OFAC penalties and enforcement: what a small business should know

OFAC can impose civil penalties for sanctions violations on a strict liability basis, which means a US business can be liable even without knowing it dealt with a sanctioned party (OFAC strict liability guidance). Under the International Emergency Economic Powers Act, the civil maximum is the greater of $377,700 or twice the value of the transaction, per violation (Sanctions Penalties Regulations). OFAC also weighs whether you had a compliance program, which can reduce a penalty (OFAC framework).

Strict liability, in plain terms

OFAC's guidance says that "in many cases, a U.S. person may be held civilly liable for sanctions violations even without having knowledge or reason to know it was engaging in such a violation" (OFAC strict liability guidance). It adds that OFAC looks at the totality of facts and circumstances to decide its response, and may treat a risk-based compliance program and remedial steps as mitigating factors.

For a small business, that means two things. Not knowing is not a defense on its own. And what you can show about how you checked matters when OFAC decides what to do.

How large the penalties can be

On 25 September 2026 OFAC published the Sanctions Penalties Regulations, a new 31 CFR part 505 that consolidates penalty information used across its programs (Sanctions Penalties Regulations). The rule states:

Civil, under IEEPA: up to the greater of $377,700 or twice the amount of the transaction that is the basis of the violation.
Criminal, for willful violations: a fine of up to $1,000,000 and, for an individual, up to 20 years in prison, or both.
Inflation: the civil amounts are adjusted under the federal civil penalties inflation adjustment law.

The same rule also sets out penalties under the United Nations Participation Act, which carries its own amounts.

What OFAC weighs when it decides

The rule summarizes the factors OFAC considers, including whether a violation was willful or reckless, awareness of the conduct, and harm to the program's objectives. It also notes that base penalties are halved when OFAC learns of the violation through a voluntary self-disclosure (Sanctions Penalties Regulations).

The full method is in OFAC's Economic Sanctions Enforcement Guidelines (31 CFR part 501, Appendix A). OFAC's 2019 framework explains how a compliance program fits in: under the guidelines' compliance program factor, OFAC "may consider the existence, nature, and adequacy" of a sanctions compliance program and "when appropriate, may mitigate" a penalty on that basis (OFAC framework).

Where OFAC publishes enforcement actions

OFAC lists every civil penalty, settlement and finding of violation by year on its Civil Penalties and Enforcement Information page (OFAC enforcement information). As of 9 October 2026 the page showed 7 actions in 2026 totalling $284,145,655. Most of that total is one $275,000,000 settlement. The same list includes an action against Rice Lake Weighing Systems for $60,764 and two actions against individuals.

Reading the published cases closest to your industry is a practical way to see what OFAC treats as a failure.

What a small business can do now

Screen before you deal. Check customers, vendors and other parties against the SDN and Consolidated lists before the transaction, not after.
Re-screen on a schedule you write down. OFAC leaves frequency to your own policy (OFAC FAQ 28); see how often to re-screen.
Keep the records. OFAC requires records of transactions subject to its rules for at least 10 years (31 CFR 501.601). A dated screening record is the evidence that you checked.
Write the program down. The framework's five components are management commitment, risk assessment, internal controls, testing and auditing, and training (OFAC framework). Our compliance program template is a starting point.
Know what to do on a match. Blocking and reporting deadlines are short; see what to do on a true match.

Start with the check

This is screening data, not legal advice. Run a free check against the SDN and Consolidated lists before your next deal, payment or vendor setup.