Written and maintained by CASRAI Editorial Board
Last updated
An OFAC compliance program, which OFAC calls a sanctions compliance program (SCP), is a written, risk-based set of controls that an organization uses to avoid dealing with sanctioned persons, places and activities. OFAC’s framework names five essential components: management commitment, risk assessment, internal controls, testing and auditing, and training. This guide applies each component to a research institution. It follows OFAC’s framework document as described there on 2026-10-29.
What the framework is and who issued it
The framework is a document from the Office of Foreign Assets Control (OFAC), the U.S. Treasury office that administers and enforces U.S. economic and trade sanctions, titled A Framework for OFAC Compliance Commitments. In it, OFAC strongly encourages organizations subject to U.S. jurisdiction to take a risk-based approach to sanctions compliance by developing, implementing and routinely updating an SCP. It says a program should be predicated on, and incorporate, at least five essential components of compliance.
Who it applies to
OFAC addresses organizations subject to U.S. jurisdiction, and says programs vary with an organization’s size and sophistication, products and services, customers and counterparties, and geographic locations. It also states that OFAC regulations do not require a formal SCP, while encouraging one, especially for organizations in international trade or with clients or counter-parties outside the United States. This page does not claim that any university is legally required to have one. For the underlying lists and the wider export-control picture, see OFAC list and embargoed countries and export control.
The five components, applied to a research institution
The component descriptions below follow OFAC’s document. The research-office mapping in the right-hand column is this guide’s illustration, not OFAC text.
| Component | What OFAC’s document describes | Where it shows up in a research office |
|---|---|---|
| 1. Management commitment | Senior leadership, executives and/or the board have reviewed and approved the program; the compliance unit has sufficient authority, autonomy and direct reporting lines to senior management; adequate resources, including a dedicated sanctions compliance officer; a culture of compliance. | An approved institutional policy and a named owner with a reporting line above the individual departments. |
| 2. Risk assessment | No one-size-fits-all approach; a holistic review of touchpoints covering customers, supply chain, intermediaries and counter-parties; products and services; and geographic locations. Updated when violations reveal root causes. | Mapping international collaborators, subawardees, vendors, visitors and payees, and the countries they sit in. |
| 3. Internal controls | Written policies and procedures to identify, interdict, escalate, report (as appropriate) and keep records of potentially prohibited activity; enforced; weaknesses remediated, including root cause analysis; recordkeeping that accounts for OFAC requirements. | Screening steps at onboarding and payment, an escalation path, and a record-retention schedule. See restricted party screening. |
| 4. Testing and auditing | A comprehensive, independent and objective function; immediate and effective action on any confirmed negative result. | A periodic review of screening logs and escalations by someone outside the team that runs the process. |
| 5. Training | Provided to all appropriate employees periodically, and at a minimum annually; job-specific; communicates each employee’s responsibilities; holds employees accountable through assessments; tailored to the risk profile. | Role-based sessions for sponsored programs, procurement, accounts payable and international-affairs staff. |
Steps to build one
- Get approval and an owner. Have senior leadership review and approve the program and name who runs it.
- Run the risk assessment. List the counter-parties, services and countries your institution actually touches before writing any procedure.
- Write the controls. Cover identification, interdiction, escalation, reporting where appropriate, and recordkeeping, then communicate them to the staff who need them.
- Test independently. Check that the controls work in practice and act at once on a confirmed failure.
- Train, then update. Train at least annually and revise the assessment and controls after any violation or root-cause finding.
Typical phases
Programs usually move through the same order without fixed durations: approval and ownership, risk assessment, control design and rollout, first independent test, then a recurring cycle of training, testing and updates. OFAC describes the program as one to be routinely updated, so there is no end state.
Common mistakes: the ten root causes as a self-audit
The appendix to OFAC’s framework lists root causes seen in enforcement matters. Read as a self-audit list, they are:
- Lack of a formal OFAC SCP.
- Misinterpreting, or failing to understand the applicability of, OFAC’s regulations.
- Facilitating transactions by non-U.S. persons.
- Exporting or re-exporting U.S.-origin goods, technology or services to OFAC-sanctioned persons or countries.
- Utilizing the U.S. financial system for commercial transactions involving OFAC-sanctioned persons or countries.
- Sanctions screening software or filter faults.
- Improper due diligence on customers or clients, for example on ownership.
- De-centralized compliance functions and inconsistent application of an SCP.
- Utilizing non-standard payment or commercial practices.
- Individual liability.
Two of these deserve attention in a university setting. Item 7 includes ownership: under OFAC’s 50 Percent Rule, as described in OFAC FAQ 91, an entity owned directly or indirectly, individually or in the aggregate, 50 percent or more by blocked persons is itself blocked even if it is not on the SDN List, so a name-only match can miss it. Item 8, decentralized compliance, is a structural risk wherever departments or campuses handle their own purchasing and payments. The related Commerce rule is covered in the BIS affiliates rule.
Enforcement hooks in the primary text
Three primary-text points explain why institutions build programs. First, General Factor E of the Economic Sanctions Enforcement Guidelines considers the existence, nature and adequacy of a subject person’s risk-based OFAC compliance program at the time of the apparent violation. Second, OFAC’s framework says a program built on the five components may receive further mitigation under General Factor F (remedial response) when it leads to remedial steps, and that OFAC may weigh an effective program in deciding whether a case is egregious. Third, the Guidelines define a voluntary self-disclosure as a self-initiated notification to OFAC of an apparent violation, made before or at the same time OFAC or another government body discovers it; a disclosure prompted by an agency, or one that is false, misleading or materially incomplete, does not qualify.
Related programs and guidance
| Resource | What it is |
|---|---|
| OFAC, A Framework for OFAC Compliance Commitments | The source of the five components and the root-cause appendix |
| 31 CFR 501.601 | OFAC recordkeeping requirement (10 years) |
| 31 CFR Part 501, Appendix A | Economic Sanctions Enforcement Guidelines |
| Sanctions and embargoes in university research | CASRAI guide on sanctions exposure in research |
| Four pillars of export control compliance | CASRAI guide on the export-control side of the same office |
| Consolidated Screening List | CASRAI dictionary term: one search across several government lists, including OFAC lists |
FAQ
Is an OFAC compliance program required?
OFAC’s framework document states that OFAC regulations do not require a formal sanctions compliance program, but that OFAC strongly encourages organizations subject to U.S. jurisdiction to adopt a risk-based one, especially those in international trade or with clients and counter-parties outside the United States. Whether a particular institution is subject to a specific obligation depends on the sanctions program that applies, so check the regulations for that program.
Does having a program reduce penalties?
It can. In the Economic Sanctions Enforcement Guidelines (31 CFR Part 501, Appendix A), General Factor E has OFAC consider the existence, nature and adequacy of a subject person’s risk-based OFAC compliance program at the time of an apparent violation, where relevant. OFAC’s framework document adds that OFAC will consider favorably subject persons that had effective programs, and may mitigate a civil monetary penalty. Nothing in either text promises a particular outcome.
How often should staff be trained?
The framework document says training should be provided to all appropriate employees on a periodic basis, and at a minimum annually, tailored to the organization’s risk profile and to each person’s job-specific responsibilities.
How long must sanctions records be kept?
Under 31 CFR 501.601, records of transactions must be available for examination for at least 10 years after the date of the transaction. For blocked property the period runs while the property is blocked and for at least 10 years after it is unblocked. The section was amended at 89 FR 74834 (September 13, 2024).
Who owns the program at a university?
OFAC does not name a university role. Its framework asks for senior management approval, a compliance function with sufficient authority, autonomy and direct reporting lines to senior management, and adequate resources, including a dedicated sanctions compliance officer among the criteria it lists. How an institution maps those onto its sponsored programs, procurement and international offices is an internal design decision.
Sources
- OFAC, A Framework for OFAC Compliance Commitments, U.S. Department of the Treasury: https://ofac.treasury.gov/media/16331/download (checked 2026-10-29).
- 31 CFR 501.601, Records and recordkeeping requirements, eCFR: https://www.ecfr.gov/current/title-31/subtitle-B/chapter-V/part-501/subpart-C/section-501.601 (checked 2026-10-29).
- 31 CFR Part 501, Appendix A, Economic Sanctions Enforcement Guidelines, eCFR: https://www.ecfr.gov/current/title-31/subtitle-B/chapter-V/part-501/appendix-Appendix%20A%20to%20Part%20501 (checked 2026-10-29).
- OFAC Frequently Asked Questions, general questions: https://ofac.treasury.gov/faqs/topic/1501 (checked 2026-10-29).
