OFAC Sanctions Compliance Program: A Guide for Accounting Firms

In the United States, sanctions are enforced by the Treasury's Office of Foreign Assets Control (OFAC), and the rules apply to every US person, including accounting firms, whether or not the firm is covered by the Bank Secrecy Act. OFAC has published a framework that describes what it expects a sanctions compliance program to look like. This guide explains that framework for accountants and finance students, using the OFAC document "A Framework for OFAC Compliance Commitments". For the wider US picture, see our overview of US AML requirements for CPAs.

Please read "What we could not confirm" at the end. The framework is guidance, not a statute, and we did not read OFAC's enforcement guidelines, its sanctions lists or its frequently asked questions.

Who the framework is for

According to the OFAC document, the framework is aimed at organisations subject to US jurisdiction, and at foreign entities that do business in or with the United States, with US persons, or using US-origin goods or services. It encourages a "risk-based approach to sanctions compliance", which means a program tailored to factors such as the organisation's size, products, customers and geography. The text we read does not mention accounting firms specifically, so applying it to a practice is our own reading.

The five essential components

1. Management commitment

Senior leadership should review and approve the program, give the compliance function adequate resources and authority, and foster a culture of compliance. In a partnership, that points to the partners rather than to a junior compliance employee.

2. Risk assessment

Organisations should regularly assess their exposure across customers, products, supply chains, intermediaries and geographic locations, and use the results to shape their controls. The framework also mentions sanctions due diligence in mergers and acquisitions. Our guide to the firm-wide AML risk assessment shows how a practice can structure that kind of exercise.

3. Internal controls

Written policies and procedures should let the organisation identify, interdict, escalate, report and keep records of prohibited activity. The framework asks organisations to find weaknesses, work out the root cause and fix them, and to adapt controls quickly when lists or programs change.

4. Testing and auditing

An independent, objective testing or audit function should check whether the program works as designed, and any gaps should be remediated. See our guide to independent AML reviews in accountancy practices for the equivalent idea in the UK.

5. Training

Training should be provided to appropriate personnel at least annually, tailored to risk, and include accountability through assessments.

The ten root causes OFAC lists

The framework lists ten non-exhaustive root causes drawn from past enforcement actions. They are: lack of a formal program; misinterpreting or misunderstanding OFAC's regulations; facilitation of transactions by non-US persons, including overseas subsidiaries; re-exporting US-origin goods, technology or services to sanctioned persons or countries; using the US financial system for transactions involving sanctioned parties; sanctions screening software or filter faults, such as outdated lists or missed alternative spellings; improper due diligence on customers, including ownership and dealings; decentralised compliance functions and inconsistent application; non-standard payment or commercial practices; and individual liability of supervisory, managerial or executive employees.

For an accounting firm, two stand out. The first is screening failures, because a firm that checks clients once at onboarding and never again can miss a later designation. The second is improper due diligence on ownership, because a sanctioned person can sit behind a layered structure.

What OFAC says about enforcement

The document says OFAC will evaluate programs under its Economic Sanctions Enforcement Guidelines. An effective program at the time of a violation is viewed favourably under the compliance program factor, and remedial steps taken through an effective program may earn further mitigation. An effective program may also be considered when deciding whether a case is "egregious". OFAC may pursue enforcement against individuals as well as entities, and it recommends reviewing its published settlements to improve programs. The text we read does not discuss strict liability.

Our suggestions for a US accounting firm

These are our own suggestions, not OFAC requirements. Write a short sanctions policy that names who owns it. Screen new clients and their owners, and re-screen on a fixed schedule and whenever a list changes. Keep a record of each screening decision, including the false positives. Train staff once a year and record attendance. For structured study, see our CPD courses.

Frequently asked questions

Does OFAC require a written sanctions compliance program?

The framework describes what OFAC expects a program to contain and says an effective one is viewed favourably in enforcement. The text we read does not say that every organisation must have one.

How often should training happen?

The framework says at least annually.

Is a one-off client screening enough?

The framework points to outdated lists and weak ownership due diligence as common failure points, which suggests repeat screening, but the framework does not prescribe a schedule.

What we could not confirm

The text we read does not show a publication date, though law-firm summaries of it are dated May 2019. We did not read OFAC's Economic Sanctions Enforcement Guidelines, its frequently asked questions, its sanctions lists or any guidance written for accountants. We could not confirm how OFAC applies these expectations to small professional firms. Always check current OFAC guidance. This post is general information, not legal advice.