Foreign financial institution exposure under OFAC: scope and obligations

A correspondent bank in Singapore processes a payment on behalf of a regional financial institution. The transaction clears. Months later, the US regulator identifies that the regional bank had conducted a significant volume of transactions for a designated entity – transactions routed through the correspondent's dollar-clearing infrastructure. The correspondent now faces a formal inquiry. Could this have been anticipated? Almost certainly, yes.

Foreign financial institution exposure (the risk that a non-US bank, insurer, or payment firm falls within OFAC's authority for conducting or facilitating transactions with designated persons or specified sectors) is governed principally by OFAC under IEEPA (the International Emergency Economic Powers Act) and the relevant thematic sanctions programmes. As of January 2026, OFAC's authority in this area extends well beyond direct dealings with listed persons: it can reach correspondent relationships, clearing arrangements, and trade-finance flows where the foreign institution facilitates conduct that a US person could not do directly. The exposure is strict-liability in character – knowledge is not required to establish the violation.

This briefing explains who administers foreign financial institution exposure under OFAC rules, the legal basis and scope of authority, the core prohibitions and tests, the cross-regime comparison, the risk flags that compliance teams most often miss, and when to involve counsel.

Who administers foreign financial institution exposure – and on what legal basis?

OFAC, a division of the US Treasury, administers the foreign financial institution exposure rules under authority derived principally from IEEPA and, for older programmes, the Trading with the Enemy Act (TWEA). OFAC does not require a US nexus at the foreign institution itself – the hook is typically the use of the US financial system, the involvement of US persons, or the movement of US-origin goods or services through the transaction chain.

The legal architecture has two principal layers. First, the list-based layer: OFAC maintains the SDN List (Specially Designated Nationals and blocked persons), and a foreign financial institution that conducts significant transactions for an SDN or an entity caught by the 50 percent rule (any entity owned 50 percent or more in the aggregate by blocked persons is itself treated as blocked) may be brought within OFAC's scope. Second, the sectoral and programme-level layer: specific sanctions programmes can impose restrictions directly on foreign financial institutions that conduct or facilitate transactions within a designated sector, regardless of whether an individual SDN is involved.

In our experience, the sectoral layer is consistently underweighted by compliance teams. A foreign bank's relationship manager may confirm that no SDN name appears in a transaction, yet the transaction itself – financing a sector covered by a programme-level restriction – can engage the foreign financial institution exposure rules. Name screening alone is not the complete answer.

The statute of limitations for civil violations under IEEPA was extended to ten years, as currently in force, verify before reliance. That window is long enough to revisit relationships that appeared clean at the time of the transaction.

What transactions and conduct bring a foreign financial institution within scope?

OFAC's authority over foreign financial institutions rests primarily on the concept of "significant transactions" – a qualitative standard that looks at the value, volume, nature, and pattern of the institution's conduct, not a bright-line threshold. A foreign bank that processes a single high-value payment for a designated person may cross the significance line. So may one that processes numerous lower-value payments as part of a systematic relationship.

Several categories of conduct attract particular scrutiny. Correspondent-account and payable-through arrangements are the most common vector: where a foreign bank clears US dollars for another institution without adequate due diligence on that institution's underlying customer base, the US correspondent's account becomes the conduit for prohibited flows. The US correspondent is at risk; so is the foreign bank that used it.

Trade finance is a second high-risk category. Letters of credit, documentary collections, and supply-chain financing arrangements can embed a foreign financial institution in a transaction chain that also includes a sanctioned sector or a sanctioned counterparty. The prohibition on facilitation – the rule that a US person may not facilitate a transaction that it could not do directly – means that a US bank participating even indirectly in such a chain faces exposure, and that fact increases pressure on the foreign institutions with which US banks deal.

Insurance and card networks are a third category. As currently in force and subject to review, OFAC's definition of "financial institution" for these purposes can extend to insurers and payment-card network operators, not only banks. A foreign insurer that provides cover for a vessel engaged in sanctioned trade, or a card network that processes settlements for a merchant with a sanctioned beneficial owner, can be in scope.

What about indirect facilitation? A foreign financial institution does not need to be the direct counterparty to a sanctioned entity. Processing payments for an intermediary that itself routes funds to a designated person – a pattern known in the industry as layering through non-designated correspondents – can still engage the foreign financial institution exposure rules where the pattern is significant and the intermediary relationship was not adequately reviewed.

How does OFAC's foreign financial institution test compare with OFSI and EU approaches?

The US, UK, and EU frameworks each impose obligations on financial institutions, but they operate on different legal bases, apply different tests, and carry different consequences. Understanding the divergence is not an academic exercise – for a foreign bank with operations or correspondent relationships across all three jurisdictions, the same transaction can engage all three simultaneously, and the stricter prohibition governs the conduct of a person subject to both.

Under OFAC, the core question is whether the foreign institution has conducted or facilitated "significant" transactions for designated persons or specified sectors. Liability is strict: knowledge of the designation is not required to establish the underlying violation, though knowledge and intent remain relevant to the penalty calculation. Consequences for a foreign institution found within scope can include correspondent-account restrictions – which effectively cut the institution off from dollar clearing – and the prospect of being added to OFAC's own lists.

Under OFSI, the UK regulator can impose monetary penalties on a strict-liability basis (no need to prove knowledge), in force since 2022. The maximum penalty is the greater of £1,000,000 or 50 percent of the breach value, as currently in force, verify before reliance. OFSI's test focuses on whether a financial institution has dealt with the funds or economic resources of a designated person, or made funds available directly or indirectly. The ownership-and-control test under UK rules can catch a non-listed entity controlled by a designated person, which is a broader standard than a pure ownership analysis.

Under EU sanctions, the asset-freeze prohibition extends to making funds or economic resources available, directly or indirectly, to or for the benefit of listed persons. The EU control test looks at effective control as well as an ownership criterion of more than 50 percent. An EU directive on the criminalisation of sanctions violations, which member states were required to transpose by May 2025, sets minimum penalties including maximum terms of imprisonment and corporate fines expressed as a percentage of worldwide turnover for serious offences. That directive affects EU-established institutions and their personnel.

In our cross-border practice, the most common divergence problem arises when a foreign financial institution has correctly confirmed under EU rules that a counterparty falls just below the ownership threshold, yet the same counterparty crosses the OFAC 50 percent line through indirect aggregate holdings not visible in the corporate registry. An EU analysis that stops at the registered ownership level will miss this. We regularly advise clients to run parallel ownership analyses for OFAC, OFSI, and the EU rather than treating one as a proxy for the others.

What are the principal risk flags that compliance teams miss?

The most consequential gap we see in practice is the failure to map the full beneficial-ownership chain before clearing a correspondent relationship. A foreign financial institution may screen the name of its direct counterparty and see no match. That screening tells it nothing about the counterparty's own customer base, or about whether any beneficial owner of the counterparty sits at or above the 50 percent threshold across multiple positions held by related persons. Screening the name is not the same as understanding the ownership structure.

A second persistent risk flag is the AIS gap in maritime-linked transactions. Foreign financial institutions that finance commodity trades or provide working capital against shipment documentation should scrutinise whether vessels involved have had transmission gaps, ship-to-ship transfers in open anchorages, or insurance cover from an insurer subject to its own restrictions. A sharp change in trade flows to a neighbouring or transit jurisdiction is also a recognised diversion red flag. These are due-diligence questions, not only screening questions.

Third: de-risking decisions made without legal review. When a foreign financial institution decides to exit a relationship to avoid sanctions exposure – a practice known as de-risking – the decision itself can be a compliance event. If the institution's own analysis reveals that blocked property has been held, a reporting obligation may already have been triggered. An exit without a report can convert a manageable breach into an aggravated one.

Fourth: correspondent relationships with institutions in higher-risk jurisdictions that have not been reviewed since the current programme restrictions came into force. Sanctions programmes change. A correspondent relationship established before a new sectoral restriction took effect may now route transactions through a restricted sector without any alert firing. Static correspondent-bank due diligence – reviewed once at onboarding and not refreshed – is a structural gap.

Fifth: the interaction between the EU Blocking Regulation and US requirements. The EU Blocking Regulation can prohibit EU operators, including EU-incorporated financial institutions, from complying with specified third-country measures. A foreign financial institution with both EU and US operations may face an irreconcilable conflict: compliance with one regime renders it non-compliant with the other. In our experience, institutions that have not taken legal advice on this conflict before it arises are poorly placed to manage it when it does.

What obligations attach once a foreign financial institution identifies potential exposure?

Where a foreign financial institution identifies that it may have blocked property or may have conducted a transaction that should have been blocked, two immediate obligations arise under OFAC's rules. First, blocked property must be frozen and maintained in a segregated account. Second, OFAC's transaction-reporting rules apply: blocked and rejected transactions must be reported to OFAC within 10 business days, as currently in force, verify before reliance. Records must be retained for five years.

These are US obligations, and they attach to US persons and to foreign institutions doing business in the United States or through US intermediaries. For a foreign bank with a New York branch, the branch's conduct is directly within OFAC's jurisdiction. For a foreign bank with no US presence, the obligation may arise through the US correspondent's own reporting duties – but the foreign bank's conduct remains a factor in any enforcement analysis directed at that correspondent.

Voluntary self-disclosure (a VSD – the proactive reporting of an apparent violation to OFAC before the regulator raises it) is a recognised mitigating factor under OFAC's Enforcement Guidelines. OFAC distinguishes "egregious" from "non-egregious" cases and takes VSD into account in penalty calculations. An early, well-structured VSD can materially affect the outcome. A late or incomplete one can aggravate the position. Timing is therefore a first-order decision. What should come before a VSD? A scoped internal review, legal privilege protection over that review, and a legal assessment of whether the apparent violation meets the thresholds that make a VSD advisable.

Where a foreign financial institution has significant ongoing US exposure – dollar clearing, US investor relationships, US-governed trade finance – maintaining a sanctions compliance programme (a documented, risk-based framework addressing screening, transaction monitoring, governance, training, and escalation) is a practical necessity even where no specific regulation mandates one. OFAC's Enforcement Guidelines treat the absence of a compliance programme as an aggravating factor in penalty determinations.

When should a foreign financial institution involve counsel?

There are four situations in which delaying specialist advice demonstrably worsens the position.

The first is a transaction hit – a screening alert, an AIS anomaly, a counterparty disclosure, or an internal audit finding that suggests a prohibited transaction may have occurred. The window in which a well-constructed VSD can be assembled and submitted without the regulator having already opened an inquiry is short. In our experience, institutions that wait for a second opinion from internal teams before retaining external counsel lose days they cannot recover.

The second is receipt of an OFAC subpoena, administrative inquiry, or request for information. These carry mandatory response deadlines. Counsel needs to be instructed before any response is prepared, not after a draft has circulated internally.

The third is a material change in a correspondent or counterparty relationship – a change in ownership, a report of a designation in a related group, a press report of regulatory action in another jurisdiction. These are triggers for a legal review of the relationship, not merely a further screening run. Have you reviewed your correspondent relationships since the most recent programme amendments?

The fourth is a jurisdictional conflict: where a foreign financial institution receives advice in one jurisdiction that a transaction is permissible, and advice in another that the same transaction is restricted. Resolving that conflict requires a cross-regime analysis. A domestic compliance officer is not well-placed to perform it without external support.

We have acted for financial institutions across the major regimes in scoping apparent violations, advising on voluntary self-disclosure, and preparing the penalty defence. We also advise on the design and testing of sanctions compliance programmes for institutions entering or expanding in the US dollar-clearing environment.

The position above covers the standard case. Your specific correspondent relationships, your dollar-clearing volume, your trade-finance structures, and the programme restrictions in force at the time of the transactions all change the analysis. For a confidential review of potential exposure, contact Calder & Vance at info@caldervance.com.

Related practices

• Secondary sanctions bank risk under OFAC – correspondent banking exposure to secondary-sanctions consequences
• Affiliate-level restrictions under BIS and the EAR – US export-control obligations for affiliated entities

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.