Source: https://www.treasury.gov/resource-center/faqs/Sanctions/Pages/faq_compliance.aspx
Timestamp: 2019-04-19 21:27:26+00:00

Document:
5. How do I determine if I have a valid OFAC match?
Please take the following “due diligence” steps in determining a valid OFAC match.
Step 1. Is the “hit” or “match” against OFAC’s Specially Designated Nationals (SDN) list, one of its other sanctions lists, or targeted countries, or is it “hitting” for some other reason (i.e., “Control List” or “PEP,” “CIA,” “Non-Cooperative Countries and Territories,” “Canadian Consolidated List (OSFI),” “World Bank Debarred Parties,” “Blocked Officials File,” or “government official of a designated country”), or can you not tell what the “hit” is?
If it’s hitting against OFAC’s SDN list, one of its other sanctions lists, or targeted countries, continue to 2 below.
The Denied Persons List and the Entities List, please contact the Bureau of Industry and Security at the U.S. Department of Commerce at 202-482-4811.
The FBI’s Most Wanted List or any other FBI-issued watch list, please contact the Federal Bureau of Investigation (http://www.fbi.gov/contact/fo/fo.htm).
The Debarred Parties list, please contact the Directorate of Defense Trade Controls at the U.S. Department of State, 202-663-1282.
The Bank Secrecy Act and the USA PATRIOT Act, please contact the Financial Crimes Enforcement Network (FinCEN), 1-800-949-2732.
Step 2. Now that you’ve established that the hit is against one of OFAC’s sanctions lists or targeted countries, you must evaluate the quality of the hit. Compare the name in your transactions with the name on the sanctions list. Is the name in your transaction an individual while the name on the sanctions list is a vessel, organization or company (or vice-versa)?
If no, please continue to 3 below.
Step 3. How much of the listed entry’s name is matching against the name in your transaction? Is just one of two or more names matching (i.e., just the last name)?
If no, please continue to 4 below.
Step 4. Compare the complete sanctions list entry with all of the information you have on the matching name in your transaction. An entry often will have, for example, a full name, address, nationality, passport, tax ID or cedula number, place of birth, date of birth, former names and aliases. Are you missing a lot of this information for the name in your transaction?
If yes, go back and get more information and then compare your complete information against the entry.
If no, please continue to 5 below.
Step 5. Are there a number of similarities or exact matches?
If yes, please call the hotline at 1-800-540-6322.
Step 1. Is the “hit” or “match” against OFAC’s SDN list, one of OFAC's other sanctions lists or targeted countries, or is it “hitting” for some other reason (i.e., “Control List” or “PEP,” “CIA,” “Non-Cooperative Countries and Territories,” “Canadian Consolidated List (OSFI),” “World Bank Debarred Parties,” or “government official of a designated country”), or can you not tell what the “hit” is?
If it’s hitting against one of OFAC’s sanctions lists or targeted countries, continue to 2 below.
Step 2. Now that you’ve established that the hit is against one of OFAC’s sanctions lists or targeted countries, you must evaluate the quality of the hit. Compare the name of your customer with the name on the sanctions list. Is the name of your customer an individual while the name on the sanctions list is a vessel, organization or company (or vice-versa)?
Step 3. How much of the listed entry’s name is matching against the name of your account holder? Is just one of two or more names matching (i.e., just the last name)?
Step 4. Compare the complete entry with all of the information you have on the matching name of your account holder. An entry often will have, for example, a full name, address, nationality, passport, tax ID or cedula number, place of birth, date of birth, former names and aliases. Are you missing a lot of this information for the name of your account holder?
For additional information regarding strong and weak aliases on OFAC's sanctions lists, please see the following topic.
25. Does OFAC itself require that banks set up a certain type of compliance program?
27. What do I need to do to comply? Do I have to buy expensive software?
28. How often do I need to scan my customer database against OFAC's sanctions lists?
29. How do I setup a compliance program for my bank?
30. How do I know if my compliance program is adequate?
31. What are the features and benefits that banks should be looking for when selecting an OFAC compliance software package?
32. How do I block an account or a funds transfer?
33. How much interest do I have to pay on the blocked funds?
34. Can my bank deduct service charges from the account?
35. Do all OFAC programs involve blocking transactions?
36. I understand blocking a transaction, but what is meant by rejecting a transaction? When should a transaction be rejected rather than blocked?
In some cases, an underlying transaction may be prohibited, but there is no blockable interest in the transaction. In these cases, the transaction is simply rejected, or not processed. For example, a U.S. bank would have to reject a wire transfer between two third-country companies (non-SDNs) involving an export to a company in Sudan that is not subject to sanctions. Since there is no interest of the Government of Sudan or an SDN, there is no blockable interest in the funds. The U.S. bank cannot process the transaction because that would constitute a transaction in support of a commercial activity in Sudan, which is prohibited by the Sudanese Sanctions Regulations. Similarly, a U.S. bank could not be involved in the financing of a prohibited transaction. A U.S. bank cannot so much as advise a letter of credit if the underlying transaction is in violation of OFAC regulations.
The following examples may help illustrate which transactions should be blocked and which should be rejected.
A U.S. bank interdicts a commercial payment destined for the account of XYZ Import-Export Co. at the Bank of XYZ in Sudan. The Bank of XYZ is wholly-owned by the Government of Sudan and, accordingly, is a Specially Designated National of Sudan. This payment must be blocked.
A U.S. bank interdicts a commercial payment destined for the account of ABC Import-Export at Sudanese French Bank, Khartoum, Sudan. Unlike the Bank of XYZ, Sudanese French Bank, Khartoum is a private sector entity so there is no blockable interest in this payment. However, processing the payment would mean facilitating trade with Sudan and providing a service in support of a commercial transaction in Sudan, therefore the U.S. bank must reject the payment.
39. What do I do if I have a blocked account that needs to be escheated to the state?
41. Should an institution tell its customer that it blocked their funds, and, if so, how does the institution explain it to them?
An institution may notify its customer that it has blocked funds in accordance with OFAC's instructions. The customer has the right to apply for the unblocking and release of the funds.
42. What do I do if a person tries to open an account and the person's name is on OFAC's SDN list? Do I open the account and then block the funds?
48. I just received an interdiction "alert." What do I do?
53. How do I differentiate between an "inquiry" and a "payment instruction" when a customer wants to send a wire transfer to a sanctioned party or country?
49. If I reject or block a transaction, when do I have to report the action to OFAC? How do I submit the report?
50. Is there a requirement for annual reporting of blocked property? Is there a required format?
72. Can I send money to a sanctioned country using a third-country company’s website? Can I buy gifts for someone in a sanctioned country over the internet? The websites tell me that it’s ok because they themselves are not sanctioned parties.
73. My company provides money remittance and account services via the Internet. Does OFAC have any compliance guidance for this type of business?
Complying with United States sanctions policy presents unique challenges to institutions that operate exclusively on the Internet. The Internet has often been thought of as an "anonymous venue" in that e-commerce transactions can be conducted in relative privacy with little or no face-to-face contact among the parties in a transaction. This anonymity creates a significant challenge for Internet businesses that wish to satisfy their due diligence requirements.
B. Engaging in trade or transaction activities with sanctions targets named on OFAC's list of Specially Designated Nationals and Blocked Persons (SDN's).
A number of Internet-based financial service companies already developed Internet Protocol (IP) address blocking procedures. These companies use publicly available data to maintain tables of IP addresses based on geographic region. Users attempting to initiate an online transaction or access an account from a sanctioned country are blocked based on their IP address. While this approach is effective, it does not fully address an Internet firm’s compliance risks. The fact that international distribution authorities can reassign IP blocks makes the geographic location of an IP potentially dynamic.
The anonymous character of Internet-based transactions often places obstacles in the path of rigorous compliance practices. Firms that facilitate or engage in e-commerce should do their best to know their customers directly. In order to minimize their liabilities, Internet remittance and account service firms should attempt to gather authentic identification information on their customers before a new account is opened or new transaction is initiated. This information will help confirm the customer’s identity and help the e-commerce firm ensure it is not conducting business with a sanctions target. Currently many Internet remittance companies use credit card authentication as the primary method of confirming a customer's identity. While this method is technologically expedient, it does not meet the standards of due diligence normally found in the non-Internet-based financial community. A company cannot rely on another firm’s compliance program in order to mitigate risk.
For information regarding Cyber-related Sanctions and Executive Orders 13694 and 13757, please see the following topic.
Effective January 17, 2017, the general license under the Sudanese Sanctions Regulations, 31 C.F.R. part 538 (SSR), authorizing the exportation, reexportation, or provision of certain services, software, and hardware incident to personal communications, 31 C.F.R. § 538.533, has been superseded by a broader general license under the SSR that authorizes all transactions prohibited under the SSR. See 31 C.F.R. § 538.540. As a result, for such exports and reexports to Sudan, U.S. persons may rely on the broader authorization in § 538.540 and do not need to abide by the narrower requirements of § 538.533. Section 538.540 only authorizes transactions prohibited under the SSR and does not affect Iran General License D-1.
434. Are all applications designed to run on mobile operating systems (“apps”) covered by the Personal Communications GLs?
435. Is the exportation of anti-virus, anti-malware, anti-tracking, and anti-censorship software authorized?
436. What do Secure Socket Layers (SSLs), listed in the Annex to GL D-1 and in Appendix A to § 538.533, encompass?
437. Are mobile phone accessories and computer accessories and peripherals authorized for export under the Personal Communications GLs?
438. Is the exportation of parts or components for authorized hardware, such as microprocessors, authorized under the Personal Communications GLs?
439. Do the Personal Communications GLs authorize the export of bundled software that includes both software authorized by the Personal Communications GLs and software that is not authorized by the Personal Communications GLs?
440. Do the Personal Communications GLs authorize the exportation to Iran and Sudan of fee-based desktop publishing software and productivity software suites used to publish documents, presentations, spreadsheets, charts, music, movies, and digital images?
442. For purposes of category (5) of the Annex to GL D-1 and Appendix A to § 538.533, respectively, what would be considered “software required for effective consumer use” of personal computing devices, laptops, and tablets?
443. What are “residential consumer” satellite terminals and transceiver equipment?
61. State insurance statutes regulate an insurer's ability to withhold claim payments, cancel policies or to decline to enter into policies. In some cases, insurers must commit an ostensible violation of state insurance regulations to comply with OFAC regulations. Does OFAC have a position as to whether OFAC regulations preempt state insurance regulations in this context?
62. At what point must an insurer check to determine whether an applicant for a policy is a Specially Designated National (SDN) or is on one of OFAC's other sanctions lists?
63. What should an insurer do if it discovers that a policyholder is or becomes a Specially Designated National (SDN)--cancel the policy, void the policy ab initio, non-renew the policy, refuse to pay claims under the policy? Should the claim be paid under a policy issued to an SDN if the payment is to an innocent third-party (for example, the injured party in an automobile accident)?
64. A workers' compensation policy is with the employer, not the employee. Is it permissible for an insurer to maintain a workers compensation policy that would cover a person on the Specially Designated Nationals (SDN) List, since the insurer is not transacting business with the SDN, but only with his/her employer?
If an insurer knows that a person covered under the group policy is an SDN, that person’s coverage is blocked, and if he or she makes a claim under the policy, the claim cannot be paid. If an insurer does not know the names of those covered under a group policy, it would have no reason to know it needed to block anything unless and until an SDN files a claim under that policy. At that point its blocking requirement would kick in.
65. How frequently is an insurer expected to scrub its databases for OFAC compliance?
That is up to your firm and your regulator. Remember that a critical aspect of the designation of a Specially Designated National (SDN) is that the SDN's assets must be frozen immediately, before they can be removed from U.S. jurisdiction. If a firm only scrubs its database quarterly, it could be 3 months too late in freezing targeted assets. Although the prohibitions and treatments for individuals and entities on OFAC's other sanctions lists are different from those on the SDN list, there may be similar consequences if your firm takes a long time in recognizing a sanctions list match.
66. Is it sufficient if my company screens life insurance policies only prior to policy issuance?
68. If my screening efforts uncover a policyholder who became a Specially Designated National after policy issuance, can I notify the policyholder that the policy is "blocked"?
69. In my letter to the policyholder whose policy is "blocked," may I also instruct the policyholder not to send any more premium or that we will not accept additional premium under this account?
102. How can an insurer participate in worldwide insurance markets through global insurance policies if, by definition, coverage extends to potential risks in sanctioned countries?
103. What if the commercial setting and/or market circumstances of a global insurance policy does not permit the use of an OFAC exclusion such as the one noted above?
104. Can an insurer offer global travel insurance and worldwide travel assistance without violating U.S. sanctions?
For additional information regarding insurance, reinsurance, and underwriting activities in Iran, please see the following topic.
40. If my financial institution receives a wire going to an embassy in a sanctioned country, can we process the transaction?
43. Does a financial institution need to scan names against OFAC's list of targets upon account opening or can it wait for 24 hours to receive a report from its software vendor on whether or not there is a hit?
44. Is there a dollar limit on which transactions are subject to OFAC regulations?
45. Does my bank need to check the OFAC list when selling cashier's checks and money orders? In the case of cashier's checks, do I need to check both the purchaser and the payee? As a mortgage lender, do I need to check both the purchaser and the seller's name against the Specially Designated Nationals list? Do I need to check their names against all of OFAC's other sanctions lists?
46. If a loan meets underwriting standards but is a true "hit" on OFAC's Specially Designated Nationals (SDN) list, what do we use as a denial reason on the adverse action notice?
47. Through corporate giving programs, many banks contribute toward charities and other non-profits. To what extent does a bank need to review the recipients of these gifts or the principals of the charities?
52. Can U.S. financial institutions open correspondent accounts for Iraqi financial institutions, or process funds transfers to and from Iraqi financial institutions?
95. Does a financial institution have the obligation to screen account beneficiaries for compliance with OFAC regulations?
116. On February 14, 2008, OFAC issued guidance stating that the property and interests in property of an entity are blocked if the entity is owned, directly or indirectly, 50% or more by a person whose property and interests in property are blocked pursuant to an Executive Order or regulations administered by OFAC. We act as an intermediary bank in wire transfers between other banks. Does OFAC expect banks that are acting as financial intermediaries to research non-account parties that do not appear on the SDN List, but are involved with or referenced in transactions that are processed on behalf of correspondents?
A wire transfer in which an entity has an interest is blocked property if the entity is 50% or more owned by a person whose property and interests in property are blocked. This is true even in instances where such a transaction is passing through a U.S. bank that (1) is operating solely as an intermediary, (2) does not have any direct relationship with the entity (e.g., the entity is a non-account party), and (3) does not know or have reason to know the entity’s ownership or other information demonstrating the blocked status of the entity’s property. In instances where all three conditions are met, notwithstanding the blocked status of the wire transfer, OFAC would not expect the bank to research the non-account parties listed in the wire transfer that do not appear on the SDN List and, accordingly, would not pursue an enforcement action against the bank for having processed such a transaction.
If a bank handling a wire transfer currently has information in its possession leading the bank to know or have reason to know that a particular individual or entity involved with or referenced in the wire transfer is subject to blocking, then the bank will be held responsible if it does not take appropriate steps to ensure that the wire transfer is blocked.
OFAC expects banks to conduct due diligence on their own direct customers (including, for example, their ownership structure) to confirm that those customers are not persons whose property and interests in property are blocked.
335. Firms operating in the securities industry as custodians and securities intermediaries often face the question of how to accurately identify the beneficial owner of assets within an account or transaction. What can these firms do to protect themselves from the risk of directly or indirectly providing services to—or dealing in property in which there is an ownership or other interest of—parties subject to sanctions?
Making customers aware of the firm’s U.S. sanctions compliance obligations and having customers agree in writing not to use their account(s) with the firm in a manner that could cause a violation of OFAC sanctions. Sanctions may be implicated when the United States is the jurisdiction of issuance or custody of an underlying security or when a U.S. person acts as a custodian or other service provider.
Conducting due diligence, including through the use of questionnaires and certifications, to identify customers who do business in or with countries or persons subject to U.S. sanctions. Such customers may warrant enhanced due diligence because of an increased risk that they will use their accounts to hold assets or conduct transactions for third parties subject to sanctions.
Imposing restrictions and heightened due diligence requirements on the use of certain products or services by customers who are judged to present a high risk from an OFAC sanctions perspective. Restrictions might include limitations on the use of omnibus accounts, where a lack of transparency can be exploited in order to circumvent OFAC regulations.
Making efforts to understand the nature and purpose of non-proprietary accounts, including requiring information regarding third parties whose assets may be held in the accounts. Red flags may arise relating to geographic areas or the nesting of third-party assets.
For additional information regarding Iran, please see the following topic.
559. For purposes of OFAC sanctions programs, what do the terms “virtual currency,” “digital currency,” “digital currency wallet,” and “digital currency address” mean?
Virtual currency is a digital representation of value that functions as (i) a medium of exchange; (ii) a unit of account; and/or (iii) a store of value; is neither issued nor guaranteed by any jurisdiction; and does not have legal tender status in any jurisdiction.
A digital currency wallet is a software application (or other mechanism) that provides a means for holding, storing, and transferring digital currency. A wallet holds the user’s digital currency addresses, which allow the user to receive digital currency, and private keys, which allow the user to transfer digital currency. The wallet also maintains the user’s digital currency balance. A wallet provider is a person (individual or entity) that provides the software to create and manage wallets, which users can download. A hosted wallet provider is a business that creates and stores a digital currency wallet on behalf of a customer. Most hosted wallets also offer exchange and payments services to facilitate participation in a digital currency system by users.
560. Are my OFAC compliance obligations the same, regardless of whether a transaction is denominated in digital currency or traditional fiat currency?
Yes, the obligations are the same. U.S. persons (and persons otherwise subject to OFAC jurisdiction) must ensure that they block the property and interests in property of persons named on OFAC’s SDN List or any entity owned in the aggregate, directly or indirectly, 50 percent or more by one or more blocked persons, and that they do not engage in trade or other transactions with such persons.
As a general matter, U.S. persons and persons otherwise subject to OFAC jurisdiction, including firms that facilitate or engage in online commerce or process transactions using digital currency, are responsible for ensuring that they do not engage in unauthorized transactions prohibited by OFAC sanctions, such as dealings with blocked persons or property, or engaging in prohibited trade or investment-related transactions. Prohibited transactions include transactions that evade or avoid, have the purpose of evading or avoiding, cause a violation of, or attempt to violate prohibitions imposed by OFAC under various sanctions authorities. Additionally, persons that provide financial, material, or technological support for or to a designated person may be designated by OFAC under the relevant sanctions authority.
561. How will OFAC use its existing authorities to sanction those who use digital currencies for illicit purposes?
562. How will OFAC identify digital currency-related information on the SDN List?
563. What is the structure of a digital currency address on OFAC’s SDN List?
594. Is it possible to query a digital currency address using OFAC’s Sanctions List Search tool?

References: § 538
 § 538
 § 538
 § 538
 § 538
 § 538