OFAC Compliance Framework: Five Components and Ten Root Causes

The US Treasury's Office of Foreign Assets Control (OFAC) does not require a formal sanctions compliance program, but it tells firms what it expects to see. On 2 May 2019 it published A Framework for OFAC Compliance Commitments, which sets out five components of an effective program and ten root causes of past compliance breakdowns. This guide summarises both from the OFAC documents. It is guidance rather than binding law. For the alert-handling side, see our guide to sanctions alert resolution and blocked and rejected reports.

Status of the framework

OFAC's recent actions page records the framework as published on 2 May 2019 and says it covers the essential components of a sanctions compliance program, with an appendix analysing root causes OFAC identified in its investigations. The document itself notes that OFAC regulations do not require a formal program, and it is offered as guidance.

The five essential components

1. Management commitment

According to the framework, senior leadership should review and approve the program. The compliance unit should have real authority, direct reporting lines to senior management, and adequate staff, expertise and technology. A dedicated sanctions compliance officer should be appointed. The framework also expects a culture of compliance where staff can report misconduct without fear of retaliation, and where leaders take violations seriously and fix root causes, preferably with systemic solutions.

2. Risk assessment

The framework describes a top-to-bottom review of exposure to sanctioned parties, countries or regions, covering customers, supply chains, intermediaries, counterparties, products, services and geographic locations. Results should set the depth of due diligence at onboarding and during mergers and acquisitions, and the assessment should be updated as new issues or root causes emerge.

3. Internal controls

Policies and procedures should be written and practical, and cover identifying, blocking, escalating, reporting and recordkeeping. They should adapt quickly to changes such as list updates, new programs and general licences. Screening and other technology should be calibrated and tested to match the organisation's risk profile. The framework expects policies to be enforced through audits, recordkeeping requirements to be met, temporary compensating controls applied when weaknesses are found, and policies communicated to staff and relevant external parties.

4. Testing and auditing

The framework calls for an independent, objective function that reports to senior management, with audit procedures matched to the size and complexity of the program, whether performed internally or externally. Negative findings should be acted on promptly, with compensating controls until the root causes are fixed.

5. Training

Training should be delivered at least annually and more often based on risk, tailored to job roles with extra focus on high-risk employees, and cover the products, customers and regions the organisation serves. Corrective training should follow testing failures or audit findings, and easily accessible materials should be available to all relevant personnel.

The ten root causes in the appendix

1. No formal program: lacking one was a root cause in many enforcement actions.
2. Misreading OFAC rules: organisations misjudged whether rules applied to them, for example through US person status, US-owned subsidiaries or exposure to the US financial system or goods.
3. Non-US facilitation: overseas affiliates, often with US headquarters involvement, approved or facilitated dealings with sanctioned parties.
4. Re-exports: non-US parties bought US-origin goods intending to resell them to sanctioned destinations, often despite warning signs.
5. Use of the US financial system: US dollar payments that passed through US banks supported sanctioned transactions, sometimes through concealment.
6. Screening software gaps: outdated systems, missed identifiers such as SWIFT codes, or failure to catch alternative spellings of names and places.
7. Weak due diligence: incomplete checks on ownership, business dealings, locations and counterparties.
8. Decentralised compliance: scattered decision-makers, inconsistent application and missing escalation or oversight.
9. Non-standard practices: unusual payment or commercial methods used to evade or conceal sanctioned dealings.
10. Individual liability: supervisors and executives sometimes directed or hid violations, and OFAC may pursue individuals as well as entities.

Our suggestions for a self-assessment

These are Learnsignal's suggestions, not OFAC requirements. Score your program against each of the five components and the ten root causes. Ask who owns sanctions decisions and whether they have a direct line to senior management. Test your screening with misspellings and alternative name forms. Check how overseas affiliates are told about US sanctions exposure. Keep evidence of each annual training round. For a related regulatory action that applies the Treasury's approach, see our guide to section 311 special measures, and for training see Learnsignal CPD.

What we could not confirm

We read OFAC's recent actions page and the framework PDF, and the text we could read did not include a publication date, which comes from the recent actions page. We have not checked whether OFAC has updated or supplemented the framework since 2019, or how it has applied it in recent enforcement actions. We did not review OFAC's enforcement guidelines or its penalty rules, so this guide does not give penalty levels.

Frequently asked questions

Is a sanctions compliance program legally required by OFAC?

The framework says OFAC regulations do not require a formal program, but it sets out what OFAC considers the essential components.

How often should sanctions training take place?

The framework says at least annually, and more often based on risk.

Can OFAC pursue individuals?

The framework's appendix lists individual liability as a root cause and says OFAC may pursue individuals as well as entities.