OFAC Sound Banking Compliance Guide 1 of 2 pages 

Simple Steps for Sound Compliance 

A. Identify High Risk Business Areas 

 

A fundamental element of a sound OFAC compliance program rests on a banking institution’s assessment of its 

specific product lines and identification of the high-risk areas for OFAC transactions. As OFAC sanctions reach 

into virtually all types of commercial and banking transactions, no single area will likely pass review without 

consideration of some type of OFAC compliance measure. Relevant areas to consider in a risk assessment 

include, but are not limited to, the following: retail operations, loans and other extensions of credit (open and 

closed-ended; on and off balance sheet, including letters of credit), funds transfers, trust, private and 

correspondent banking, international, foreign offices, over-the-counter derivatives, internet banking, safe deposit, 

payable through accounts, money service businesses, and merchant credit card processing. 

B. Internal Controls 

 

An effective OFAC compliance program should include internal controls for identifying suspect accounts and 

transactions and reporting to OFAC. Internal controls should include the following elements: 

1. Flag and Review Suspect Transactions and Accounts 

A banking institution’s policies and procedures should address how it will flag and review transactions and 

accounts for possible OFAC violations, whether conducted manually, through interdiction software, or a 

combination of both methods. For screening purposes, a banking institution should clearly define 

procedures for comparing names provided on the OFAC list with the names in its files or on the transaction 

and for flagging transactions or accounts involving sanctioned countries. In high-risk and high-volume areas 

in particular, a banking institution’s interdiction filter should be able to flag close name derivations for 

review. New accounts should be compared with the OFAC lists prior to allowing transactions. Established 

accounts, once scanned, should be compared regularly against OFAC updates. 

2. Update Your Compliance Program 

A banking institution’s compliance program should also include procedures for maintaining current lists of 

blocked countries, entities, and individuals and for disseminating such information throughout the 

institution’s domestic operations and its offshore offices, branches and, for purposes of the sanctions 

programs under the Trading with the Enemy Act, foreign subsidiaries. 

3. Reporting 

A compliance program should also include procedures for handling transactions that are validly blocked or 

rejected under the various sanctions programs. These procedures should cover the reporting of blocked 

and rejected items to OFAC as provided in § 501.603 of this Part and the annual report of blocked property 

required by § 501.604 of this Part. 

How do you know your compliance program is sound? 

Guide

Guidance for Sound Banking 

Compliance 
OFAC Sound Banking Compliance Guide 2 of 2 pages 

4. Manage Your Blocked Accounts 

An audit trail should be maintained in order to reconcile all blocked funds. A banking institution is 

responsible for tracking the amount of blocked funds, the ownership of those funds, interest paid on those 

funds, and the release of blocked funds pursuant to license. 

5. Maintain License Information 

Sound compliance procedures dictate that a banking institution maintain copies of customers’ OFAC 

specific licenses on file. This will allow a banking institution to verify whether a customer is initiating a legal 

transaction. If it is unclear whether a particular transaction is authorized by a license, a banking institution 

should confirm this with OFAC. Maintaining copies of licenses will also be useful if another banking 

institution in the payment chain requests verification of a license’s validity. In the case of a transaction 

performed under general license (or, in some cases, a specific license), it is sound compliance for a 

banking institution to obtain a statement from the licensee that the transaction is in accordance with the 

terms of the license, assuming the banking, institution does not know or have reason to know that the 

statement is false. 

C. Internal Testing and Audits 

Except for a banking institution with a very low OFAC risk profile, a banking institution should have a periodic test 

of its OFAC program performed by its internal audit department or by outside auditors, consultants, or other 

qualified independent parties. The frequency of the independent test should be consistent with the institution’s 

OFAC risk profile; however, an in-depth audit of each department in the banking institution might reasonably be 

conducted at least once a year. The person(s) responsible for testing should conduct an objective, 

comprehensive evaluation of OFAC policies and procedures. The audit scope should be comprehensive and

sufficient to assess OFAC compliance risks across the spectrum of all the institution’s activities. If violations are 

discovered, they should be promptly reported to both OFAC and the banking institution’s banking regulator. 

D. Designate Responsible Individuals 

It is sound compliance procedure for an institution to designate a qualified individual or individuals to be 

responsible for the day-today compliance of its OFAC program, including at least one individual responsible for 

the oversight of blocked funds. This individual or these individuals should be fully knowledgeable about OFAC 

statutes, regulations, and relevant Executive orders. 

E. Train Your People 

A banking institution should provide adequate training for all appropriate employees. The scope and frequency of 

the training should be consistent with the OFAC risk profile and the particular employee’s responsibilities.