Goods-origin verification under OFAC: a compliance guide

A US-connected exporter ships what its team classifies as a standard commercial component. Customs documentation lists the item as EAR99. An OFAC review later establishes that the goods originated – or transited – in a way that triggers liability. The penalty exposure arrives without warning, and without any intent to violate the law. That is the defining feature of OFAC's strict-liability civil standard: origin matters regardless of what the paperwork says.

Goods-origin verification under OFAC means confirming, before a shipment moves, that the item's country of origin, transit route, and supply chain do not connect it to a prohibited territory, a blocked person, or a controlled end use. The obligation derives from OFAC's authority under IEEPA and the relevant programme regulations. Because OFAC's civil-penalty standard requires no knowledge or intent, an origin error in the documentation is enough to constitute a violation.

This guide walks through goods-origin verification under OFAC step by step, identifies where the analysis diverges from UK and EU rules, and flags the situations that require counsel before a shipment clears.

What does goods-origin verification actually require under OFAC?

Goods-origin verification under OFAC requires a business to establish, through documentary and systemic checks, that neither the item, its components, nor the parties handling it connect the transaction to a prohibited programme or a blocked person. OFAC administers both list-based programmes – which operate through the SDN List (OFAC's list of Specially Designated Nationals and blocked persons) – and comprehensive or territorial programmes that prohibit dealings with goods of a particular origin regardless of who the counterparty is. Both dimensions must be checked.

For comprehensive programmes, the country of origin of the goods is itself the trigger. An item manufactured in, or substantially transformed in, a prohibited territory may be prohibited in a US person's supply chain even if every named counterparty in the transaction clears a screening check. That is a point many compliance teams miss: list screening alone does not discharge the origin obligation.

For list-based programmes, the relevant question is whether the goods have been, or are being, procured for or on behalf of a blocked person. Facilitation – a US person helping a non-US party do what would be prohibited if done directly – is itself prohibited under OFAC's rules. A goods transaction routed through an intermediary can engage facilitation liability even if the US person never touches the final destination.

As of January 2026, OFAC's published guidance makes clear that "we screened the name" is not a complete control. A well-tested origin-verification procedure addresses country of origin, substantial transformation, transit and transshipment routes, and beneficial ownership of the supply-chain parties.

How do you verify country of origin for OFAC purposes?

The country-of-origin determination begins with the item's production history, not its shipping documentation. Customs documentation records where an item was last substantially transformed; OFAC compliance requires tracing that transformation back to the source of the controlled inputs or the controlled territory, not just the country of last export.

In practice, the verification process runs in three linked checks.

Documentary review. Collect the certificate of origin, commercial invoice, bill of lading, and any available supplier declarations. Look for inconsistencies: a certificate of origin issued in one country while the bill of lading reflects loading in another is a red flag that warrants follow-up, not a filing decision.

Supply-chain mapping. For items with multiple components or inputs, map the origin of each significant input. Components sourced from a territory subject to a comprehensive OFAC programme can carry the programme's restrictions into a finished product, even if the finished product is assembled elsewhere. Whether the relevant rules follow the component depends on the programme; this is an area where counsel adds real value.

Screening of supply-chain parties. Every freight forwarder, intermediary, transshipment port agent, and logistics provider should be screened against the SDN List and relevant programme criteria. A sharp change in trade flows through a transit jurisdiction – particularly one that has historically handled goods now subject to tighter controls – is a recognised diversion red flag and should trigger enhanced due diligence rather than a routine pass.

In our practice, the documentary review step is the one firms most often compress under time pressure. A shipment that clears on time but carries an undetected origin defect creates far greater exposure than a delayed shipment with a clean file.

How does OFAC's approach to goods-origin differ from the UK and EU positions?

OFAC, OFSI, and the EU Council each impose goods-origin obligations, but the legal architecture differs in ways that matter operationally for a business trading across these regimes. Where two regimes both apply, the stricter prohibition governs conduct; a business cannot net out the obligations.

Under OFAC, the key question for comprehensive programmes is whether goods are of a prohibited country's origin. The test is territorial and focuses on substantial transformation. Liability is strict: OFAC does not require that the exporter knew the origin was problematic.

Under OFSI and the UK regime, the primary prohibition bites on making funds or economic resources available to a designated person. Goods transactions become relevant where the counterparty or beneficial owner is designated. The UK's ownership and control test (the UK and EU test for whether a non-listed entity is caught through a listed person) is broader than OFAC's 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked), because the UK test also captures control relationships that fall below the ownership threshold. For a business with both US and UK exposure, a counterparty that clears the OFAC ownership screen may still be caught under the UK control test.

The EU Council regime similarly extends to entities controlled by listed persons, with the EU control test looking at both a more-than-50 percent ownership criterion and actual control. The EU dual-use rules under the recast Regulation (EU) 2021/821 add a separate layer for controlled goods, with export authorisation requirements that operate independently of the asset-freeze prohibitions.

For a business exporting from the UK or EU into a market where OFAC also applies, the starting question is not "which regime applies?" but "which obligations are triggered?" The answer is often both – and a failure under either creates independent enforcement risk.

What are the most significant risk flags in a goods-origin verification?

Experienced compliance counsel identify five patterns that, when present, should halt a shipment pending a fuller review rather than proceed on a best-guess classification.

Transshipment through a high-risk transit point. Goods that travel through a jurisdiction which has recently seen a documented increase in re-exports to a sanctioned territory are a priority flag. Transit through a third country does not change an item's controlled status; origin and end-use analysis follows the item, not the route. A bill of lading that does not reflect the full transit chain is itself a red flag.

Inconsistent or absent certificates of origin. Where a certificate of origin is missing, altered, or inconsistent with other shipping documents, the verification process must stop. Proceeding without a clean documentary basis is not a business decision; it is a compliance exposure.

Last-minute changes to logistics providers or routes. A sudden substitution of the freight forwarder, a rerouting through an unexpected port, or a request to break a single shipment into multiple smaller consignments are classic evasion indicators – and their presence in a supply chain puts a US person on notice of a potential facilitation risk.

Counterparty opacity. Where the ultimate buyer, end-user, or consignee cannot be clearly identified, or where the intermediary declines to name the end-user, the transaction cannot be cleared on standard screening. The 50 percent rule requires that the beneficial ownership chain be traced; if that chain is opaque, the verification is incomplete.

Classification mismatches. Items classified as EAR99 or as non-controlled goods that are functionally capable of controlled applications warrant a second-opinion classification review, particularly for electronics, advanced components, and dual-use goods. We regularly advise businesses that a prior EAR99 classification was incorrect, and that the item required a licence or was subject to specific OFAC programme restrictions.

Is a commercial item automatically outside OFAC's reach?

No. The assumption that commercial or off-the-shelf goods cannot be controlled is one of the most persistent compliance myths we encounter, and it is wrong in two distinct ways.

First, OFAC's comprehensive programmes do not distinguish between controlled and non-controlled goods. If goods originate in or are destined for a prohibited territory, the prohibition applies regardless of the item's commercial character. A commercially available product manufactured in a prohibited territory is as restricted as a dual-use item: the goods' origin, not their technical specification, is the operative fact under a comprehensive programme.

Second, for list-based programmes, a commercial transaction for a blocked person is prohibited even if the goods themselves are entirely unrestricted. OFAC's asset-freeze and dealings prohibitions are not limited to controlled technology or strategic goods; they extend to any transaction in which a blocked person has an interest. The facilitation prohibition extends this further: a US person who assists a non-US intermediary in procuring commercial goods for a blocked end-user is within scope, regardless of the item's ECCN classification.

The myth persists partly because export-control classification – which does sort items by their technical capabilities – is sometimes confused with OFAC origin and party screening, which operates differently. In our cross-border practice, the two analyses are kept strictly separate: export-control classification answers "can this item be exported?"; OFAC screening and origin verification answers "to whom and from where?" Both questions must be answered before a shipment clears.

What does that mean operationally? It means that even a business dealing only in standard commercial goods – packaging materials, office supplies, bulk agricultural commodities – should maintain an origin and party screening programme. The item's commercial character is not a substitute for compliance.

When should a business involve sanctions counsel for a goods-origin question?

Some origin questions resolve cleanly through a well-designed internal procedure. Others require an independent legal assessment before the shipment can clear. The dividing line sits at the point where standard documentary review does not produce a clear answer.

Counsel should be engaged before the shipment clears in any of the following situations.

The supply chain includes a transshipment jurisdiction that has recently become associated with diversion activity, or where the logistics chain cannot be fully mapped on available documentation. A business that proceeds without tracing the full chain cannot credibly claim it conducted a reasonable origin verification.

The item's classification is uncertain, particularly where a prior EAR99 classification was assigned without a formal review, and the item is now entering a supply chain that routes near a sanctioned territory or an at-risk end-user. Items subject to the EAR but not on the Commerce Control List – designated EAR99 – are not automatically clear of OFAC programme restrictions; the two analyses are separate.

A counterparty or its known principals have previously appeared on a list or been the subject of an enforcement inquiry, even if a current screen returns a clear result. List removals and prior enforcement histories both carry ongoing compliance implications that a name-screen alone does not capture.

A voluntary self-disclosure (VSD) – disclosure to OFAC of a potential violation – is under consideration. A VSD is a recognised mitigating factor under OFAC's Enforcement Guidelines, but its scope and timing materially affect how it is received. Preparing a VSD without counsel is one of the situations in which businesses most commonly reduce the benefit they would otherwise receive.

Records of origin verification – certificates of origin, due-diligence files, screening records, and the analysis supporting a classification – must be retained for five years under OFAC's record-keeping requirement. Counsel engagement at the transaction stage ensures the documentation is preserved in the form that will matter if an inquiry arises later.

We have acted for businesses across the trade and manufacturing sectors in responding to OFAC queries about origin verification. An early review of the transaction file – before a response to a regulator is filed – consistently produces better outcomes than a review conducted under a deadline.

How should a goods-origin compliance procedure be structured?

A goods-origin compliance procedure for OFAC purposes operates across four phases, each with a defined output that feeds the next.

Phase 1 – Classification and origin triage. Before any counterparty or licence check, establish what the item is and where it came from. Confirm the ECCN or EAR99 designation with a documented rationale, not a legacy assumption. Map the significant inputs and confirm the country or countries in which substantial transformation occurred. Output: a classification memo and an origin determination, both dated and retained.

Phase 2 – Programme and list screening. Screen the item's origin against OFAC's active comprehensive programmes. Then screen every named party – buyer, intermediary, freight forwarder, end-user, beneficial owners at 50 percent or more – against the SDN List and other applicable lists. Apply the ownership aggregation test: two blocked persons each holding below the threshold may reach it in combination. Output: a screening record showing each party checked, the date, and the result.

Phase 3 – Route and logistics review. Review the full transit chain. Identify any transshipment point associated with diversion risk. Confirm that the bill of lading and the actual routing are consistent. Flag any last-minute changes for senior compliance review before the shipment moves. Output: a logistics review note, with any red flags escalated and resolved in writing.

Phase 4 – Licence and authorisation check. Where the item, its origin, or its destination triggers a licence requirement under OFAC's relevant programme or under BIS's EAR, confirm whether a general licence (a standing authorisation that permits a defined category of transactions without a separate application) covers the transaction, or whether a specific licence (a case-by-case authorisation to conduct an otherwise prohibited transaction) is required. Do not assume an exception or exemption applies without checking its current terms and conditions. Output: a licence determination, with any general-licence reliance documented and any specific-licence application filed before the shipment clears.

All four phase outputs form the transaction's compliance file. They are not internal notes; they are the evidence base if OFAC later enquires. A blocked-property or rejected-transaction report, where required, must reach OFAC within 10 business days; the transaction file determines how well that report can be prepared.

The goods-origin verification procedure is not a one-time exercise. Regime changes, new listings, and updated OFAC guidance can alter the analysis for an ongoing supply relationship. We advise businesses to schedule a periodic review of their origin assumptions – at a minimum when a major programme change occurs, and at least annually for high-risk supply chains.

Related practices

• Advanced computing controls – BIS/EAR advisory – classification, licence requirements, and Entity List diligence for advanced-computing goods
• Advanced computing controls – EU regime explained – how the EU dual-use rules apply to advanced computing exports and re-exports
• Cloud and remote-access controls under OFAC – OFAC's treatment of technology access and deemed-export equivalents in digital services

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.