How to assess foreign financial institution exposure under OFAC

A multinational bank's correspondent relationships span dozens of jurisdictions. Its compliance team screens counterparty names routinely. Then a regulator's inquiry arrives: a foreign correspondent conducted a series of transactions involving a designated entity, and the bank processed the dollar legs. The question is no longer whether the foreign bank will face consequences under its own national regime. The question is whether your institution's relationship with it has already created OFAC exposure for you.

Foreign financial institution exposure under OFAC arises when a US person – or a transaction touching the US financial system – has a material nexus to a foreign bank, insurer, or card-network operator that has conducted or facilitated significant transactions for designated persons or specified restricted sectors. As of January 2026, US authority allows measures against such institutions that can include correspondent-account restrictions and, in serious cases, blocking. The analysis requires more than name screening. It requires a review of what the foreign institution does, who it serves, and whether those dealings fall within the scope of OFAC's authority.

This guide walks a representative compliance engagement from initial identification of a foreign financial institution relationship through to the point at which counsel should be involved. It covers the legal basis, the assessment methodology, the cross-border dimensions that most commonly widen exposure, and the risk flags that matter most in practice.

What creates foreign financial institution exposure in the first place?

OFAC's authority to act against foreign financial institutions rests on US statutory powers that allow measures where an institution has conducted or facilitated significant transactions for designated persons, or has operated in sectors subject to sectoral restrictions. The concept is extraterritorial by design. It does not require the foreign institution to have US operations, US staff, or a US charter. The jurisdictional hook is the US financial system – specifically, the clearing of US-dollar transactions, the maintenance of correspondent accounts at US banks, or the involvement of a US person anywhere in the transaction chain.

That extraterritorial logic is what makes the exposure hard to see from inside a compliance function that focuses on direct counterparty screening. The foreign institution may not appear on the SDN List (OFAC's list of Specially Designated Nationals and blocked persons) and may not itself be subject to a US designation. Its exposure – and therefore yours – arises from what it has done for others.

Three categories of conduct commonly trigger the risk. First, the foreign institution has processed transactions for a designated party, knowingly or otherwise. Second, it has provided services to an entity in a restricted sector, in sufficient volume or value that OFAC would characterise the dealings as "significant". Third, it has acted as an intermediary for transactions that, had a US person conducted them directly, would have been prohibited. That last category – the facilitation prohibition – is often the one that surprises in-house counsel. OFAC's position is that facilitating a transaction that a US person could not conduct directly is itself prohibited. When a foreign bank clears the dollar leg of such a transaction and the dollar clearing runs through your institution, you are inside the facilitation chain.

We regularly advise on exactly this pattern: a US-headquartered group's treasury function has routed payments through a foreign subsidiary's local correspondent, and the local correspondent's book of business turns out to include clients operating in sanctioned sectors. The starting question is always the same – how much did you know, and when did you know it? But the legal position does not wait for that answer.

Step one – mapping the foreign financial institution relationship

The first step in any structured assessment is mapping every relationship your institution or business maintains with a foreign financial institution, and categorising those relationships by the degree of US nexus they carry. This is not a screening exercise. It is a business-activity and payment-flow review.

Begin with the correspondent banking book, if you are a financial institution. Identify which foreign correspondents clear US dollars through your institution. Each of those relationships carries a direct US nexus: a dollar payment cleared by you for a foreign correspondent is, in substance, a US financial-system transaction. You are the US touchpoint in that chain.

For non-bank multinationals, the mapping exercise focuses on treasury, accounts payable, and trade-finance flows. Which foreign banks process your cross-border payments? Which insurers underwrite your cargo or credit risk? If those institutions are themselves exposed, the risk can travel up the transaction chain to you.

The definition of a foreign financial institution for these purposes can extend beyond deposit-taking banks. Insurers and card-network operators can fall within scope, as can broker-dealers, payment processors, and money-service businesses operating outside the US. In our experience, compliance functions that focus exclusively on their banking counterparties routinely undercount the population of institutions in scope.

At this stage, document every identified institution with four data points: jurisdiction of incorporation, the nature of the US nexus (dollar clearing, US correspondent account, US parent), the product or service provided, and the volume or value of transactions processed in the review period. That documentation becomes the backbone of your risk-tiering in step two.

Step two – risk-tiering: how significant is the nexus?

Once the population is mapped, each foreign financial institution is assessed against two intersecting axes: the strength of its US nexus, and the risk profile of its underlying business. Together, those axes produce a tier for each institution, and the tier determines the depth of due diligence required.

On the nexus axis, the clearest high-water mark is a foreign institution that maintains a correspondent account at a US bank and clears US-dollar transactions through it. That account is the conduit through which OFAC's most direct remedy – restriction or termination of the account – operates. An institution that clears dollars but does so through intermediary banks, without a direct US account, still carries US nexus but at a remove. An institution with no dollar exposure and no US-person involvement in its transactions sits at the low end of the axis – but it is not necessarily outside scope if it processes transactions in which a US person has a financial interest.

On the business-risk axis, the questions are operational: does the institution serve customers in designated jurisdictions? Does it provide services to entities in restricted sectors? Has it been the subject of regulatory inquiry, a deferred prosecution agreement, or any public enforcement action in any jurisdiction? Does its disclosed customer base include state-owned entities from jurisdictions with elevated OFAC risk?

High nexus combined with high business risk is the tier that demands immediate, detailed review. An institution in that tier cannot safely be retained as a correspondent or counterparty without a documented assessment of its compliance controls and a view on whether its past transactions have created exposure for your institution. Where that review cannot be completed, or where it discloses unacceptable risk, the appropriate response is de-risking (a financial institution exiting a relationship to avoid sanctions exposure) – a decision that carries its own regulatory and commercial considerations and should not be taken without advice.

Step three – the due-diligence review: what the assessment must cover

For any foreign financial institution in the high or medium tier, the assessment must go beyond name-list screening. A name screen confirms only that the institution itself is not designated. It tells you nothing about what the institution has been doing. That is the myth the opening of this guide is designed to correct: name screening alone is not a complete control where foreign financial institution exposure is in issue.

The review should cover at least four areas. First, the institution's own sanctions compliance programme: does it have a programme? Is it independently assessed? Does it cover OFAC obligations as well as its home-jurisdiction requirements? An institution with a strong home-jurisdiction programme but no OFAC overlay is not a safe counterparty for a US person or for a transaction that touches the US financial system.

Second, disclosed transaction history: can the institution provide a representation that it has not, within a defined lookback period, processed transactions for persons on the SDN List or for entities in restricted sectors? That representation does not substitute for independent verification, but its absence is itself a material flag.

Third, beneficial ownership and control: who controls the foreign institution? An institution owned 50 percent or more in the aggregate by one or more blocked persons is itself treated as blocked under the 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked), even if the institution is not separately listed. The ownership and control review must go to at least two layers, and in high-risk cases further.

Fourth, third-party intelligence: financial intelligence units, correspondent-bank due-diligence utilities, and news searches can surface enforcement actions, suspicious-activity report trends, or media coverage that does not appear in list screening. These sources are not infallible, but they form part of a defensible record.

Document each of these four areas in a structured assessment memorandum. If a matter later becomes the subject of OFAC inquiry, the memorandum is the evidence that your institution conducted a genuine review, not a perfunctory name check. Voluntary self-disclosure (a VSD – a proactive disclosure to OFAC of a potential violation before enforcement) is a recognised mitigating factor under OFAC's Enforcement Guidelines. A documented assessment supports the argument that any breach was non-egregious and that your institution acted in good faith.

How does this assessment differ from OFSI and EU requirements?

The OFAC foreign-financial-institution analysis has no precise analogue in the UK or EU regimes, but the cross-border picture matters because institutions subject to multiple regimes must satisfy all of them, and the stricter prohibition governs. Where two regimes both apply, you cannot net them out: you comply with the most demanding requirement.

Under the UK regime, the Office of Financial Sanctions Implementation (OFSI) administers financial sanctions under the Sanctions and Anti-Money Laundering Act and the relevant thematic regulations. OFSI does not operate a foreign-financial-institution-specific mechanism of the kind that US authority provides. But OFSI can impose monetary penalties on a strict-liability basis – meaning no proof of knowledge or intent is required for the violation itself. The maximum penalty is the greater of £1,000,000 or 50 percent of the value of the breach, as currently in force – and the UK regime is actively developing its enforcement posture. The ownership and control test under UK rules can reach a non-listed entity that a designated person controls, even without majority ownership. That is a broader test than OFAC's mechanical 50 percent threshold and can catch structures that an OFAC analysis would clear.

The EU position is similar in structure but different in enforcement architecture. EU asset-freeze prohibitions extend to making funds or economic resources available, directly or indirectly, to or for the benefit of listed persons. The EU control test also looks beyond ownership to actual control. An EU-incorporated financial institution that processes a payment for a correspondent which itself serves a designated person may be within scope of the EU asset-freeze, even without a direct contractual relationship with the designated party.

The EU has also developed an anti-circumvention instrument that can, in principle, be directed at operators in third countries where EU measures are being circumvented. Although the primary target of that instrument is not typically a financial institution, its existence signals that the EU is prepared to look through transaction chains in a manner analogous to OFAC's facilitation doctrine.

In practice, a financial institution with US-dollar clearing, EU operations, and UK-regulated entities must run a three-regime assessment. The OFAC foreign-financial-institution analysis sits at one end of that stack. The UK and EU assessments run in parallel, not in sequence. Compliance counsel working through this will often find that the EU's broader control test surfaces exposure that the OFAC ownership analysis does not, and vice versa. That divergence is not theoretical: it regularly produces different conclusions about whether the same correspondent relationship is permissible.

What are the primary risk flags in practice?

In our cross-border practice, certain patterns recur as the primary indicators that a foreign financial institution relationship requires urgent escalation rather than routine annual review.

The first is a sharp change in transaction volumes or flows through the relationship. A foreign correspondent that suddenly increases its US-dollar clearing activity – particularly to or from jurisdictions with elevated OFAC risk – is a diversion red flag. Trade-flow analysis is increasingly a standard component of correspondent-due-diligence programmes for exactly this reason.

The second is an AIS or shipping-data anomaly in the institution's client base. If the institution's disclosed customer portfolio includes entities with a heavy presence in maritime trade, and those entities' vessels show gaps in automatic identification system transmission, the maritime-sanctions exposure of the book translates directly into potential OFAC exposure for anyone who clears dollar transactions for the institution.

The third is a disclosed enforcement action in any jurisdiction. A foreign bank that has resolved a money-laundering or sanctions investigation with a non-US regulator is not automatically a prohibited counterparty. But the resolution itself is material information that changes the risk tier. We have acted for financial institutions that acquired correspondent relationships through mergers without inheriting the compliance history. The lesson is that due diligence on the relationship includes due diligence on the institution's regulatory record.

The fourth is a change in ultimate beneficial ownership. A foreign institution that is acquired by, or placed under the control of, a state entity from a jurisdiction subject to sectoral restrictions may move from a permissible counterparty to a restricted one without a direct change to the SDN List. The facilitation prohibition and the 50 percent rule can both be triggered without any new listing. Sanctions records must be kept for five years, and the point at which ownership changed is directly relevant to any later inquiry into when your institution should have known.

The fifth is a report or suspicion of AIS manipulation, cargo mislabelling, or ship-to-ship transfer activity in the institution's client base. A designation of an insurer serving vessels in that pool can cascade into loss of cover, which is itself a compliance trigger for anyone further up the transaction chain.

When should counsel be instructed?

The narrative arc of a foreign financial institution exposure matter typically has three decision points at which external counsel adds the most value. Understanding where those points fall is itself part of the assessment.

The first decision point is at the mapping stage, where the population of relationships is larger or more complex than the compliance function can assess with internal resource. Practitioners advising on OFAC matters regularly see institutions that have identified a problem population but lack the analytical capacity to tier it accurately. An accurate tier is not a guarantee of any outcome – but an inaccurate one, applied to a correspondent that later becomes the subject of OFAC action, produces a much harder enforcement conversation.

The second decision point is when the review of a specific institution reveals a potential prior violation. Blocked-property and rejected-transaction reports are due to OFAC within 10 business days of the blocking or rejection. If a review surfaces the possibility that a past transaction should have been blocked and was not, the reporting clock may already be running. Sanctions records must be kept for five years; a historic review of those records is feasible, but the decision on how to proceed – including whether to make a voluntary self-disclosure – requires legal advice. VSD is a recognised mitigating factor under OFAC's Enforcement Guidelines, and the distinction between an egregious and a non-egregious violation can be the difference between a cautionary letter and a significant civil penalty.

The third decision point is when the institution's home-jurisdiction regulator or a US authority makes an inquiry. At that stage, the matter has moved from internal compliance to external engagement. The record built during the assessment process – the mapping, the tiering, the due-diligence memoranda, the ownership reviews – becomes the evidential foundation for the response. Building that record retrospectively, after the inquiry arrives, is possible but materially harder. The position narrows with time.

For a financial institution that has completed the mapping and tiering exercise and has identified relationships that require structural remediation rather than enhanced monitoring, the question is not only what to do about those relationships going forward. It is also what the historical position looks like, and whether a proactive disclosure is warranted. That analysis requires legal advice and is not a compliance-function decision alone.

The position above covers the standard case. Your facts – the jurisdiction of your foreign correspondent, the nature of its business, the volume and direction of the transactions at issue, the US nexus in play – change the analysis materially. For a structured review of your institution's foreign financial institution exposure, contact Calder & Vance at info@caldervance.com.

Related practices

• Affiliate-level restrictions under the EAR – how entity-level BIS restrictions affect affiliated counterparties and dealings
• Insurers and card networks under the EAR – mapping the BIS export-control perimeter for non-bank financial institutions

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.