OFAC Sanctions Compliance for Small and Mid-Size Businesses: What You Need to Know

A Tennessee import business purchases specialty goods from a supplier in a country under US sanctions — not the country itself, but the specific supplier has recently been added to OFAC's Specially Designated Nationals list. The purchase is paid in euros through a European bank. The business owner believes US sanctions do not apply because the payment is not in dollars and the goods are not military. OFAC investigators, examining correspondent banking records, see it differently. Sanctions compliance is a legal obligation, not a large-company optional programme.

The Office of Foreign Assets Control (OFAC) administers US economic sanctions programs that apply to businesses of all sizes. The misconception that sanctions compliance is relevant only to banks, large multinationals, or defence contractors is factually incorrect and commercially dangerous. Any US person or entity — including a small Tennessee business — that engages in a transaction prohibited by OFAC sanctions faces potential civil or criminal penalties.

OFAC Sanctions — Economic restrictions administered by the US Treasury's Office of Foreign Assets Control, based on US foreign policy and national security objectives. Sanctions prohibit US persons from engaging in specified transactions with targeted countries, individuals, or entities. Major programmes include sanctions on Iran, Cuba, North Korea, Syria, Russia, Venezuela, and Belarus, as well as targeted individual sanctions under the Global Magnitsky programme.

US Person — For OFAC purposes, a US person includes US citizens and permanent residents anywhere in the world, US entities and their foreign branches, and anyone physically located in the United States. US persons are subject to primary sanctions obligations regardless of where the transaction occurs or what currency is used.

Why Small Businesses Face Real OFAC Exposure

Three common misconceptions lead small businesses to underestimate their OFAC obligations:

Misconception 1: "I'm not a bank, so OFAC doesn't apply to me." OFAC's primary sanctions apply to all US persons — not just financial institutions. A Tennessee manufacturing company that sells products to a sanctioned foreign entity has violated OFAC regulations as surely as a bank that processes a payment for a sanctioned party. Banks are higher-profile enforcement targets because they process more transactions, but OFAC has pursued enforcement actions against manufacturers, exporters, technology companies, and service providers.

Misconception 2: "If I use euros or another foreign currency, I'm outside US jurisdiction." Currency denomination does not determine OFAC jurisdiction over US persons. A US person who purchases goods from an SDN-listed company using euros has still violated OFAC primary sanctions. Currency matters for correspondent banking (dollar payments clear through US banks, creating an independent compliance obligation for the bank) — but it does not affect the US person's own legal obligation.

Misconception 3: "Our business is too small for OFAC to care about." OFAC's enforcement priorities include mid-market businesses. The agency publishes enforcement actions regularly, and they include businesses well below the size of Fortune 500 companies. Small-business violations are often identified through bank reports, trade finance disclosures, or counterparty enforcement actions — not through direct investigation.

The SDN List: What It Is and How to Screen Against It

The Specially Designated Nationals and Blocked Persons (SDN) List is OFAC's primary list of sanctioned individuals and entities. It currently contains thousands of entries including individuals, companies, vessels, aircraft, and cryptocurrency wallet addresses. US persons are prohibited from dealing with SDN-listed parties — all property of SDNs within US jurisdiction must be blocked, and transactions with SDNs are prohibited.

The SDN list is updated multiple times per week. A counterparty that was clean last quarter may be designated today. This means screening at customer or supplier onboarding is necessary but not sufficient — ongoing monitoring is required.

For small businesses, several practical screening approaches are available:

• Direct OFAC database search: OFAC provides a free online search tool at ofac.treas.gov that allows name-based searches of the SDN list and other sanctions lists. This is free but manual and not scalable for businesses with large customer or supplier bases.
• Compliance software with list screening: Providers including Dow Jones, Accuity, Refinitiv, and others offer automated list screening tools that screen against the SDN list and other government lists and generate compliance records. Entry-level products are available at prices accessible to small businesses.
• 50 Percent Rule screening: OFAC's 50 Percent Rule deems any entity 50% or more owned by SDN-listed parties to itself be treated as an SDN, even if not directly listed. Screening only direct entity names without checking beneficial ownership creates a compliance gap. For higher-risk relationships, obtain and screen beneficial ownership information down to 25% ownership.

Building a Proportionate OFAC Compliance Programme

OFAC's Framework for Compliance Commitments (published 2019) outlines five core compliance programme elements. For a small business, a proportionate implementation of these elements might look like:

1. Designate an OFAC compliance owner. This need not be a full-time position — it can be the CFO, controller, or a senior operations manager with specific responsibility for sanctions compliance training and review.
2. Assess your sanctions risk. Map your customers, suppliers, service providers, and investors against OFAC sanctions programmes. Identify which programmes create the highest potential exposure given your industry, trade routes, and counterparty geography. A Tennessee automotive parts manufacturer selling to Europe faces different risks than a technology company with customers in Latin America.
3. Implement SDN screening. Choose a screening approach appropriate for your transaction volume and risk level. Document all screening results — both matches and clears. A documented screening record is evidence of good-faith compliance if a question ever arises.
4. Review before high-value transactions. For any significant new customer, supplier, or investment relationship, conduct a sanctions check as part of your onboarding process. Require counterparties to represent that they are not on sanctions lists, and include sanctions compliance representation in contracts.
5. Know your escalation path. What do you do if a screening hits a potential match? Establish in advance: who reviews potential matches, who has authority to block or reject a transaction, and when to engage outside legal counsel.

Penalties and Voluntary Self-Disclosure

OFAC civil penalties for sanctions violations can be substantial: the higher of the transaction value or a statutory maximum that for many programmes now exceeds $350,000 per violation. In egregious cases involving wilful conduct, criminal referral to the Department of Justice is possible.

OFAC's voluntary self-disclosure process provides significant penalty mitigation for businesses that proactively identify and report apparent violations. A voluntary disclosure, timely made, can reduce civil penalties by 50% and signals the kind of good-faith compliance culture that OFAC considers in determining penalty amounts. If your business discovers a potential historical sanctions violation, consult legal counsel immediately before making any disclosure or communication with OFAC.

Frequently Asked Questions

This article is for informational purposes only and does not constitute legal or tax advice. Tax laws change frequently — consult a qualified tax attorney or CPA for advice specific to your business situation.