Why OFAC matters
OFAC enforces US economic sanctions, and the consequences of a violation are large \u2014 civil penalties up to the greater of $358,000 (as of 2025) or twice the transaction value per violation, with strict liability (no intent requirement). For a financial institution, that exposure is real. For a fintech program, it lands on the sponsor bank, then on the fintech.
In practice, OFAC compliance means screening every customer, every counterparty, and every transaction against the Specially Designated Nationals (SDN) list and the various consolidated sanctions lists.
When OFAC matters most
It matters most: (a) at onboarding, when CIP/KYC pulls trigger SDN screening; (b) at every monetary transaction, when sender and beneficiary names are screened; (c) when SDN list updates (which happen frequently) catch existing customers; and (d) during sanctions program changes (Russia, Iran, Venezuela actions move the line repeatedly).
Common pitfalls
- Fuzzy matching tuned too loose or too tight. Loose matching creates an unmanageable alert queue; tight matching misses near-matches and creates regulatory exposure. Mature programs tune continuously.
- Not screening on intermediaries. A wire's sender, beneficiary, and every intermediary bank in the chain require screening.
- Voluntary self-disclosure decisions. When you discover a violation, the path forward (disclose? remediate quietly?) is a complex legal call \u2014 have counsel on standby.
OFAC is strict liability with no materiality threshold. Build for false negatives, not for convenience.