A regional bank in South-East Asia maintains a US dollar clearing account with a large American correspondent. Its compliance team flags a pattern of transactions that touch a sanctioned jurisdiction. The US correspondent has forty-eight hours to decide: pause the relationship, file a report, or terminate? That question – posed under the rules administered by the Office of Foreign Assets Control (OFAC, the US Treasury agency that administers and enforces most American economic sanctions programmes) – can end a correspondent-banking relationship that took years to build.
Correspondent-banking de-risking (a financial institution exiting or restricting a relationship to reduce sanctions exposure) under OFAC is governed primarily by IEEPA and the relevant OFAC programme regulations, administered by OFAC. As of January 2026, OFAC's enforcement posture rewards proactive compliance and documented exit decisions, but an undocumented or poorly managed termination can itself create liability if it masks a prior apparent violation. The key steps are: identify the trigger, assess the legal exposure, document the analysis, execute the wind-down procedure, and – where a prior breach is possible – evaluate a voluntary self-disclosure.
This guide walks each step in sequence, flags the mistakes we see most often in cross-border practice, and explains how the OFAC position compares with the approaches taken by OFSI in the United Kingdom and the EU authorities – differences that matter because most correspondent chains touch more than one regime.
Step 1 – Identify the trigger: what causes a correspondent bank to consider de-risking?
The trigger for a de-risking review almost always falls into one of three categories: a transaction-monitoring alert, an external signal such as an OFAC designation of a downstream counterparty, or an internal or external audit finding.
Transaction-monitoring alerts are the most common starting point. An unusual payment corridor, a spike in volume to a high-risk geography, or a hit against the SDN List (OFAC's list of Specially Designated Nationals and blocked persons) at the customer or beneficial-owner level each produces an alert that demands a response. The difficulty is calibration: over-broad alerting leads to de-risking decisions that are commercially damaging and legally unnecessary, while narrow alerting leaves genuine exposure undetected.
External signals – a new OFAC designation, a secondary-sanctions advisory, or a notice from a supervisory authority – are often more acute. A correspondent bank that learns its respondent has wired funds to a newly designated entity faces immediate questions about whether it has itself handled blocked property. Have you mapped which of your respondents have direct or indirect exposure to newly listed entities? The answer to that question defines the urgency of your review.
Internal audit findings are the trigger that carry the greatest legal weight. An audit that surfaces what may be an apparent violation puts the institution inside a disclosure window; the clock for evaluating voluntary self-disclosure (VSD, a self-report to OFAC before the agency opens an investigation) begins to run from the point of knowledge, not from the point of formal decision.
Step 2 – Assess the legal exposure: the OFAC framework for correspondent banks
A correspondent bank's OFAC exposure arises principally from the prohibition on dealing in blocked property and from the strict-liability character of most OFAC civil violations – meaning that intent is relevant only to penalty calculation, not to whether a violation occurred.
Under IEEPA and the relevant programme regulations, a US financial institution, or any institution that processes US-dollar transactions through the US financial system, is prohibited from facilitating transactions in which a blocked person has an interest. The risk for correspondents sits at several layers simultaneously: the direct respondent, the respondent's customers, and the beneficial owners of entities in the payment chain.
The 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked, whether or not they appear on the SDN List) is the analytic engine behind most correspondent-bank exposure assessments. An entity does not need to be listed to be blocked. Two blocked persons each holding less than fifty percent can aggregate to reach the threshold together. Screening tools that query only the SDN List and listed ownership miss this exposure entirely.
The position under OFAC also extends to non-US persons in certain circumstances. Secondary-sanctions risk – the risk that OFAC will designate or impose correspondent-banking restrictions on a non-US financial institution for providing material support to a sanctioned party – sits outside the strict-liability civil framework but can extinguish a correspondent relationship just as effectively. We regularly advise respondent banks in Asia, the Middle East, and Latin America on this secondary-sanctions dimension, which is distinct from the primary prohibition analysis but equally decision-critical.
The position above covers the legal baseline. Your facts – the respondent's location, the payment corridors in question, the nature of the underlying trade – change the risk calculus materially.
For a structured assessment of your exposure under the OFAC correspondent-banking rules, contact Calder & Vance at info@caldervance.com, or visit our correspondent-banking de-risking service page.
Step 3 – Document the analysis: the compliance record that will matter later
Documentation is not a back-office formality. Under OFAC's enforcement framework, the quality and contemporaneity of a financial institution's compliance record is one of the factors that determines whether a voluntary self-disclosure or a penalty-mitigation argument succeeds.
OFAC's published compliance commitments guidance – which sits below the threshold of a formal regulation but informs every enforcement decision – sets out five core elements of an adequate compliance programme: management commitment, risk assessment, internal controls, testing and auditing, and training. In our cross-border practice, the element that most consistently breaks down in correspondent-banking de-risking decisions is internal controls. Specifically: the controls that govern how a correspondent documents its analysis when it decides to restrict or exit a respondent, and the controls that capture what it knew and when.
A contemporaneous record should address four questions. First: what triggered the review? Second: what did the screening and ownership analysis establish? Third: what legal conclusion did the institution reach, and on what basis? Fourth: what action was taken, and when? Where the analysis involved a legal judgement call – for instance, whether a controlling relationship short of 50 percent ownership triggered blocking under the control arm of OFAC's guidance – that reasoning should be recorded explicitly.
Retention of these records is a live obligation. OFAC regulations require financial institutions to maintain records of transactions involving blocked or rejected property, and a general standard of several years applies across the major US sanctions programmes. Verify the precise retention period against the applicable programme regulations before setting your retention policy.
How does the OFAC approach compare with OFSI and EU rules on correspondent de-risking?
The OFAC ownership test is mechanical and threshold-based: 50 percent or more triggers blocked status regardless of control. The UK and EU position is materially different, and that difference shapes how a multi-jurisdictional bank handles the same correspondent relationship.
Under OFSI (the UK's Office of Financial Sanctions Implementation), the relevant test encompasses both ownership and ownership and control (the UK and EU test for whether a non-listed entity is caught through a listed person). A listed person who holds less than fifty percent but exercises effective control over an entity can render that entity subject to financial sanctions prohibitions. OFSI's published guidance makes explicit that the analysis requires a facts-and-circumstances assessment, not a mechanical threshold check. That introduces interpretive discretion – and corresponding legal uncertainty – that the OFAC framework largely excludes.
The EU position under the relevant Council regulations adopts a similar facts-and-circumstances approach to control, and EU General Court case law has further shaped the analysis. An entity that a listed person controls through contractual or operational means, even without majority ownership, may be treated as within the scope of the freeze. For a correspondent bank clearing both US-dollar and euro transactions, this means the same underlying relationship may need to be evaluated under two materially different legal tests at the same time.
Does your institution's de-risking policy address both tests? In our experience, policies drafted primarily around the OFAC threshold check frequently under-analyse the control question when the relationship is also regulated under OFSI or EU rules. Our guide on OFSI correspondent-banking de-risking sets out the UK position in detail.
The Swiss position, administered by SECO, presents a further variant. For correspondent banks with Swiss-franc clearing relationships, the guide on SECO de-risking considerations covers the additional obligations that arise under the Swiss ordinances.
The general principle across all three regimes is that where two or more sets of rules apply to the same relationship, the stricter prohibition governs. A correspondent bank that is permitted to maintain a relationship under OFAC but prohibited under the EU regulation must exit – and vice versa. Multi-regime analysis is not optional; it is the baseline for any correspondent decision.
Step 4 – Execute the wind-down: legal requirements and practical sequencing
A decision to exit a correspondent relationship triggers its own compliance obligations. These fall into three areas: notice obligations, property-handling requirements, and reporting.
On notice, no OFAC rule universally prescribes the form or timing of termination notice to the respondent. The relevant contractual terms and the applicable banking regulations in the respondent's home jurisdiction govern the process. However, where a decision to exit is driven by a specific OFAC programme obligation – for instance, a correspondent-bank prohibition under a sanctions programme that imposes secondary consequences – the instrument governing the relevant programme may restrict the disclosures that can be made to the respondent. Legal advice before any communication to the respondent is essential.
On property handling, any blocked property identified during the wind-down must be handled in accordance with OFAC's blocking and reporting requirements. That means the property is frozen – not returned, not transferred, not offset – and a report is filed with OFAC within a short statutory window. The precise window is prescribed by the relevant programme regulations; verify the current position for the programme in question before relying on any general statement of the deadline.
On reporting more broadly, US financial institutions are subject to separate reporting obligations under the Bank Secrecy Act where the facts of a correspondent relationship indicate suspicious activity. The decision whether a de-risking exit also requires a suspicious-activity report is a distinct analysis, conducted by the compliance and legal teams together, and it does not displace or substitute for the OFAC blocking report.
Sequencing matters. In a recent matter, a financial-services business handling a multi-currency clearing arrangement identified that its correspondent wind-down had generated a blocking obligation mid-process. The property was frozen and the OFAC report was filed within the required window. We assisted the business in coordinating the blocking report, the contractual termination notice, and the internal documentation simultaneously – avoiding the common mistake of treating the three as sequential rather than parallel tasks.
Step 5 – Evaluate voluntary self-disclosure: when a prior breach is possible
Where the de-risking analysis reveals that transactions may have been processed through the correspondent account in apparent violation of OFAC programme regulations, the institution faces a distinct decision: whether to make a VSD (voluntary self-disclosure to OFAC before the agency opens an investigation).
OFAC's penalty framework treats a timely VSD as a significant mitigating factor. The practical effect – based on OFAC's published penalty matrix and enforcement history – is that a well-documented VSD can substantially reduce the civil monetary penalty from the base amount that would otherwise apply. OFAC has also, in a number of enforcement resolutions, credited a VSD as among the reasons a matter was resolved without a Finding of Violation. These outcomes are not guaranteed; they depend on the completeness and accuracy of the disclosure, the nature and volume of the apparent violations, and the quality of the institution's remediation plan.
The decision whether to disclose is not a compliance decision alone. It has legal, regulatory, and reputational dimensions. It also interacts with the institution's obligations in other jurisdictions: a decision to self-disclose to OFAC should be evaluated alongside the institution's reporting obligations to OFSI and the relevant EU national competent authority if the same conduct potentially breached UK and EU financial-sanctions rules. In our cross-border practice, we have advised institutions on coordinated multi-regime disclosures where the same underlying payment stream generated apparent violations across OFAC, OFSI, and at least one EU-programme jurisdiction simultaneously.
If a transaction has already been flagged, or a prior compliance failure has surfaced during a de-risking review, early legal review preserves options that narrow with time. Contact Calder & Vance at info@caldervance.com to discuss how a VSD analysis fits within a broader remediation strategy.
Common mistakes and risk flags in OFAC correspondent-banking de-risking
The most common mistake is treating de-risking as a risk-avoidance decision rather than a legal compliance decision. Those two framings produce different processes, different documentation standards, and different outcomes.
A bank that exits a relationship purely to manage commercial or reputational risk will often move faster than one that treats the exit as a legal matter – and faster does not mean better when undocumented speed creates a gap in the compliance record. Conversely, a bank that delays exit pending a complete internal investigation while continuing to process transactions may be extending the period of an apparent violation. The sequencing of the review, the decision, and the wind-down must be managed as a legal question from the outset.
A common myth worth addressing directly: that terminating a correspondent relationship once a problem is identified automatically protects the correspondent from OFAC liability for prior transactions. It does not. OFAC's enforcement jurisdiction over past apparent violations is not extinguished by a subsequent exit. The determination of whether prior transactions constituted apparent violations, and how to address them, is a separate analysis that runs in parallel to the wind-down.
Other risk flags we see frequently in practice:
- Screening that covers only the respondent entity itself, not the respondent's significant beneficial owners or the respondent's downstream customer base where visible;
- De-risking decisions taken by the business line without legal or compliance sign-off, leaving no contemporaneous record of the reasoning;
- Failure to assess whether a restriction (rather than a full exit) is sufficient under OFAC's rules – relevant where the exposure is narrow and the relationship has significant value;
- Ignoring the secondary-sanctions dimension when the respondent bank is a non-US institution operating in a high-risk corridor, even where no direct SDN-list hit is present;
- Treating the OFAC analysis as the entire compliance exercise when the relationship is also regulated under OFSI or EU rules – creating a gap in the multi-regime analysis.
Related practices
- Correspondent-banking de-risking (OFAC) – service page – full-scope advisory on identification, documentation, and remediation under OFAC rules.
- Correspondent-banking de-risking under OFSI – UK financial-sanctions obligations and OFSI's ownership-and-control test compared.