A payment operations team at a global bank runs a wire transfer through its sanctions-screening system. The filter returns a partial match on the beneficiary name. The compliance officer must decide: block, reject, or release? The answer depends on OFAC rules that many payment firms understand imperfectly – and the cost of getting it wrong can be severe.
Payment-processing controls under OFAC require every US person, and every institution processing US-dollar transactions, to screen parties and transaction data against OFAC's SDN List (the list of Specially Designated Nationals and blocked persons) and applicable country programmes, block any property in which a blocked person has an interest, and report blocked or rejected transactions to OFAC within defined statutory windows. The obligation is strict-liability: intent is not a defence to the underlying prohibition, though it is relevant to penalty calculations.
This guide walks through the procedural requirements step by step, identifies the risk flags that most frequently trip up payment teams, and explains how OFAC's approach compares to the frameworks applied by OFSI and the EU – a comparison that matters whenever a payment crosses a multi-currency or multi-jurisdictional path.
Step 1: Understand who is obligated – and why the answer is broader than most assume
OFAC's payment-processing obligations attach to all US persons and to all transactions that clear in US dollars through a US correspondent bank, regardless of where the originating or receiving institution is located. This is the extraterritorial reach that catches non-US banks most by surprise.
A payment firm incorporated in Singapore, processing a euro-denominated transfer, may have no OFAC obligation on that transaction. The same firm processing a dollar-denominated transfer that clears through a US correspondent bank is within OFAC's reach. The currency is what triggers US jurisdiction in the payment chain – not the nationality of the parties.
In our cross-border practice, we regularly advise payment institutions that believed their non-US incorporation placed them outside OFAC's scope. It does not, whenever dollar clearing is involved. The first procedural step is therefore mapping which of your payment flows touch US correspondent relationships, and treating those flows as subject to OFAC in exactly the same way as flows originated by a US entity. Have you identified every point in your payment infrastructure where a dollar conversion or clearing step occurs?
UK and EU institutions face an additional layer. OFSI's obligations apply to UK persons and UK-nexus transactions independently of any OFAC trigger. The EU Council regulations apply to EU-nexus parties. A payment between two European counterparties denominated in euros may be outside OFAC's reach yet squarely within both OFSI and EU sanctions. The threshold question at Step 1 is: which regimes apply, and to which legs of the transaction?
Step 2: Screen accurately – parties, payment fields, and the ownership chain
Accurate OFAC screening requires checking every party to the payment – originator, beneficiary, intermediary, and any referenced third party – against the SDN List and all applicable country-based programme lists, using tools calibrated to catch name variations, transliterations, and partial matches.
Most payment systems screen the obvious fields: originator name and beneficiary name. OFAC's expectations go further. The reference field, the correspondent bank field, and any intermediary instruction field can carry information that brings a transaction within scope. A payment referencing a blocked vessel's name, for example, can be caught even where both the originating and receiving parties are clean.
The 50 percent rule (OFAC's rule treating entities owned 50 percent or more in the aggregate by blocked persons as themselves blocked) applies to beneficial ownership behind a payment instruction just as it applies to trade counterparties. A beneficiary company that is not on the SDN List but is majority-owned by an SDN is itself blocked under OFAC. A screening tool that checks only listed names will not catch this. Beneficial-ownership information, where available, must feed into the screening logic.
We regularly advise payment firms on the design of their screening architecture. The practical finding is consistent: first-generation systems screen names; second-generation systems screen names and aliases; third-generation systems screen names, aliases, and ownership. Most enforcement-adjacent matters we review involve firms stuck at the first or second level.
Fuzzy-match thresholds present a related problem. Set too low, the system generates unmanageable alert volumes; compliance analysts begin ignoring alerts on a statistical basis. Set too high, genuine matches pass through. Calibration is not a one-time exercise. Programmes must be tested against known-positive datasets on a regular cycle, and the testing methodology must be documented.
Step 3: Triage the alert – block, reject, or release?
When a screening alert fires, OFAC's rules require one of three dispositions: block the transaction and hold the funds in a segregated, interest-bearing account; reject the transaction and return the funds; or release the transaction because the alert is a false positive or the transaction is covered by a licence.
The distinction between blocking and rejecting matters operationally. A transaction involving property in which a blocked person has an interest must be blocked – the funds are held, not returned. A transaction that OFAC prohibits but where there is no blocked property interest – a transfer to a sanctioned country that involves no blocked person's property, for example – is rejected and the funds returned to the originator.
False-positive management is where procedural discipline is most tested. A decision to release a payment after a screening alert must be documented: what was reviewed, what information was relied on, who authorised the release, and when. In our experience, institutions that lack a formal false-positive decision record are poorly positioned to defend a release in an enforcement context. The decision log is the compliance record. Its absence is a control failure, regardless of whether the underlying release was correct.
One operational question that frequently arises: what happens when the originating bank has already released the payment but the correspondent bank identifies an OFAC match mid-chain? The correspondent is obligated to block at the point it processes the funds. It cannot rely on the originating bank's release. Each institution in the chain applies its own OFAC controls independently.
Step 4: Report to OFAC within the required window
Both blocked and rejected transactions carry reporting obligations. Blocked transactions must be reported to OFAC within 10 business days of the blocking, and then again annually for as long as the funds remain blocked. Rejected transactions must also be reported, within a defined short statutory window.
Annual reports on blocked property cover the total value of assets held, the category of property, and the sanctions programme under which the blocking occurred. These reports allow OFAC to monitor the aggregate effect of its programmes and are treated as mandatory compliance events, not optional disclosures.
Late reporting does not itself create criminal liability but does constitute a regulatory violation that can be cited in an enforcement context. Where an institution discovers that a blocking occurred but was not reported within the statutory window, the standard practitioner guidance is to make a late report promptly and to consider whether a voluntary self-disclosure (VSD – a proactive disclosure of a potential violation to OFAC) is appropriate. A VSD, where the violation meets the materiality threshold, can significantly affect the penalty calculation. Verify the current reporting windows before relying on any internal procedure documents, as OFAC updates its guidance periodically.
OFSI's reporting obligation in the UK differs in structure. Where a firm knows or suspects that it holds frozen funds, it must report that to OFSI. The trigger is knowledge or suspicion, not the mechanical act of blocking. The two regimes' reporting architectures are distinct, and a firm operating in both jurisdictions needs parallel procedures, not a single template applied to both.
How does OFAC's approach differ from OFSI and the EU?
OFAC, OFSI, and the EU share the core prohibition – blocking or freezing assets of designated persons and entities – but diverge on ownership and control tests, licensing architecture, and enforcement posture in ways that directly affect payment-processing decisions.
On ownership, OFAC's 50 percent rule is mechanical. If blocked persons own 50 percent or more in aggregate, the entity is blocked regardless of whether they exercise control. OFSI and the EU use an ownership and control test (the test for whether a non-listed entity is caught through a listed person's ownership or direction). Under OFSI's and the EU's approach, a listed person need not reach the 50 percent threshold if they exercise effective control through other means – board appointments, veto rights, or contractual arrangements. The practical implication: a payment that is clear under OFAC's mechanical ownership test may still be prohibited under OFSI or EU rules if a listed person exercises control below the ownership threshold.
On licensing, OFAC operates both general licences (standing authorisations for defined categories of transaction) and specific licences (case-by-case authorisations). OFSI's licensing regime in the UK is structured around specific licences by default; general licences exist but are fewer and narrower. EU licensing is Member State-administered under the relevant Council Regulation, which creates national variation across the bloc. A payment firm that has obtained an OFAC specific licence for a category of transactions cannot assume that licence covers the equivalent transaction under OFSI or EU rules.
On enforcement posture, OFAC's civil penalty base and its use of egregious-case multipliers mean that a voluntary self-disclosure for a significant violation can be the difference between a base-amount penalty and a substantially higher figure. OFSI's enforcement guidance similarly recognises voluntary disclosure as a mitigating factor. The EU operates through Member States, so enforcement intensity varies by national competent authority. For a payment firm with a correspondent network spanning all three regimes, the cross-regime comparison is not academic – it determines the priority order for remediation and disclosure strategy.
The position above covers the standard multi-regime comparison. Your specific facts – the currency, the correspondent chain, the counterparty structure, the goods or services being paid for – can shift the analysis materially. For an initial review of your payment controls across regimes, contact Calder & Vance at info@caldervance.com.
Step 5: Record and retain
OFAC requires that records relating to blocked and rejected transactions be retained for five years from the date of the transaction or from the date of the blocking – whichever is longer for blocked property. This is a firm regulatory requirement, not a best-practice recommendation.
The records that must be kept include the original payment instruction, all screening alerts and the disposition records for each, the basis for any false-positive release, and all correspondence with OFAC relating to the transaction. For blocked funds, the interest-bearing account records are part of the retention requirement.
Where a firm is using automated transaction-monitoring systems, the system logs themselves must be retained in a form that is retrievable and auditable. It is insufficient to retain summary reports if the underlying alert data has been purged. OFAC's examination practice in enforcement investigations typically includes requests for system logs going back multiple years. If the logs are gone, the firm cannot demonstrate that its controls were operating correctly during the period under review.
Document retention is also where firms experience a particular governance problem on change-of-system. When a payment platform migrates to a new screening infrastructure, the legacy records from the old system must be preserved and accessible. We have acted for firms in enforcement reviews where the records gap resulted directly from a platform migration that did not include a data-preservation obligation in the vendor contract. This is an avoidable control failure.
Common risk flags and when to involve counsel
The risk flags that most frequently appear in OFAC payment-processing enforcement matters fall into four categories: name-screening gaps, ownership-chain failures, procedural lapses in alert-handling, and record-keeping deficiencies.
Name-screening gaps arise when a firm's list-management process lags behind OFAC's SDN List updates. OFAC adds, modifies, and removes designations frequently. A firm that refreshes its internal blocked-party list weekly rather than in near-real-time can process a transaction involving a newly designated party before its screening tool has caught up.
Ownership-chain failures occur when beneficial-ownership information is not integrated into the screening workflow. As noted above, the 50 percent rule operates through the ownership chain, not only on the face of the payment instruction. A payment firm that cannot access or query beneficial-ownership information has a structural gap in its controls.
Procedural lapses include the failure to document false-positive release decisions, the failure to segregate blocked funds into a separate interest-bearing account, and the failure to make timely reports to OFAC. Any of these can convert a substantively defensible decision into a procedural violation.
Record-keeping deficiencies – including the failure to retain screening logs for the required period, and the failure to preserve legacy records on platform migration – expose a firm to evidentiary problems in an investigation context, independent of whether the underlying transactions were compliant.
The question of when to involve counsel is often asked too late. In our practice, the matters that are most difficult to manage are those where the firm has already made a series of internal decisions – a release, a failure to report, a record purge – before seeking external advice. If a payment alert has produced a hold, a counterparty dispute, or any internal escalation, the time to involve sanctions counsel is before the next decision is made, not after it.
If a transaction has already been flagged or an internal review is under way, an early review can preserve options that narrow with time. For a confidential assessment, contact Calder & Vance at info@caldervance.com.
The compliance programme behind the controls
Individual payment controls operate within a broader sanctions-compliance programme. OFAC's published framework for effective compliance identifies five essential elements: management commitment, risk assessment, internal controls, testing and audit, and training. Payment-processing controls are the operational expression of the internal-controls element, but they do not function reliably without the other four.
Management commitment means that the compliance programme has visible senior-level endorsement, dedicated resources, and the authority to block or delay a payment regardless of commercial pressure. A payment-compliance function that can be overridden by business-line pressure is not an effective control. The question is whether your organisation's governance structure actually allows the compliance team to block a transaction – or whether commercial incentives consistently prevail at escalation.
Risk assessment for payment-processing identifies the highest-risk corridors, currencies, and counterparty profiles in the payment flow. A firm with significant exposure to payments involving certain geographic corridors or high-risk sectors should weight its controls toward those flows. A generic, uniform-intensity screening approach is less effective than a risk-differentiated one.
Testing and audit of payment controls should include live transaction testing – running transactions through the screening system and validating that known-positive matches are caught. Firms that test only the screening tool's configuration without testing actual transaction throughput can carry a false confidence in control effectiveness. We regularly advise on and conduct compliance-audit exercises for payment firms – an independent perspective on a control framework is a material input to a defensible compliance posture.
For firms operating in multiple jurisdictions – or considering expanding their payment corridors into new markets – an early compliance-audit exercise is worth considering before scale creates inherited risk. See our related guidance on compliance audit and testing for further detail on how a structured review works in practice.
Related practices
- Payment-processing controls under OFSI – a practitioner guide to the UK equivalent of these obligations, including OFSI's licensing and reporting framework
- OFSI payment controls: advanced issues – deeper analysis of OFSI enforcement posture, the ownership-and-control test, and cross-border divergence points
- Compliance audit and testing – independent testing of sanctions controls, including payment-screening architecture, alert-handling procedures, and record-keeping obligations