OFAC sanctions list explained, who must comply, and what happens after a match

In November 2023, the U.S. Treasury’s Office of Foreign Assets Control settled with Binance for $968,618,825, the largest civil penalty OFAC has ever issued. Binance is not a typical name in most compliance departments, but the mechanism that caught it applies just as directly to a five-person payments startup screening its first hundred customers. The OFAC sanctions list decides who a U.S. person can do business with; it updates without warning, and it carries no size exemption. 

This guide covers what the list contains, who has to screen against it, what happens the moment a name matches, how a false match gets corrected, and how OFAC’s newest tools change the process for getting off the list.

What is OFAC, and what are OFAC sanctions?

What is OFAC, and what does the OFAC meaning behind the acronym actually cover? It stands for the Office of Foreign Assets Control, the U.S. Treasury division that administers and enforces sanctions tied to national security and foreign policy. What are OFAC sanctions in practice? They run through OFAC’s primary tool, the Specially Designated Nationals and Blocked Persons List, known as the SDN list, which names individuals, entities, vessels, and aircraft that U.S. persons cannot transact with. A match blocks the underlying property immediately.

The SDN list and the OFAC 50 Percent Rule

Anyone designated an SDN has their U.S. assets blocked and is off-limits for business with U.S. persons. The prohibition reaches further than the name on the list. Under the OFAC 50 Percent Rule, any entity owned 50 percent or more by one or more SDNs, cumulatively, counts as blocked even if that entity never appears on the list by name. The rule looks at ownership rather than control, so real exposure can sit inside a shareholder structure that a basic name search will never surface.

OFAC’s other lists, and what an OFAC sanctions search actually covers

The OFAC SDN list gets the most attention, but OFAC maintains several narrower lists with different legal effects, and a full OFAC sanctions search checks all of them, not just SDN.

• Sectoral Sanctions Identifications List. Restricts specific dealings, mainly debt and equity, with named Russian energy, defense, and financial firms, without full asset blocking.
• Foreign Sanctions Evaders List. Covers parties who violated or evaded Iran or Syria sanctions.
• Non-SDN Communist Chinese Military Companies List. Restricts investment in named Chinese defense-linked entities.

Running an OFAC sanctions screening by hand means searching each name through OFAC’s own Sanctions List Search tool, which also reflects OFAC’s country-level sanctions programs, including Cuba, Iran, North Korea, Russia, and Syria, alongside the named-party lists.

Do small businesses really need to screen against OFAC?

Yes, and no size or transaction-value threshold changes that. Running an OFAC check is not optional for any size of business. The obligation attaches to being a U.S. person, defined as any U.S. citizen, permanent resident, company organized under U.S. law, or anyone physically located in the United States.

What scales with company size is the compliance program, not the underlying duty. OFAC’s own Framework for OFAC Compliance Commitments states that an effective program varies by “the company’s size and sophistication, products and services, customers and counterparties, and geographic locations.” A ten-person crypto payments startup and a national bank face the same screening obligation, but OFAC does not expect identical staffing, tooling, or audit cadence from both. The obligation is fixed. The proportionate response to it is not.

Can OFAC freeze your bank account without warning?

Not directly, and that distinction changes how you should respond. OFAC does not reach into an account and freeze it in real time. Under 31 CFR 501.603, the U.S. financial institution holding the funds must block them the moment it identifies a match, then report that block to OFAC within 10 business days.

The bank is acting on a rule that already existed, and a list that was already public, not on a fresh instruction issued that day. That is why a freeze can feel instant and unannounced to the customer even though nothing about the underlying obligation changed. The warning, in effect, was already available to anyone screening proactively, and the account holder’s first call after a block should go to the institution that filed the report, since the block originated there rather than at OFAC.

The same 10-business-day clock applies to a rejected transaction, not only a blocked one. If a bank declines a payment outright because a party matches the list, rather than holding the funds, that rejection carries its own reporting duty under a companion rule, 31 CFR 501.604. Either way, the paper trail starts at the institution that acted, not at OFAC’s front door.

What if your customer appears on the list by mistake?

OFAC has a documented process for exactly this, and it does not require a full license application. If a name match turns out to be a false positive, meaning there was never a real blockable interest in the property, the organization that placed the block can unblock it and file a standard unblocking report citing OFAC FAQ 1196 as the authority, rather than applying for a general or specific license.

This route, called a Compliance Release, is only available to the organization that placed the block in the first place. If a customer’s funds were frozen by their own bank rather than by your business, the resolution runs through that bank, not through a direct filing on the customer’s behalf. Reliable supporting evidence for the false-positive determination still needs to exist and stay on file.

Can someone remove their name from the OFAC list?

Yes, but delisting runs through a formal petition, not a dispute process. Anyone on the SDN list, or an authorized representative, can file a request for administrative reconsideration under 31 CFR 501.807, arguing either that an insufficient basis exists for the designation or that the circumstances behind it no longer apply.

On June 29, 2026, OFAC replaced its email-based intake with an online Reconsideration Portal, built to collect the required biographical, ownership, and evidentiary detail upfront instead of through repeated follow-up questionnaires. Petitioners can also use the portal to request certain non-classified courtesy documents underlying their designation. The process itself has not gotten faster. OFAC sets no decision deadline, and a denied petition still carries a two-step administrative appeal before judicial review becomes an option.

What’s the biggest OFAC fine ever issued?

Binance’s $968,618,825 settlement in November 2023 remains OFAC’s largest civil penalty on record, resolving more than 1.6 million apparent violations tied to trades between U.S. users and sanctioned jurisdictions over five years. It edges out the $963 million OFAC assessed against BNP Paribas in 2014, part of a combined $8.9 billion settlement across several U.S. agencies.

Both cases share the same aggravating pattern. OFAC weighs several factors when it sets a penalty, and three carried the most weight in both settlements:

1. Willfulness. Whether the conduct was knowing and intentional or not an oversight.
2. Management awareness. Whether senior leadership knew sanctioned users or transactions were present and allowed it to continue.
3. Voluntary self-disclosure. Whether the company reported the issue before OFAC opened its own inquiry.

Neither Binance nor BNP Paribas self-reported, and OFAC labeled both cases egregious, which removes the credit a voluntary disclosure would otherwise earn. 

How Shufti keeps OFAC screening current

A name match against the SDN list is only as good as the list behind it, and OFAC updates its lists without a fixed schedule, sometimes several times in one week. A screening stack running on a weekly or monthly refresh is checking customers against a version of the list that is already out of date. Shufti’s Sanctions screening covers 215+ sanctions regimes, including the OFAC SDN list, alongside UN, EU, and UK designations, aggregated across 3,500+ watchlists through a single API. Sanctions data refreshes as often as every 15 minutes, so a Tuesday afternoon designation reaches your screening flow the same day it publishes, not at the next scheduled batch.

See how Shufti keeps your OFAC screening current as designations change, then book a demo.