Secondary sanctions exposure for non-domestic banks under OFAC: the essentials

A correspondent bank in Singapore processes a payment routed through New York. The underlying transaction involves a counterparty that maintains an account at a financial institution in a third country – one that, unknown to the Singapore bank, has been conducting significant business with designated persons. The US dollar clearing clears. Six months later, OFAC opens an inquiry. The Singapore bank had no US nexus to the underlying business. Yet it now faces the question every non-US financial institution dreads: can OFAC reach us?

Secondary sanctions exposure for non-domestic banks under OFAC rules does not depend on a direct US nexus to the prohibited transaction. OFAC holds authority under IEEPA and programme-specific legislation to impose measures on foreign financial institutions – including correspondent-account restrictions and de facto exclusion from the US financial system – when they conduct or facilitate significant transactions for designated persons or specified sectors. As of January 2026, that authority covers a broad range of financial-institution types, extending in certain programmes beyond banks to insurers and card-network operators.

This briefing follows the lifecycle of secondary sanctions exposure: from the trigger that creates the risk, through the analysis OFAC applies, to the enforcement measures available, and finally to the programme design that reduces the threat. It addresses where the OFAC position diverges from the UK and EU regimes, and when to involve counsel.

What creates secondary sanctions exposure for a non-domestic bank?

Secondary sanctions exposure arises when a foreign financial institution conducts or facilitates a transaction that falls within a prohibition directed at non-US persons. The legal basis is not the general economic-sanctions architecture – which applies to US persons and to transactions with a US nexus – but rather a distinct set of powers that Congress has granted OFAC to protect the integrity of the US financial system and the effectiveness of US sanctions programmes. The exposure is real even where no US dollar, no US correspondent, and no US person is involved in the immediate transaction.

The trigger is ordinarily one of three things. First, a transaction of significant value for or with a specially designated national (SDN – a person on OFAC's list of blocked persons and entities). Second, a transaction with a person or sector subject to a programme-specific secondary measure, even where that person or sector is not on the SDN List. Third, a pattern of smaller transactions that, viewed in aggregate, amounts to a significant course of dealing. OFAC's own guidance makes clear that significance is assessed qualitatively – size alone does not determine whether a transaction crosses the line, though it is relevant.

In our experience, the most common gap we see in non-domestic banks is the failure to distinguish primary from secondary exposure. A bank that has screened a payment against the SDN List and found no match may believe it has discharged its obligation. But secondary sanctions exposure for non-domestic banks under OFAC rules can arise even where the immediate counterparty is clean, if that counterparty is itself facilitating a transaction for a listed person further up the chain. Name screening alone is not a complete control.

How does OFAC define "financial institution" for secondary sanctions purposes?

The definition of financial institution in the secondary-sanctions context is deliberately broad and extends beyond commercial banks. As currently in force, OFAC authority in certain programmes treats the term as covering insurers and card-network operators, in addition to the deposit-taking and lending institutions that most compliance programmes centre on. This matters for non-domestic firms operating at the edges of the traditional banking model.

A foreign bank's indirect exposure through a correspondent relationship is the most familiar route. The correspondent holds a dollar account at a US bank; OFAC can direct the US bank to restrict or terminate that account, effectively severing the foreign institution from the US financial system. The consequence is not a civil penalty assessed against the foreign bank – it is the loss of US dollar clearing capacity. For most internationally active banks, that is the more serious outcome.

Payment firms and virtual-asset service providers (VASPs – businesses that exchange or transfer digital assets) face equivalent exposure. A VASP that processes a transfer for a designated wallet address, or for a cluster of addresses that OFAC has attributed to a designated person, is within the secondary-sanctions perimeter even if it is incorporated and operating entirely outside the United States. Blockchain analytics allows OFAC and partner regulators to trace wallet associations; a designation can extend to addresses linked to a designated person.

The practical lesson is that any institution whose business brings it into contact with USD-denominated value, US-linked infrastructure, or US correspondent banks should treat secondary-sanctions exposure as a live operational risk – not a theoretical one.

What is the "significant transaction" test and how is it applied?

The significant transaction test is the central mechanism OFAC uses to determine whether a foreign financial institution has triggered secondary-sanctions measures. There is no fixed monetary threshold; OFAC assesses significance by reference to a range of factors that include the size, number, and frequency of transactions, the nature of the underlying goods or services, the degree of coordination between the institution and designated persons, and whether the institution took steps to obscure the connection.

Size matters, but it is not determinative. A single very large transaction carries obvious weight. But a pattern of smaller transactions routed through multiple vehicles – designed to avoid the appearance of significance – is not automatically safe. OFAC's guidance makes clear that evasion of controls is itself a factor that can elevate the significance assessment.

The assessment is programme-specific. Different programmes carry different significance thresholds. In some programmes, the term "significant" has been further defined by executive orders or OFAC guidance specific to that programme; in others, it is left as a general standard. Practitioners advising on OFAC matters therefore look first at which programme is in play, then at the programme-specific guidance, before applying the general significant-transaction analysis.

What constitutes a facilitated transaction is also broad. Providing trade finance, processing payments, extending credit, or maintaining a correspondent account for an institution that is itself engaged in significant transactions can be sufficient. The facilitation route is why a bank with no direct relationship to a designated person can still find itself within the secondary-sanctions perimeter: the bank provides the financial infrastructure through which the prohibited business flows.

How does secondary-sanctions enforcement work in practice?

Enforcement against a foreign financial institution under the secondary-sanctions authority does not follow the standard OFAC civil-penalty pathway. OFAC does not typically impose a monetary penalty on a non-US bank in the way it would on a US person or a US entity. Instead, the principal enforcement tool is a directive to US correspondent banks and US financial institutions to restrict or terminate their accounts with the foreign institution.

The effect is severe. A foreign bank that loses its US correspondent relationships loses its ability to clear US dollars. For an internationally active bank, this is an existential commercial consequence. It does not require a finding of intent; OFAC's secondary-sanctions authority is not limited to knowing or intentional violations. The standard is whether the institution conducted or facilitated the relevant transactions, not whether it knew they were prohibited.

The enforcement lifecycle typically runs as follows. OFAC identifies the pattern of transactions through intelligence, partner-regulator referrals, or its own monitoring of financial flows. It may issue a finding or a formal designation of the foreign institution. More often in the first instance, it issues a warning – often called a "finding" or a "determination" – that puts the institution on notice and triggers a secondary obligation on US persons to restrict access. The foreign institution then faces a choice: demonstrate to OFAC that it has ceased the relevant activity, or face the consequence of losing US market access.

The voluntary self-disclosure pathway – a recognised mitigating factor in OFAC's Enforcement Guidelines for US-person violations – does not translate directly into the secondary-sanctions context, because the foreign bank is not itself subject to the Enforcement Guidelines in the same way. However, proactive engagement with OFAC, including disclosing the transactions and demonstrating remediation, can affect how aggressively OFAC pursues correspondent-restriction measures. In our practice, the banks that manage secondary-sanctions inquiries most effectively are those that engage early, provide full transactional transparency, and demonstrate a credible programme change.

How does OFAC secondary-sanctions exposure compare with the UK and EU positions?

The divergence between OFAC's secondary-sanctions reach and the positions of OFSI and the EU is one of the most important structural features of cross-border financial sanctions compliance. A non-domestic bank subject to all three regimes faces obligations that do not stack neatly.

The UK regime under OFSI and the EU sanctions architecture both operate primarily on a primary-sanctions basis: they prohibit conduct by persons within their jurisdiction, or with a sufficient nexus to their jurisdiction, and they apply ownership-and-control tests to identify entities caught through listed persons. Neither OFSI nor the EU operates a secondary-sanctions mechanism equivalent to the OFAC authority described above. There is no UK or EU equivalent of the correspondent-account restriction directed at a third-country bank for facilitating transactions with designated persons outside UK or EU territory.

However, the gap is narrowing in one respect. The EU Blocking Regulation can prohibit EU operators from complying with specified third-country measures – including, in principle, certain US sanctions. For an EU-incorporated bank subject to both regimes, that creates a genuine conflict: OFAC creates pressure to restrict business, while the EU Blocking Regulation may prohibit compliance with that pressure. Managing this conflict requires a programme that addresses both jurisdictions, not one that resolves the tension by choosing one side.

The UK post-Brexit position has been to maintain a broadly US-aligned approach on secondary-sanctions risk, without the formal legal machinery. OFSI guidance encourages UK firms to assess exposure to US secondary measures as part of their overall sanctions risk framework, even where OFSI itself has no equivalent rule. Where two regimes both apply, the stricter prohibition governs; where they conflict, specialist cross-regime advice is required. That is not a theoretical point – it arises in practice whenever a bank processes a cross-border payment that touches the US financial system.

Switzerland (through SECO), Canada (through GAC), Australia (through DFAT), Singapore, Japan, and the UAE each implement UNSC-mandated measures and maintain varying degrees of autonomous sanctions alignment. None of them replicates the OFAC secondary-sanctions architecture. A bank operating under those regimes is not thereby exempt from OFAC reach; it is simply not subject to a parallel secondary-sanctions obligation from its home regulator. The OFAC risk travels with the dollar and the US nexus, regardless of where the bank is chartered.

What are the principal risk flags for non-domestic banks?

Risk identification for secondary sanctions exposure for non-domestic banks under OFAC rules requires looking beyond the transaction that screens clean today and toward the structural relationships that could create exposure tomorrow. Several risk flags appear consistently across the cases we advise on.

The first is correspondent-account management. A non-domestic bank that maintains accounts for financial institutions in high-risk jurisdictions without conducting ongoing due diligence on the transactions those institutions process is accumulating exposure. The fact that the account itself screens clean does not resolve the question of what flows through it.

The second is sector exposure. Some OFAC programmes impose secondary measures on entire sectors – energy, metals, financial services – rather than on named persons alone. A bank that has no direct SDN contact but provides financing or payment services to companies operating in a designated sector is within the secondary-sanctions perimeter under those programmes. Sector-level screening is qualitatively different from name screening; many compliance programmes have not been built to perform it reliably.

The third is diversion and transit risk. A sharp change in trade flows to a neighbouring or transit jurisdiction is a diversion red flag that OFAC and its partner agencies treat seriously. A bank financing those flows – even where the goods are permitted and the counterparties are unlisted – faces the question of whether the ultimate destination triggers a secondary measure. Transit through a third country does not change a transaction's controlled status; origin and end-use analysis follows the transaction, not the route.

The fourth is the use of third-party payment intermediaries or shell structures. Where a transaction appears designed to obscure the connection between a financial institution and a designated person or sector, that design feature itself is a significant-transaction aggravating factor. Compliance programmes that flag unusual routing, circular flows, or layering are better positioned to detect this before it becomes an enforcement problem rather than after.

A screening gap that surfaces only after a breach is almost always more costly to manage than one detected and remediated proactively. The forensic reconstruction of a payment chain – to determine whether any transaction in the flow crossed a secondary-sanctions threshold – takes time and specialist knowledge. Waiting for OFAC to do that reconstruction is not a strategy.

What should a non-domestic bank's compliance programme address?

A secondary-sanctions compliance programme for a non-domestic bank has five elements that go beyond the standard name-screening model. Each maps to a specific exposure route described above.

The first element is jurisdiction mapping. The bank must identify, at the programme level, which OFAC programmes carry secondary-sanctions measures that could reach it, given its business model, its correspondent relationships, and the sectors and geographies it serves. That mapping exercise is not a one-time task; it needs to be updated when OFAC designates a new sector or when the bank's own business changes.

The second element is correspondent due diligence. For each correspondent relationship that creates a potential USD-clearing nexus, the bank should conduct periodic review of the transactions being processed through the account, including a sector-level and geography-level assessment, not only a name check. The five-element compliance programme standard – management commitment, risk assessment, internal controls, testing and audit, training – sets the baseline that OFAC expects from US persons; non-domestic banks should use it as a benchmark even though they are not directly bound by it.

The third element is transaction monitoring calibrated to secondary risk. That means rules and alerts designed to catch sector-level exposure, unusual routing, and aggregation patterns, in addition to direct SDN matches. We regularly advise compliance teams on the gap between what their screening tools were built for and what OFAC's secondary-sanctions analysis actually looks at. The two are not the same.

The fourth element is escalation and counsel engagement. The bank needs a clear internal route from a potential secondary-sanctions hit to a decision-maker who understands the consequence: loss of US correspondent access. That is a board-level commercial risk, not only a compliance matter. The decision about whether to engage with OFAC proactively – including the question of whether anything approaching a voluntary disclosure is appropriate – requires specialist sanctions counsel, not only in-house compliance.

The fifth element is record-keeping discipline. OFAC requires that sanctions records be kept for five years. Non-domestic banks should match that standard for transactions that could be within any secondary-sanctions analysis, so that the forensic reconstruction – if it ever becomes necessary – draws on contemporaneous documentation rather than retrospective reconstruction.

The position above covers the standard framework. Your facts – the specific programme, the correspondent relationships in play, the sectors your clients operate in, the jurisdictions you serve – will determine where your actual exposure sits. An assessment calibrated to your business model identifies the gaps before they become enforcement triggers.

If a transaction or a relationship has already been flagged, or if you have received any inquiry from OFAC or a US correspondent bank, an early review preserves options that narrow significantly with time. Contact Calder & Vance at info@caldervance.com for a confidential initial assessment.

For the related question of how US export-control restrictions apply at the affiliate level, see our service page on affiliate-level restrictions under the BIS and EAR. For an analysis of the transaction-pattern indicators OFAC uses to identify sham structures, see sham transaction indicators under OFAC. The intersection of secondary sanctions and digital assets – including stablecoin issuers – is addressed at stablecoin issuer obligations under OFAC.

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.