How to manage secondary sanctions exposure under OFAC

A foreign bank clears a routine trade-finance payment through its US correspondent account. The underlying transaction involves a counterparty that does not appear on any sanctions list – but that counterparty maintains a significant banking relationship with a designated entity. Weeks later, the correspondent bank receives an OFAC inquiry. The question is no longer whether the payment was blocked. The question is whether the foreign bank's conduct triggers secondary sanctions exposure. That distinction is the one that derails compliance programmes built on name-screening alone.

Secondary sanctions exposure under OFAC arises when a non-US bank conducts or facilitates transactions that US authorities determine to be significant dealings with designated persons, sanctioned sectors, or programmes carrying secondary-sanctions authority. The legal basis is not the same prohibition that applies to US persons: it is a separate, extraterritorial authority under IEEPA and related statutes that allows OFAC – and other US agencies – to restrict or sever a foreign financial institution's access to the US financial system. The consequence, typically a loss of correspondent-banking relationships or access to the US dollar, can be existential for an internationally active bank.

This guide addresses how non-domestic banks can identify, assess, and manage secondary sanctions exposure under OFAC: the governing authority, the key questions to ask at each stage, the places where compliance programmes fail, and when to bring in sanctions counsel.

What is the legal basis for secondary sanctions exposure, and why does it differ from primary OFAC liability?

Primary OFAC sanctions bind US persons and US-nexus transactions directly. Secondary sanctions operate on a different logic: they allow the United States to restrict the US-system access of foreign persons who engage in conduct the US has identified as unacceptable, even where that conduct involves no US person, US territory, or US-dollar clearing.

The authority derives principally from IEEPA, supplemented by programme-specific statutory provisions. Not every OFAC programme carries secondary-sanctions authority. Whether a given programme carries that authority is the first question a non-domestic bank must answer when assessing exposure. The answer determines the analytical framework entirely.

In our experience, compliance teams at non-US banks routinely conflate primary and secondary obligations. Primary sanctions prohibit a specific transaction. Secondary sanctions authorise a range of consequences – from enhanced due diligence requirements imposed on US correspondents, to direct measures against the foreign institution itself. The conduct that triggers secondary exposure is frequently broader than a flat prohibition: it includes "significant" dealings, defined by reference to factors such as volume, materiality, frequency, and the nature of the relationship. None of those factors is a binary test.

A cross-border point matters here. UK and EU sanctions do not carry a secondary-sanctions architecture in the OFAC sense. OFSI's regime binds entities with a UK nexus; EU Council regulations bind EU operators. A non-UK, non-EU bank that deals with a designated person under those regimes is not itself exposed to UK or EU measures simply by reason of that dealing. The OFAC secondary-sanctions model is the significant outlier, and it is the one that demands bespoke management.

How do you identify whether a specific OFAC programme creates secondary-sanctions risk for a non-domestic bank?

The starting point is to confirm, for every programme relevant to the bank's geographic and sectoral footprint, whether the programme's statutory or executive-order basis authorises secondary measures against non-US financial institutions. That is a legal determination, not a screening determination. Screening tells you who is on a list; it does not tell you whether your dealings with an unlisted counterparty in a given sector trigger exposure under a programme that operates on a "significant transaction" test.

Once the programme scope is confirmed, a non-domestic bank should map its transaction book against three exposure categories.

• Direct dealings with designated persons. This is the clearest category. Any transaction that gives a designated person access to the US financial system, directly or indirectly, creates maximum exposure. The 50 percent rule (OFAC's rule treating entities owned 50 percent or more in the aggregate by one or more blocked persons as themselves blocked) extends this category to non-listed entities. Have you mapped ownership chains to the second and third tier?
• Dealings with sanctioned sectors. Some programmes restrict certain sectors rather than specific persons. A bank that knowingly facilitates activity in a restricted sector – regardless of whether the specific counterparty is listed – can fall within the secondary-sanctions reach of those provisions. Sector mapping is a distinct analytical step from list screening.
• Dealings that facilitate a prohibited transaction. A foreign bank that structures, processes, or provides financing for a transaction that would be prohibited if conducted by a US person may attract OFAC attention even where the bank has no direct connection to the listed party. OFAC's own guidance confirms that facilitation of prohibited conduct – enabling transactions that a US person would be barred from doing directly – is itself prohibited for US persons, and that foreign institutions which provide the conduit for such facilitation are within the scope of secondary-sanctions concerns.

Programme mapping is not a one-off exercise. OFAC designations occur continuously, and the sectoral scope of a programme can change. A bank that mapped its exposure in the prior year and has not revisited the analysis is operating on stale data.

What does a step-by-step compliance review look like for secondary sanctions exposure?

The following sequence reflects the approach we apply with clients building or stress-testing a secondary-sanctions compliance programme. It is not a substitute for advice on specific facts, but it is the logical order of the exercise.

1. Programme audit. Identify every OFAC programme with a geographic or sectoral connection to the bank's business. For each, confirm whether it carries secondary-sanctions authority. Document the basis.
2. Counterparty mapping. For each relevant counterparty, map the full ownership and control chain. Apply the 50 percent rule at every tier. Flag any entity where a blocked person holds a significant minority that, when aggregated with other blocked-person holdings, crosses the threshold.
3. Transaction categorisation. Categorise transactions against the three exposure types above (direct SDN dealing, sectoral activity, facilitation). Assign a risk rating to each category for each relevant programme.
4. Correspondent-account analysis. Assess which of the bank's US correspondent relationships would be affected if OFAC were to impose secondary measures. Map the US-dollar exposure and identify where concentration risk sits.
5. Policy and procedural gap analysis. Compare existing policies against the risk map. A policy that addresses name-screening but not sector screening, or that applies ownership analysis only to direct counterparties, has an identifiable gap.
6. Escalation and response procedures. Confirm that the bank has a response procedure for the event of an OFAC inquiry or a correspondent's notification of concern. Who owns the response? What is the timeline for internal escalation? Is there a pre-identified external sanctions counsel?
7. Record-keeping. Confirm that records are maintained for the required period. Sanctions records should be kept for five years as a minimum reference point, as currently in force – verify the applicable standard for your jurisdiction.

Each step generates a documented output. That documentation is the bank's first line of defence if a regulator or a correspondent bank asks about the institution's controls.

What are the common red flags that indicate a secondary-sanctions gap in a non-domestic bank?

We regularly advise institutions that discover secondary-sanctions gaps only after a correspondent bank has imposed a restriction or after OFAC has made a preliminary inquiry. The common failure points are consistent.

Name screening treated as sufficient. This is the most persistent gap. List screening identifies designated persons. It does not identify a sector restricted under a programme. It does not identify an entity that is blocked under the 50 percent rule but does not appear on the SDN List (OFAC's list of Specially Designated Nationals and blocked persons) itself. A bank whose compliance programme consists primarily of name-matching against published lists has not addressed secondary-sanctions exposure.

Sector blind spots are the second consistent failure. A bank that has business in an industry with known sectoral restrictions – energy, metals, defence-related manufacturing – and has not mapped those activities against the sectoral scope of applicable programmes has an unquantified exposure. This is the scenario where a single mis-categorised transaction can generate a significant inquiry.

Correspondent-bank feedback is frequently misread. A US correspondent that asks enhanced due-diligence questions about a specific transaction or counterparty is often signalling a secondary-sanctions concern. Treating that inquiry as routine documentation overhead, rather than as a signal to review the underlying relationship, delays the moment of recognition.

Finally: the facilitation test catches activity that sits outside the direct transaction chain. A bank that provides trade finance, issues letters of credit, or provides payment services for a transaction with a sanctioned-sector connection may be facilitating a prohibited transaction even where it has no direct relationship with a designated person. The chain of analysis must follow the economic substance of the transaction, not only the identity of the immediate counterparty.

How does OFAC's secondary-sanctions posture interact with correspondent-banking and de-risking decisions?

The practical consequence of secondary-sanctions exposure for a non-domestic bank is not always a formal OFAC action. More often, the consequence is a decision by a US correspondent bank to restrict, limit, or terminate the relationship. That is because the US correspondent itself faces primary OFAC liability if it maintains a relationship with a foreign bank that is engaging in prohibited or sanctioned-sector activity. The correspondent's risk-management decision is therefore driven by its own OFAC exposure, not by a formal determination against the foreign institution.

De-risking (a financial institution exiting a relationship to avoid sanctions exposure) has become a significant operational risk for non-domestic banks in jurisdictions or sectors that US correspondents associate with elevated secondary-sanctions risk. A correspondent's decision to exit can precede any formal OFAC action by a substantial period. In our experience, the banks that manage this risk most effectively are those that engage proactively with their US correspondents – providing compliance documentation, demonstrating programme quality, and maintaining open channels – rather than those that respond only when a restriction is already in place.

This creates a practical two-track obligation. A non-domestic bank must manage its own exposure to OFAC secondary measures, and it must also manage the perception of that exposure as seen through its correspondents' risk frameworks. The second track often moves faster than the first.

It is worth noting that the foreign financial institution risk authority – which allows US measures against institutions that conduct or facilitate significant transactions for designated persons or specified sectors – can extend beyond banks to insurers and card-network operators, as currently in force. A bank's sanctions programme that addresses only direct correspondent-banking exposure and not its insurance and payment-network relationships may have a structural gap.

When should a non-domestic bank involve external sanctions counsel?

The decision to involve external sanctions counsel (a qualified adviser on OFAC and related regimes) is itself a risk-management decision. There are four trigger points where external input materially changes the outcome.

The first is programme design or redesign. Building a secondary-sanctions compliance programme without independent input from practitioners who advise on OFAC matters is a common error. In-house teams are well-positioned to manage day-to-day screening. They are typically not positioned to challenge the programme's own analytical assumptions.

The second is a correspondent-bank inquiry. When a US correspondent raises questions about a specific transaction or counterparty, external counsel can assess quickly whether the inquiry signals a secondary-sanctions concern and what the appropriate response is. Acting without that assessment risks a response that escalates rather than resolves the inquiry.

The third is a transaction with an unusual ownership structure or sectoral profile. A transaction that crosses multiple jurisdictions, involves a counterparty in a sector with known secondary-sanctions exposure, or presents an ownership chain with any SDN-connected holding warrants independent review before proceeding. The cost of that review is small relative to the cost of a correspondent restriction.

The fourth – and the one where timeliness is most acute – is receipt of a direct inquiry from OFAC or a US government agency. A voluntary self-disclosure or VSD (the process of proactively reporting an apparent violation to OFAC) is a recognised mitigating factor in OFAC's enforcement framework. Whether a VSD is appropriate, what it should cover, and how it should be framed are questions that require specialist input quickly. The statute of limitations for civil and criminal violations under IEEPA was extended to ten years, as currently in force – verify the effective date and scope before reliance – which means OFAC has a significantly longer window to act than many compliance teams assume.

We have acted for financial institutions and trading companies identifying and managing secondary-sanctions exposure across multiple OFAC programmes. The matters where early counsel involvement changed the outcome are not the ones involving formal enforcement; they are the ones where the question was identified before a correspondent took action.

What is the secondary keywords compliance checklist for a non-domestic bank under OFAC?

The following checklist distils the step-by-step guidance above into a practical reference for a compliance team conducting an annual review or a transaction-specific assessment. This is not an exhaustive list: it is the minimum that a well-run programme should be able to confirm.

• Programme scope confirmed: every OFAC programme with geographical or sectoral relevance to the bank's business has been identified, and its secondary-sanctions authority has been assessed.
• Ownership analysis current: ownership and control chains for material counterparties have been mapped to at least the second tier, the 50 percent rule has been applied at every tier, and the analysis has been updated within the last twelve months.
• Sector mapping complete: transactions in sectors subject to sectoral-restriction provisions under applicable programmes have been identified and assessed against those provisions.
• Facilitation analysis conducted: transactions where the bank provides trade finance, payment services, or credit support have been reviewed for indirect facilitation risk, not only counterparty identity.
• Correspondent-bank communication logged: enhanced due-diligence requests from US correspondents have been reviewed for secondary-sanctions content and escalated where appropriate.
• Escalation path documented: a written procedure exists for responding to an OFAC inquiry or correspondent restriction, including the identity of external sanctions counsel.
• Records retained: transaction and compliance records are maintained for the required retention period.
• Programme tested: the compliance programme has been independently reviewed within the last two years, with findings documented and remediation tracked.

A programme that can confirm every item on this list is in a materially stronger position than one that cannot. Gaps identified here are the gaps that regulators and correspondents will identify first. Addressing them proactively is both a compliance obligation and a business-continuity measure.

Related practices that intersect with this guide:

• Affiliate-level restrictions under BIS and the EAR – managing subsidiary-level export-control exposure across a group structure.
• Identifying sham-transaction indicators under OFAC – how to detect and respond to red flags in transaction due diligence.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.