A mid-sized US technology exporter processes hundreds of transactions a month. One morning, the screening system flags a payment instruction. The counterparty name is close – but not identical – to an entry on the SDN List (OFAC's list of Specially Designated Nationals and blocked persons). The compliance officer is not sure. Does she block the funds immediately? Does she escalate? Does she have to report? And how long does she have before inaction itself becomes the violation?
Effective escalation and reporting under OFAC is a defined procedural sequence, not a judgement call made under pressure. The governing authority is the Office of Foreign Assets Control, acting under IEEPA and other enabling statutes. As of July 2026, OFAC's published guidance describes a five-year record-keeping obligation and a reporting window for blocked property that requires a prompt filing – verify the current exact deadline before relying on it. Getting the sequence right is the difference between a voluntary disclosure that mitigates exposure and an apparent violation that does not.
This guide sets out the escalation and reporting procedures step by step, compares the OFAC position with OFSI and EU obligations, identifies the risk flags that most often cause firms to stumble, and explains when to bring in sanctions counsel.
Step 1: What triggers the escalation sequence?
The escalation sequence begins the moment a potential match or a blocked transaction is identified – whether by an automated screening tool, a relationship manager, or a third-party alert. OFAC's rules do not permit a firm to sit on an apparent match while it thinks about next steps. The obligation to act attaches at identification, not at confirmation.
Three categories of event typically start the clock. First, a positive or near-positive hit on a screening check against the SDN List, the Sectoral Sanctions Identifications List, or any other OFAC list. Second, a transaction instruction that appears to involve a blocked jurisdiction, blocked goods, or a blocked party at any point in the payment chain – including as an originator, beneficiary, or intermediary. Third, discovery, during due diligence or a compliance review, that a counterparty may be owned 50 percent or more by a blocked person under the 50 percent rule (OFAC's rule treating entities owned 50 percent or more in the aggregate by blocked persons as themselves blocked).
In our experience, firms most often mis-set this trigger. They treat the screening alert as the start of an investigation rather than as the start of a time-sensitive procedure. Those are different things. The investigation determines what happened; the procedure determines what you must do while that investigation runs. Both must run in parallel from the moment of identification.
Have you documented exactly who receives a screening alert, within what timeframe, and what authority they hold to act on it? If that chain is not written down and tested, the escalation procedure does not exist in any meaningful sense.
Step 2: Blocking, rejecting, or holding – which action applies?
OFAC distinguishes between blocking a transaction and rejecting one, and the distinction carries separate reporting obligations. Firms that collapse the two categories into a single response create exactly the kind of apparent violation that a well-designed procedure should prevent.
A transaction is blocked when it involves property in which a blocked person has an interest – direct or indirect. The property must be frozen in a blocked account and may not be returned to the originator without an OFAC licence. The firm must report the blocking to OFAC. A transaction is rejected when the underlying activity is prohibited but the property is not blocked – for example, where a transaction is denied because it would constitute a service to a prohibited jurisdiction but no blocked property is involved. Rejected transactions are not held; they are returned. The reporting treatment differs accordingly.
There is a third category: hold pending investigation. This is the appropriate interim step when the match is unclear – when the name is similar but not confirmed, when ownership information is incomplete, or when the nature of the interest in the transaction is ambiguous. A hold is not a substitute for a prompt escalation decision; it is a bridge to one. Holds that extend indefinitely without a formal decision are themselves a compliance failure.
The position above covers the standard case. Your facts – the counterparty, the goods, the payment route, the correspondent bank chain – change the analysis. For a first assessment of where a specific transaction sits, contact Calder & Vance at info@caldervance.com.
Step 3: How do you escalate internally before reporting to OFAC?
Internal escalation is the governance layer between alert identification and regulatory reporting. It determines who makes the decision to block, reject, or clear a transaction, and it creates the record that will be central to any subsequent OFAC review.
A well-designed escalation procedure has three tiers. The first tier is the front-line compliance analyst or relationship manager who receives the alert. Their role is to gather the basic facts: the transaction details, the matching list entry, the nature of the potential interest, and any immediately available ownership or beneficial-ownership information. They do not make the blocking decision. They assemble the file.
The second tier is the sanctions specialist or the head of sanctions compliance, who reviews the assembled file and makes the preliminary determination: block, reject, hold, or clear with documentation. This determination is recorded in writing. If the determination is to block or reject, the file moves immediately to the third tier.
The third tier is senior legal or compliance leadership – General Counsel, Chief Compliance Officer, or equivalent – who approves the regulatory report and any decision to seek an OFAC licence. At this tier, the question also arises whether the matter requires a voluntary self-disclosure (VSD) (a proactive report to OFAC identifying an apparent violation before OFAC discovers it independently).
In our cross-border practice, we regularly advise firms that have only one or two of these tiers functioning. A business may have a good screening tool and a senior officer willing to sign off reports, but no documented middle tier. That gap means the decision-making process cannot be reconstructed after the fact – and OFAC will ask for it.
Step 4: What must be reported to OFAC, and when?
OFAC's reporting requirements apply to blocked property and to certain rejected transactions. Both carry distinct obligations, and the timing requirement is not the same for each. Verify the current exact deadlines against OFAC's published rules before relying on this guide, as the requirements are subject to revision.
For blocked property, the obligation is to file an initial report with OFAC promptly after blocking. OFAC's rules specify a short reporting window from the date of blocking; the window is measured in days, not weeks. A second, annual report is required for as long as the property remains blocked. Both reports must contain specified information about the nature of the property, the blocked party's interest, and the transaction details.
For rejected transactions, OFAC requires a report within a short period of the rejection. The report identifies the parties, the nature of the transaction, and the basis for rejection. It does not involve the holding of funds, because rejected transactions are not blocked.
Record-keeping is an independent obligation. Under OFAC's rules, records relating to blocked property and rejected transactions must be retained for five years from the date of the transaction. This covers the original screening result, the escalation file, the decision record, the report, and all correspondence with OFAC. The five-year clock runs from the transaction; it does not restart each time OFAC queries the matter.
If a transaction has already been flagged, or a filing has been refused, an early review can preserve options that narrow with time. Write to us at info@caldervance.com for a confidential assessment.
How does OFAC's approach compare with OFSI and EU obligations?
Every firm with a cross-border presence needs to understand that OFAC's escalation and reporting procedure is not universal. The UK's OFSI (His Majesty's Treasury's Office of Financial Sanctions Implementation) and the EU's sanctions regime impose different triggers, different reporting timelines, and different ownership-and-control tests. The stricter prohibition governs where multiple regimes apply to the same transaction – but stricter on one element does not mean identical on all elements.
Under OFSI, the statutory obligation is to report to HM Treasury as soon as practicable once a person knows or has reasonable cause to suspect that they are holding frozen assets belonging to or owned or controlled by a designated person. The OFSI test extends explicitly to control – a person may be caught not because a designated person owns the required share, but because a designated person controls the entity. This is a broader test than OFAC's mechanical ownership threshold, and it catches structures that the 50 percent rule alone would not reach.
Under EU Council regulations, the obligation to report arises where a person holds frozen funds or economic resources belonging to, owned, held, or controlled by a listed person. The EU ownership and control test (the UK and EU test for whether a non-listed entity is caught through a listed person) covers direct and indirect ownership at 50 percent, but also control through other means – voting rights, the power to appoint management, and contractual influence over strategic decisions. The reporting obligation runs to the relevant national competent authority, not to a single EU body.
Three practical divergences matter most. First, the OFAC 50 percent rule is mechanical; the OFSI and EU control tests require a qualitative assessment of influence. A holding of 40 percent combined with board appointment rights may be caught under OFSI and EU rules but not under OFAC. Second, the annual reporting requirement for blocked property is an OFAC feature; OFSI and EU rules do not have a precise equivalent, though national competent authorities may request updates. Third, the VSD route is a formalised, defined mechanism at OFAC with stated mitigation effects; OFSI's approach to self-reporting as a mitigant is governed by its enforcement guidance rather than a codified VSD programme.
We regularly advise multinationals on transactions where the OFAC, OFSI, and EU analyses must run in parallel. The firm that screens only against one regime and assumes the others are covered has a material gap in its procedure.
What are the most common risk flags in practice?
Procedural failures in OFAC escalation and reporting follow recognisable patterns. Identifying them before an alert arrives is the purpose of compliance testing; encountering them during a live matter is costly.
The first risk flag is the unresolved near-match. A screening hit that scores below the firm's auto-block threshold but above the clear threshold goes into a manual review queue. Manual review queues frequently lack defined turnaround timelines. Alerts age without a documented decision, and the obligation to act runs from identification, not from a comfortable resolution of doubt.
The second is incomplete ownership mapping. A direct-owner screen will not identify an entity that is 60 percent owned by a blocked person through two intermediate holding companies. The 50 percent rule aggregates across layers. If your screening programme does not map at least two ownership layers above a counterparty and across any shared beneficial owners, it is not testing the right question.
The third is the single-point-of-failure escalation chain. If the only person authorised to make a blocking decision is the Chief Compliance Officer, and that officer is unavailable, the firm has no escalation path. OFAC does not recognise "key person was on leave" as a procedural explanation.
The fourth is the assumption that rejection is self-executing. A firm that processes a payment rejection by simply returning funds and deleting the record has failed its reporting obligation. Rejection must be documented, reported, and retained.
The fifth – and in our experience the most consequential – is the failure to consider the VSD question early enough. A VSD filed before OFAC opens an investigation is treated differently from a disclosure made after the investigation begins. The question of whether to file a VSD should appear as a defined step in every escalation procedure; it should not arise only after outside counsel is engaged.
A common misconception: "OFAC only applies to US banks"
We regularly encounter the view that OFAC's escalation and reporting requirements apply only to US financial institutions. This misconception is consequential. OFAC's jurisdiction extends to any US person – including US citizens and permanent residents acting outside the United States – and to any person, entity, or transaction that touches the US financial system or US-origin goods or technology. A non-US company that settles a payment in US dollars through a US correspondent bank is within OFAC's reach for that transaction, regardless of where the company is incorporated or where its compliance team sits.
Practically, this means that a European trading company, a Singapore-based commodity broker, or a UAE logistics firm can each face an OFAC reporting obligation if the facts engage US-nexus factors. The escalation and reporting procedure described in this guide applies to them when those factors are present, not only to US-headquartered businesses.
Extraterritorial reach is the area where cross-regime mapping is most important. A non-US company that has OFAC exposure may also have OFSI and EU obligations arising from the same transaction. The procedural steps do not substitute for one another; they run in parallel, each to its own authority, each on its own timeline.
Related practices
- Sanctions compliance audit and testing – Australia – independent testing of escalation procedures and screening logic against the Australian autonomous sanctions regime.
- Escalation and reporting under OFAC: guide 3 – the next module in this series, covering voluntary self-disclosure mechanics and penalty mitigation.
- Escalation and reporting under OFAC: guide 4 – covering OFAC licence applications arising from a blocked-property position.