OFAC Sanctions: Who’s Really at Risk?

Arne Mielken
Sep 22, 2025
4 min read

🔒Even non-U.S. companies can trigger U.S. sanctions – here’s how.

In today’s compliance landscape, it's no longer enough to just “not be American.” U.S. sanctions compliance reaches far beyond U.S. borders, and the Office of Foreign Assets Control (OFAC) has built a powerful enforcement machine ready to target anyone – from California to Copenhagen – if they step out of line.

Whether you're a compliance officer, consultant, or export manager, understanding how OFAC defines jurisdiction, enforces primary and secondary sanctions, and calculates penalties is essential. This blog is your go-to guide for understanding who’s really at risk, and what you can do to stay off the SDN list.

🧠 Top Tip 1: Our weekly free newsletter covers sanctions and export controls. Simply drop your e-mail at www.customsmanager.info

🧠 Top Tip 2: We offer a low-fee subscription service for export controls & sanctions professionals to stay always in the know. Visit www.customsmanager.info to learn more.

Key Questions Covered in This Blog

What is the difference between an OFAC designation and a sanctions enforcement action?
What are the main OFAC lists, and what do they mean for businesses?
What is a “U.S. nexus” and how does it create sanctions risk?
Can non-U.S. companies be penalized under U.S. sanctions?
How does OFAC determine penalties and decide when to prosecute?
What factors can mitigate or aggravate OFAC enforcement actions?

“You don’t need to have a U.S. office to face U.S. sanctions. A single dollar transaction, routed via New York, can get you blacklisted.”— Arne Mielken, Managing Director, Customs Manager Ltd

Abbreviations Used In This Blog

OFAC: Office of Foreign Assets Control (U.S. Treasury)
SDN List: Specially Designated Nationals and Blocked Persons List
IEEPA: International Emergency Economic Powers Act
DOJ: U.S. Department of Justice
OFSI: UK Office of Financial Sanctions Implementation

📞 Fancy a Call?

Book a free expert consultation on sanctions enforcement risks at www.customsmanager.org → Book Expert Call

📬 Get Weekly Game-Changing Updates with Export Control & Sanctions Watch

Sign up at www.customsmanager.info to receive crucial updates on new OFAC actions, EU measures, UK listings, and trade compliance advice — every week.

What is the difference between an OFAC designation and a sanctions enforcement action?

A designation is a policy tool. OFAC adds individuals or entities to lists like the SDN List based on a belief – not proof – that they meet certain criteria (e.g., “operating in Iran’s petroleum sector”). These are preventive and require no formal legal process. Once listed, all U.S. persons must block the designee’s assets and stop dealings.

In contrast, sanctions enforcement is a reactive tool. OFAC (or the DOJ) investigates and penalizes entities for violating existing sanctions rules, often without being listed themselves. For example, sending money to an SDN or exporting restricted goods may trigger enforcement.

OFAC is notorious for making examples of companies – both U.S. and non-U.S. – to drive home one message: compliance is not optional.

What is a “U.S. nexus” and how does it create sanctions risk?

The term “U.S. nexus” is broad by design. It includes any transaction touching U.S. territory, infrastructure, systems, or persons. That can mean:

U.S. dollar transactions, which clear through U.S. banks
Use of U.S.-based servers or cloud infrastructure
Involvement of U.S. persons or entities
U.S. origin goods, software, or technology

OFAC has taken the position that even if an email sent from Dubai uses a Microsoft server in Virginia, it may have a sufficient U.S. nexus. That’s how far-reaching U.S. enforcement can be.

Can non-U.S. companies be penalized under U.S. sanctions?

Yes. There are two main pathways:

Causing a Violation: If a foreign firm causes a U.S. person (e.g., bank) to engage in a prohibited transaction – even unwittingly – it can trigger enforcement. This is a common OFAC angle.
Secondary Sanctions: These apply even without a U.S. nexus, primarily to foreign financial institutions that engage in “significant transactions” with sanctioned entities (e.g., Iran, Russia, North Korea). These measures are mostly discretionary, but still damaging.

Many non-U.S. firms are shocked when they discover that OFAC considers them liable just for clearing payments in U.S. dollars.

How does OFAC determine penalties and decide when to prosecute?

OFAC enforcement relies heavily on aggravating and mitigating factors. When calculating a penalty, they ask:

Was it egregious?
Was it self-disclosed?
Did management know or approve?
Was there a pattern of misconduct?
Did the entity cooperate and take remedial action?

The base penalty can be up to $377,700 per transaction, or twice the value of the transaction – whichever is higher. Add to that reputational damage, frozen assets, and loss of business partners.

And if the case is criminal (i.e., willful misconduct), the DOJ can prosecute, with penalties reaching 20 years in prison and massive fines.

Arne’s Takeaway

OFAC doesn’t just target Americans. They target risk – and if your business has any touchpoint with the U.S., you’re within reach. Understanding how OFAC enforces sanctions, defines nexus, and penalizes violations isn’t optional—it’s your insurance policy.

Don’t assume you’re safe just because you’re in Frankfurt, Dubai, or Singapore. If U.S. infrastructure, services, or banks are involved, so is OFAC.

Expert Recommendations

Audit your U.S. exposure: Servers, payment flows, personnel – map your “nexus”.
Review your sanctions screening: Include not only SDN but other OFAC lists (e.g., CAPTA, NS-MBS).
Train your teams: Especially legal, finance, logistics, and IT.
File voluntary self-disclosures: If you find a violation, tell OFAC before they find you.
Get external advice: Especially when doing business in Russia, Iran, or North Korea.

Disclaimer

This blog is for educational purposes only. It is not legal advice. For specific cases or concerns, consult with legal professionals or regulatory authorities.