OFAC Compliance: Who Is Subject, and What Creates a US Nexus
A shipment of US-made servers leaves Dubai for a buyer in Nairobi. Nobody on the deal is American, the goods never touch US soil, and the invoice is paid in dollars. Two of those details are enough to bring the deal within reach of the US Treasury.
The Office of Foreign Assets Control (OFAC) is the Treasury division that administers and enforces US economic and trade sanctions, and its reach runs well beyond US borders. For a company outside the United States, the first question is not what OFAC requires. It is whether OFAC applies at all.
Who Is Subject to OFAC ?
US Persons
US persons must comply with OFAC regulations wherever they are.
The category covers:
US citizens and lawful permanent residents anywhere in the world
entities organized under US law, including their foreign branches
anyone physically present in the United States
Under certain programs, notably Cuba and Iran, foreign subsidiaries owned or controlled by US companies are covered too.
Being a US person does not protect anyone from being designated: OFAC can and does sanction US citizens and US companies.
What Creates a US Nexus
A company with no US entity, office, or employee is still within reach when a transaction carries any of these:
Trigger | What it means | Why it matters |
|---|---|---|
Payment in US dollars | A dollar payment typically clears through a US correspondent bank, which brings the transaction into US jurisdiction even when both parties are outside the United States. | A frequent trigger, and an easy one to miss, because neither party ever deals with a US bank directly. |
US-origin goods, technology or software | US rules follow US-origin goods and technology after export, including on re-export between two non-US countries. | OFAC’s own guidance says certain programs reach foreign persons who hold US-origin goods. |
A US person involved | An employee, director, agent, or adviser who is a US person brings their own obligations into the deal, wherever they work. | Catches international teams where one participant holds US citizenship or permanent residence. |
US territory or systems | Goods transiting the United States, or services and data routed through US infrastructure. | Includes transshipment and US-hosted platforms. |
Secondary Sanctions
Secondary sanctions work differently. The four triggers above bring a transaction within US jurisdiction. Secondary sanctions apply to non-US persons by design, targeting specified dealings with sanctioned parties even where no US connection exists.
Their usual consequence is exclusion from the US market or financial system rather than a penalty under US law.
Coverage varies across the programs OFAC administers, and the position changes.
What a Compliance Program Requires ?
The prohibitions are mandatory, but regulations do not require a formal sanctions compliance program.
OFAC does, however, treat the absence of one as a root cause of violations and an aggravating factor in enforcement. It treats an effective program as a mitigating factor when setting penalties. In practice, a program is expected, even though it is not strictly mandated.
The Five Components
OFAC’s Framework for OFAC Compliance Commitments, published in 2019, names five essential components:
Component | What it covers | The detail that matters |
|---|---|---|
Management commitment | Senior management approves the program, resources it, and gives compliance real authority. | OFAC has cited staff who deliberately bypassed their own company’s screening controls. |
Risk assessment | A documented review of exposure across customers, supply chains, intermediaries, products and geographies. | Updated when the business changes, not annually by habit. |
Internal controls | Procedures to identify, escalate, report and record sanctions issues, built into operations. | Should reach third parties, including contractual sanctions clauses. |
Testing and auditing | An independent check on whether the controls work. | Findings are expected to produce action, not just a report. |
Training | Training tailored to roles and refreshed regularly. | Front-line and procurement staff need different training from compliance teams. |
Blocked, Rejected, or Licensed
Blocked. Where a designated party has an interest in the property, it is frozen, not returned. Funds go into a separate blocked account and cannot be released without OFAC authorization.
Rejected. Where a transaction is prohibited but no designated party holds a blockable interest, it is refused, and nothing is frozen.
Licensed. OFAC can authorize otherwise prohibited activity. General licenses cover categories of transactions and need no application if the criteria are met. Specific licenses are issued case by case on written application.
Reported and recorded. Blocking and rejection reports go to OFAC within 10 business days, and blocked property is also reported annually. Records must be kept for 10 years, doubled from five in March 2025.
What Enforcement Actually Looks Like ?
The Range
The gap between a statutory maximum and an actual settlement can be enormous, and the breach alone does not decide where a company lands within it. OFAC weighs four things:
whether a compliance program existed
whether the company found the problem itself
whether it disclosed voluntarily
what it did next
OFAC can now pursue violations for up to 10 years after they occur.
Two Outcomes
Amazon, 2020. Amazon settled for $134,523 against a statutory maximum above $1 billion. OFAC found the violations non-egregious, voluntarily self-disclosed, and followed by significant remedial measures.
Fracht FWO, 2025. This US freight forwarder settled for $1,610,775. It had contracted with a blocked Venezuelan airline to fly goods from Mexico to Argentina, on an aircraft blocked for its links to Iran’s Mahan Air. The goods never touched the United States. OFAC found the conduct egregious and not self-disclosed, noting the company had failed to follow its own compliance procedures.
Common Violations
The recurring patterns are:
dealing with a designated party, directly or through an intermediary
processing payments that touch a sanctioned jurisdiction
supplying goods or services into an embargoed market
missing a party that a designated person owns or controls
That last pattern is why checking a party against the lists matters as much as knowing the rules.
Where the Declared Party Sits ?
A technology import paid in dollars carries a US nexus even when no party is American. Who is named on the entry then becomes both a sanctions and a customs question. The work divides cleanly:
The company’s side: its own sanctions compliance program, including risk assessment, internal controls, training and records.
The declared party’s side: screening the parties to each shipment, keeping the result with the shipment record, and filing the declaration under its registration.
Final Thoughts
OFAC does not ask whether a company is American. It asks whether a transaction touches US dollars, US goods, US persons, or US territory, and most international trade touches at least one.
Settle that question first. If the answer is yes, a documented program, accurate records, and a fast response when something goes wrong determine where a company falls in OFAC’s penalty range.
Dollars, US Goods, US Persons: Know the Nexus Before It Ships.
A US nexus turns an ordinary shipment into a sanctions question. We screen the parties, classify the goods, and file the declaration under our registration, so each shipment moves on a record that holds up to scrutiny.
Direct Line
Available on request
Shared after initial assessment.BACKED BY GCE LOGISTICS
25+ Years of International Trade & Compliance Leadership
Backed by decades of experience in global trade, IOR Service delivers the compliance frameworks, regulatory oversight, and market-entry expertise required for successful international operations. From highly regulated industries to complex cross-border projects, we help organizations move forward with certainty.Frequently Asked Questions
A US nexus is the connection that brings a transaction within US jurisdiction even when the parties are not American. The usual triggers are payment in US dollars cleared through a US correspondent bank, and US-origin goods, technology, or software. The involvement of a US person also counts, as do goods or data moving through US territory or systems. Any one of them can be enough.
Yes. Being a US person means OFAC’s rules apply to you; it does not protect you from being designated under them. OFAC can and does designate US citizens and US companies. Designation blocks their property within US jurisdiction and prohibits US persons from dealing with them.
The prohibitions are mandatory, but regulations do not require a formal compliance program. OFAC does treat the absence of one as a root cause of violations and an aggravating factor in enforcement. It treats an effective program as a mitigating factor when setting penalties. In practice, OFAC expects the program, even though it is not strictly mandated.
Often, yes. No US entity, office, or employee is needed. A dollar payment that clears through a US correspondent bank brings the transaction into US jurisdiction. So can US-origin goods or technology, a US person on the transaction, or goods transiting the United States. Secondary sanctions programs go further and are designed to apply to non-US persons.
Latest Blogs
What is an ESMA certificate? UAE product certification explained
Many businesses preparing to sell in the UAE are told they need “ESMA approval”. They then go looking for an authority that no longer runs the scheme. The Emirates Authority for Standardization and Metrology (ESMA) was merged into the Ministry of Industry and Advanced Technology (MoIAT) in 2020. The certification it was known for still exists, and the market still calls it by the old name. Knowing where it sits now saves weeks of applying to the wrong place. An ESMA certificate, as the market calls it, is UAE product conformity approval. It shows that a regulated product meets the applicable UAE, GCC, or international standards before it is sold. Today, it is issued under two MoIAT schemes: the Emirates Conformity Assessment Scheme (ECAS) and the Emirates Quality Mark (EQM). The legal basis is Federal Law No. 28 of 2001. The schemes are federal, so the same rules apply in every emirate. Because approval comes before market entry, the scheme follows the same principle as pre-shipment conformity verification in other markets.
What is TDRA approval? UAE type approval for wireless and telecom devices
Your device may already carry CE marking, have passed its RED tests, and be sold across Europe, and still be stopped at a UAE port. Almost every device sold today has a wireless function. In the UAE, that function needs its own approval before the product can be imported, sold, or even switched on, and the application cannot start until a UAE-registered dealer is in place. TDRA approval, formally called type approval, is that authorization. It is issued by the Telecommunications and Digital Government Regulatory Authority (TDRA) and confirms that a device meets UAE technical standards and will not interfere with national networks. It applies to radio and telecommunications terminal equipment (RTTE), meaning any equipment that connects directly to a public telecommunications network or contains an intentional radio transmitter. TDRA was known as the Telecommunications Regulatory Authority (TRA) until it was renamed in 2021. It is a federal regulator, so one approval covers every emirate.
EAR99: What the Designation Means, and When it Still Needs a License
EAR99 tells you what an item is not. Under the US Export Administration Regulations (EAR), it marks goods that fall under the regulations but are not listed on the Commerce Control List (CCL). What it does not tell you is where the item may go, who may receive it, or what it may be used for. Most shipments clear all three without a license. Some do not.