SANCTIONS COMPLIANCE | 2026-10-20

OFAC Sanctions Compliance for California Businesses: The Strict-Liability Standard, the Framework for Compliance Commitments, and How a Program Keeps You Out of an Enforcement Case

U.S. economic sanctions are enforced on a strict-liability basis — a company can be penalized for a prohibited transaction even if it never knew the counterparty was blocked. Understanding how OFAC enforces its programs, what the Framework for Compliance Commitments expects, and how the facilitation and 50 Percent rules work is essential for any California business touching international trade or payments.

U.S. economic sanctions are among the most far-reaching and least forgiving rules a business can run into. They are administered by the Treasury Department’s Office of Foreign Assets Control (OFAC) , and they apply to a vast range of activity — payments, shipments, services, investments — touching s

Few areas of U.S. law reach as broadly, or punish as severely, as economic sanctions. A single prohibited wire transfer, shipment, or service can expose a company to enormous penalties, and the rules change constantly as new programs and listings are added. For California businesses — with the state’s heavy involvement in international trade, technology, finance, and logistics — sanctions compliance is not an abstract concern reserved for multinational banks. It is an operational reality that reaches importers, exporters, freight forwarders, payment processors, software companies, and investors alike. The defining feature of this regime, and the reason a compliance program matters so much, is that OFAC can impose civil penalties without proving the company meant to do anything wrong.

Who OFAC Is and What It Controls

OFAC administers and enforces U.S. economic and trade sanctions based on foreign-policy and national-security goals. Its authority flows chiefly from the International Emergency Economic Powers Act (IEEPA), 50 U.S.C. § 1701 et seq., and the older Trading with the Enemy Act (TWEA), 50 U.S.C. § 4301 et seq., along with program-specific statutes. The sanctions regulations themselves are codified across 31 C.F.R. Chapter V (Parts 500–599), with a separate set of rules for each program. Sanctions come in two broad forms: comprehensive programs that bar nearly all dealings with a country or region, and list-based programs that target specific persons and entities — most prominently those named on the Specially Designated Nationals and Blocked Persons (SDN) List. Dealing with a blocked person generally requires the U.S. person to block (freeze) the property and report it, not simply decline the deal.

The Strict-Liability Standard for Civil Penalties

The single most important thing to understand about OFAC enforcement is that civil liability is strict. A U.S. person can be held civilly liable for violating a sanctions prohibition regardless of whether it knew or had reason to know that it was engaging in a prohibited transaction. Intent is not an element of a civil violation. This is radically different from most regulatory enforcement, where knowledge or negligence must be shown, and it means that a company that is simply mistaken — about who its customer really is, who owns a counterparty, or where goods will ultimately go — can still face a penalty. (Criminal liability, by contrast, requires willfulness.) Because knowledge is irrelevant to civil exposure, a company cannot defend itself by pointing to its ignorance; it can only reduce its risk beforehand through screening and controls, and reduce its penalty afterward through the mitigating factors OFAC recognizes. Strict liability is the reason a compliance program is not optional in substance, whatever the formal rules say.

How OFAC Calculates Penalties: The Enforcement Guidelines

When a violation occurs, OFAC decides whether and how to penalize it under its Economic Sanctions Enforcement Guidelines, published at 31 C.F.R. Part 501, Appendix A. The Guidelines sort cases by whether they were voluntarily self-disclosed and whether they are “egregious,” and they weigh a list of General Factors — including willfulness or recklessness, awareness, harm to sanctions-program objectives, the violator’s sophistication, and, critically, the existence, nature, and adequacy of the company’s compliance program. Civil penalty ceilings under IEEPA are substantial and are adjusted for inflation — generally the greater of a statutory maximum per violation or twice the value of the transaction under 50 U.S.C. § 1705 — and willful criminal violations can bring far larger fines and imprisonment. The Guidelines make two things concrete: a voluntary self-disclosure can roughly halve the base penalty, and a robust compliance program is an express mitigating factor. In other words, the program a company builds in advance directly shapes what an eventual enforcement action costs.

The Framework for OFAC Compliance Commitments

OFAC has not left companies to guess what an adequate program looks like. In its Framework for OFAC Compliance Commitments, the agency set out the five essential components of an effective sanctions compliance program (SCP). They are: (1) management commitment; (2) risk assessment; (3) internal controls; (4) testing and auditing; and (5) training. The Framework also explains that when OFAC evaluates an apparent violation, it considers the existence and adequacy of the SCP against these components, and it catalogs the root causes of past enforcement cases so companies can design controls around the mistakes others have made. The five components are not a checklist to be papered over; they describe a living program that is resourced from the top, calibrated to the company’s actual risk, embedded in its transactions, tested for weaknesses, and taught to the people who run it. Each component deserves attention.

Component One: Management Commitment

Management commitment means that senior leadership — not just a compliance officer buried in the organization — actively supports the sanctions program. In practice, that means reviewing and approving the program, delegating adequate authority and autonomy to compliance personnel, committing sufficient resources (staff, technology, and budget), and fostering a culture in which compliance concerns are raised and taken seriously rather than overridden by business pressure. OFAC has repeatedly identified weak management support as a root cause of serious violations, because a program without authority or resources cannot stop a profitable transaction that senior business leaders want to close. For a California company, management commitment is demonstrated concretely: a named, empowered compliance owner; a reporting line that reaches senior management or the board; and a track record of leadership backing compliance decisions even when they cost a deal.

Component Two: Risk Assessment

A program must be built on a risk assessment that identifies where the company’s particular sanctions exposure actually lies. The relevant risks turn on the company’s customers, supply chain, intermediaries, counterparties, and geographic footprint — who it deals with, where, and through whom. A technology company with foreign-national users, an importer sourcing through multiple intermediaries, and a payment processor moving funds across borders each face different risks, and a one-size-fits-all program will miss the ones that matter. OFAC expects the assessment to be conducted in a manner proportionate to the company’s risk profile and updated as the business and the sanctions landscape change. The risk assessment is the foundation because it drives everything else: the controls, the screening, the training, and the audit should all be calibrated to the risks the assessment surfaces, not to a generic template.

Component Three: Internal Controls

Internal controls are the written policies, procedures, and systems that translate the risk assessment into day-to-day practice. They include screening counterparties and transactions against the SDN List and other restricted-party lists, procedures for blocking and rejecting transactions, escalation paths, recordkeeping, and clear lines of responsibility. Controls should be designed to prevent prohibited transactions, to detect them when prevention fails, and to ensure the company responds appropriately — including blocking property and filing required reports. Because civil liability is strict, screening is the front line: effective, well-tuned screening (with attention to aliases, fuzzy matches, and ownership) is what stops a prohibited transaction before it happens. Controls also must be documented and communicated throughout the organization, so that the people executing transactions actually follow them. Weak or poorly implemented controls are the most common root cause OFAC identifies in its enforcement cases.

Component Four: Testing and Auditing

A program is only as good as its weakest, untested link, which is why OFAC expects testing and auditing. The company should periodically subject its SCP to independent, objective review to confirm that the controls work as designed, that screening tools are properly configured, and that gaps are identified and fixed. When testing reveals a deficiency, the company is expected to take corrective action promptly. Testing and auditing matter for two reasons: they catch failures before they turn into violations, and they demonstrate — if an enforcement issue later arises — that the company was actively monitoring and improving its program rather than letting it ossify. A program that is written once and never tested invites exactly the kind of latent screening failure that produces a strict-liability violation.

Component Five: Training

Finally, OFAC expects training that is provided to all relevant employees and personnel, is tailored to their roles and the company’s risk profile, and recurs on a periodic basis. The people who onboard customers, approve transactions, book shipments, and move money need to understand what the company’s sanctions obligations are, how the controls work, and what to do when something looks wrong. Training should be documented, kept current as programs change, and extended where appropriate to agents and business partners. The best-designed controls fail if the people operating them do not know why they matter or how to apply them, so training is the component that keeps the other four alive in daily practice.

The Facilitation Trap for U.S. Persons

One of the most frequently misunderstood sanctions prohibitions is facilitation. Under many OFAC programs, a U.S. person is barred not only from engaging directly in a prohibited transaction but also from approving, financing, guaranteeing, or otherwise facilitating a transaction by a foreign person that the U.S. person could not do itself. This means a U.S. parent, employee, or executive can violate sanctions by helping or approving a foreign affiliate’s dealing with a sanctioned party, even if the U.S. person never touches the transaction directly. Facilitation catches companies that assume a transaction is “someone else’s” because a foreign subsidiary or partner carries it out. For California companies with foreign operations, affiliates, or personnel, the facilitation rules make clear that stepping back from a prohibited deal is not enough — approving, referring, or supporting it can itself be the violation.

The 50 Percent Rule and Ownership Aggregation

Another trap is the 50 Percent Rule. OFAC’s guidance provides that an entity that is owned 50 percent or more, in the aggregate, directly or indirectly, by one or more blocked persons is itself blocked — even if that entity is not named on the SDN List. The ownership of multiple blocked persons is aggregated, and ownership can be indirect through intermediate entities. The practical consequence is severe: screening only against the names on the SDN List is not enough, because a counterparty that appears “clean” by name may be blocked by operation of the 50 Percent Rule through its ownership. Effective due diligence therefore has to reach beneficial ownership, not just the name on the invoice. The 50 Percent Rule is a recurring source of strict-liability violations precisely because it blocks parties that never appear on any list.

Licenses, Blocking, and When to Self-Disclose

Where a transaction would otherwise be prohibited, OFAC may authorize it through a general license (a self-executing authorization in the regulations for a defined category of activity) or a specific license (a written authorization the company applies for and obtains). When a company finds itself holding blocked property, it generally must freeze and report it rather than return it. And when a company discovers that a violation has occurred, the Enforcement Guidelines give it a powerful option: a voluntary self-disclosure to OFAC, made before the agency learns of the matter independently, which is a mitigating factor that can substantially reduce the eventual penalty. Deciding whether and how to license, block, report, or disclose is fact-specific and consequential, and these decisions are best made promptly and with experienced counsel, because the strict-liability regime leaves little room to fix a problem after it has compounded.

Related Guides

• California International Trade & Customs Lawyers
• ITAR or EAR? Determining Export-Control Jurisdiction
• Antiboycott Compliance Under the EAR

Frequently Asked Questions

What is OFAC and what does it enforce?

OFAC is the Treasury Department’s Office of Foreign Assets Control, which administers and enforces U.S. economic sanctions under laws including IEEPA (50 U.S.C. § 1701 et seq.) and TWEA (50 U.S.C. § 4301 et seq.), with the regulations at 31 C.F.R. Chapter V (Parts 500–599). Sanctions can be comprehensive (country/region-wide) or list-based (targeting specific persons, such as those on the SDN List).

Is OFAC liability really “strict”?

For civil penalties, yes. A U.S. person can be held civilly liable for a prohibited transaction regardless of whether it knew or had reason to know the transaction was barred. Intent is not an element of a civil violation; criminal liability, by contrast, requires willfulness. Because knowledge is irrelevant to civil exposure, screening and controls — not good faith — are what protect a company.

What are the five components of an OFAC compliance program?

Per OFAC’s Framework for Compliance Commitments: (1) management commitment, (2) risk assessment, (3) internal controls, (4) testing and auditing, and (5) training. OFAC evaluates an apparent violation against these components, so a program built around all five is both the best prevention and an express mitigating factor if a violation occurs.

What is the facilitation prohibition?

Under many programs, a U.S. person may not approve, finance, guarantee, or otherwise facilitate a transaction by a foreign person that the U.S. person could not engage in directly. This means helping or approving a foreign affiliate’s prohibited dealing can itself be a violation — stepping back from the deal is not enough if you support or approve it.

What is the 50 Percent Rule?

OFAC guidance treats any entity owned 50 percent or more, in the aggregate, directly or indirectly, by one or more blocked persons as itself blocked — even if it is not named on the SDN List. Ownership is aggregated and can be indirect, so due diligence must reach beneficial ownership, not just the name on the invoice. Call Trembach Law Firm at (213) 645-2246.

How does OFAC decide penalties?

Under the Economic Sanctions Enforcement Guidelines (31 C.F.R. Part 501, App. A), OFAC considers whether the violation was voluntarily self-disclosed and whether it is “egregious,” and weighs General Factors including willfulness, awareness, harm, sophistication, and the adequacy of the compliance program. Civil ceilings under 50 U.S.C. § 1705 are large (generally the greater of a statutory maximum or twice the transaction value), and willful violations can be prosecuted criminally.

Should I voluntarily disclose a violation?

Often yes. A voluntary self-disclosure made before OFAC learns of the matter independently is a mitigating factor that can substantially reduce the base penalty under the Guidelines. But the decision is fact-specific — it affects exposure, timing, and strategy — so it should be made promptly with experienced counsel. Call Trembach Law Firm at (213) 645-2246.

Does a small California company really need a sanctions program?

If it touches international trade, payments, software, logistics, or foreign counterparties, yes. Because civil liability is strict, even a small company can be penalized for a mistaken transaction. A program proportionate to the company’s actual risk — screening, controls, training, and testing — is both the practical protection and a recognized mitigating factor.

Talk to a California Sanctions Compliance Lawyer

OFAC enforces U.S. sanctions on a strict-liability basis, which means the only reliable protection is a compliance program built before a problem arises — and the facilitation and 50 Percent rules catch companies that screen only by name. Trembach Law Firm, led by Anatolii Trembach (LL.M.; admitted in California), builds and audits sanctions compliance programs, screens counterparties and ownership, applies for licenses, and handles voluntary self-disclosures and enforcement matters. Call (213) 645-2246 for a confidential consultation.

Contact Trembach Law Firm at (818) 514-7680 for a confidential consultation.

Trembach Law Firm | 27001 Agoura Road, Suite 350, Calabasas, CA 91301