of any US program. Non-US banks that process transactions connected to Iran’s energy sector, the Central Bank of Iran, or designated Iranian financial institutions risk correspondent banking restrictions and designation under the Iran Freedom and Counter-Proliferation Act.

North Korea and Syria operate under comparable frameworks. Any non-US entity providing financial services, technology, or transport to designated North Korean or Syrian actors faces designation risk, regardless of how the transaction is denominated or routed.

How does secondary sanctions exposure happen for non-US firms?

Most exposure for non-US firms enters through dollar clearing. Global trade is still primarily dollar-denominated, and when a dollar payment clears through a US correspondent bank, that transaction briefly enters US jurisdiction. Any sanctions violation embedded in the payment chain becomes visible to OFAC at that moment.

OFAC’s November 2024 SPFS alert documented this directly. Sanctioned Iranian banks joined the Russian SPFS network specifically to maintain financial connectivity after SWIFT restrictions were imposed, and Russia pushed partner institutions to join in order to route payments for blocked Russian banks.

Foreign financial institutions that take part in those payment chains risk designation under E.O. 14024, even if their participation in SPFS appears routine on its face.

Secondary sanctions exposure is not limited to banking. European insurers covering cargo vessels transporting Russian energy products, regional technology suppliers selling components to SDN-listed entities, and logistics firms providing transport in covered sectors have all faced secondary sanctions scrutiny.

 What triggers review is the nature of the dealing and its connection to a sanctioned target, not the transaction’s currency or routing.

What should compliance teams do to manage secondary sanctions risk?

Effective secondary sanctions compliance requires steps that go beyond a standard SDN-list check, because the exposure often comes from sector-specific lists and hidden ownership structures that a basic screening pass will miss.

First, screen against the full OFAC list suite. Beyond the core SDN list, OFAC maintains the Sectoral Sanctions Identifications (SSI) List and the Correspondent Account or Payable-Through Account Sanctions (CAPTA) List, both of which carry provisions relevant to Russia and Iran. A programme that screens only the SDN list leaves material exposure unaddressed.

Second, apply enhanced due diligence to transactions routed through or involving counterparties in Russia, Iran, North Korea, Syria, Venezuela, and Cuba. Red flags include unusual payment routing, unrelated intermediaries, and invoice descriptions that do not match the underlying trade.

Third, treat SPFS membership as an evasion signal. Since OFAC’s November 2024 guidance, any counterparty routing payments via SPFS rather than the Society for Worldwide Interbank Financial Telecommunication (SWIFT) warrants escalation and additional review before processing.

Fourth, check for hidden ownership and control. OFAC’s 50% rule means any entity owned 50% or more by an SDN is itself treated as blocked, even if it does not appear on the list individually. Layered corporate structures are a common method used to obscure this relationship.

Fifth, document compliance decisions. OFAC’s Framework for Compliance Commitments makes clear that a documented, functioning compliance programme with a named compliance officer is a mitigating factor in enforcement outcomes. In 2025, OFAC collected 14 civil penalties totalling over $265 million; documentation quality was cited as a factor in several of those cases.

How Shufti helps compliance teams screen for secondary sanctions exposure

Compliance depends on a screening infrastructure that covers more than the headline SDN list. Shufti’s AML screening runs against 3,500+ global watchlists and 215+ sanction regimes in real time, covering OFAC’s full list suite, EU restrictive measures, United Nations sanctions, and UK financial sanctions list simultaneously.

The gap most compliance teams face is not knowing which counterparty relationships carry secondary exposure until a transaction is already in process. Shufti’s continuous monitoring updates every 15 minutes, so a counterparty whose beneficial owner appears on the SDN list mid-relationship is flagged before the next scheduled periodic review, not after it.

For firms operating in sectors with elevated secondary sanctions exposure, Shufti combines sanctions data with adverse media coverage across 50,000+ news sources and 415+ risk categories. That combination gives your compliance team the reasoning to distinguish genuine risk from a false positive, rather than queuing both for the same manual review.

Secondary sanctions create real exposure for firms that have never thought of themselves as falling within US jurisdiction. Shufti’s sanctions and watchlist screening covers the full infrastructure your team needs to manage that exposure, updated continuously and configurable by risk level. Request a demo to see how the screening layer performs against your own counterparty volumes.