A multinational trading house operating between the United States and multiple emerging markets asks its compliance team a pointed question: is our sanctions screening programme actually working, or are we merely assuming it does? The distinction matters. An OFAC enforcement action predicated on a failed screening process can expose the firm to civil penalties calculated per transaction – and where wilfulness is found, criminal liability follows. The compliance programme that looks adequate on paper may contain control gaps that only structured testing reveals.
An OFAC compliance audit and testing programme is the structured, evidence-based process by which a firm verifies that its sanctions controls – screening logic, ownership-chain analysis, transaction monitoring, and escalation procedures – operate as designed against the standard OFAC articulates in its published framework guidance. As of August 2026, OFAC's enforcement posture treats the existence and quality of a sanctions compliance programme (SCP) as a central mitigating factor in any civil-penalty calculation. A tested, documented SCP can reduce a penalty base materially; an absent or untested one aggravates it.
This page sets out how OFAC compliance audit and testing works in practice, where the cross-regime considerations bite, what the common failure modes are, and how Calder & Vance supports firms through the process.
What does an OFAC compliance audit actually cover?
An OFAC compliance audit reviews every control that sits between your business and an inadvertent sanctions violation: screening coverage, data quality, ownership-and-control analysis, escalation workflows, training records, and the documentation that demonstrates management oversight. The objective is not to certify that you have policies – most firms do – but to confirm that those policies translate into working controls that a regulator would find adequate.
OFAC has described five essential components of an effective SCP: management commitment, risk assessment, internal controls, testing and auditing, and training. A meaningful audit touches all five. It begins with a risk assessment scoped to the firm's actual exposure: the sectors it operates in, the geographies it touches, the counterparty types it faces, and the goods or services it moves across borders.
From there, the audit maps the controls that respond to each identified risk category. Where a control exists but has never been tested, the audit records the gap. Where a control has been tested but the test methodology was inadequate – for instance, a screening test that used only exact-name matching against the SDN List (OFAC's list of Specially Designated Nationals and blocked persons) without fuzzy-match or transliteration logic – the audit flags the residual risk and recommends remediation.
In our experience advising cross-border businesses, the gap between stated policy and operational reality is widest in three areas: beneficial ownership tracing below the first tier of direct shareholders, transaction-level screening of payment instructions after account opening, and sanctions training records for non-compliance staff in operational roles such as trade finance and logistics.
How does OFAC measure the quality of a compliance programme?
OFAC evaluates a compliance programme against a five-element standard drawn from its framework guidance, treating each element as both a mitigating factor in enforcement and a benchmark against which any apparent violation is assessed. The quality of a programme is judged not by its length but by its integration into actual decision-making.
The first element – management commitment – requires that senior leadership has formally endorsed the programme, allocated resources to it, and receives regular reporting on its performance. Audit work here typically involves reviewing board or committee minutes, budget approvals for compliance functions, and escalation logs that demonstrate upward reporting of screening alerts.
The second element – risk assessment – must be specific to the firm's business model and updated when that model changes. A trading house that expands into a new product line or a new geography must reassess its sanctions exposure before, not after, the expansion. We regularly advise clients on the risk-assessment methodology that OFAC's guidance contemplates and on how to document the outputs so that they withstand scrutiny.
Internal controls form the third element. These include the screening systems themselves, the ownership and control (the test for whether a non-listed entity is caught through a listed person's shareholding or direction) analysis procedures, and the transactional escalation process. Testing – the fourth element – is the active verification that these controls perform as designed. It must be periodic and must simulate genuine operational conditions, not merely check whether the screening system can identify a name that appears verbatim on the SDN List.
Training, the fifth element, must be role-specific and documented. A generic annual module for all staff will not satisfy OFAC if the firm employs trade-finance officers, payment processors, or relationship managers whose roles place them in regular contact with sanctions-relevant counterparties or geographies.
The position above covers the standard case. Your facts – the counterparty mix, the jurisdictions you operate in, the goods you move, the payment rails you use – change the analysis. For an initial assessment of how your programme sits against OFAC's five-element standard, contact Calder & Vance at info@caldervance.com.
What does the testing phase involve, and how long does it take?
The testing phase of an OFAC compliance audit systematically probes whether each stated control performs under realistic conditions – it is not a paper review but an operational simulation that produces evidence-grade findings. The timeline for a complete audit and testing cycle depends on the firm's size, the number of business lines, and the maturity of its existing documentation.
For a mid-sized financial institution or multinational trader with established policies, a focused audit and testing engagement typically runs over several weeks rather than months. The process divides into three phases. The first phase, documentation review, collects the policy documents, risk-assessment outputs, training records, and testing logs already in existence. The second phase, control testing, uses structured test cases – including deliberate near-miss names, entities that should be captured by the 50 percent rule (OFAC's rule treating entities owned 50 percent or more in the aggregate by blocked persons as themselves blocked), and payment instructions routed through intermediary accounts – to verify that the screening system and the human escalation process both respond correctly.
The third phase produces a written findings report, gap register, and remediation roadmap. Where an apparent violation is discovered during testing, we immediately advise on the question of voluntary self-disclosure (VSD – a voluntary report to OFAC of an apparent violation) and on the effect of a prompt disclosure on the penalty calculation.
Firms that embed periodic testing into their programme calendar – rather than waiting for a regulatory review to prompt it – gain an ongoing evidentiary record that strengthens the mitigating case in any future enforcement matter. How often should testing run? OFAC's guidance does not prescribe a fixed interval, but our practice treats annual testing as the floor for businesses with material sanctions exposure, with more frequent cycles for firms in high-risk sectors.
Cross-border audit considerations: how does OFAC interact with OFSI and the EU?
An OFAC compliance audit cannot be treated in isolation for any business that also operates under UK or EU sanctions rules, because the three regimes impose overlapping but not identical obligations – and a control that satisfies one may fall short of another. The cross-border dimension is not peripheral; for most of the clients we advise, it is central.
The most significant structural divergence concerns the ownership-and-control test. Under OFAC, the 50 percent rule is mechanical: if blocked persons own in aggregate 50 percent or more of an entity, the entity is blocked. The test does not require a showing of actual control. Under OFSI and the EU, by contrast, the analysis extends beyond numerical ownership to include direction and control – a listed person who holds less than 50 percent but effectively controls an entity may still render that entity subject to restrictions. A compliance programme that tests only for the OFAC ownership threshold will miss exposure under the UK and EU tests in precisely those cases where ownership is structured to sit just below 50 percent.
The record-keeping obligations also differ. OFAC's guidance addresses documentation of the compliance programme itself, but under OFSI and the relevant EU instruments the obligation to report suspected violations and to maintain records of transactions that were refused or blocked carries its own timelines. For businesses that maintain accounts or process payments across all three jurisdictions, the audit must map which obligation governs which activity and confirm that the internal process for each is distinct and properly documented.
For businesses that also have exposure under the Australian, Singaporean, or Japanese regimes, the audit scope expands further. Each of those regimes has its own ownership and control tests, reporting obligations, and enforcement postures. See our related pages on compliance audit and testing under the Australian regime and compliance audit and testing under OFSI for a regime-specific breakdown.
If a transaction has already been flagged, or if a filing has been refused or a screening alert has gone unresolved, an early review preserves options that narrow with time. Contact Calder & Vance at info@caldervance.com to discuss the position.
What are the most common failures in OFAC compliance testing?
The most common failure our practice identifies in OFAC compliance testing is not a missing policy but a broken escalation chain – the compliance programme states that alerts above a certain risk score are escalated to a senior decision-maker within a defined window, but in practice those escalations are resolved by junior staff without documentation or, worse, cleared automatically by the system.
A second persistent failure is over-reliance on a single screening vendor without periodic validation of the vendor's match logic. Vendors update their matching algorithms and their list coverage independently; a firm that has not validated its vendor's performance against the current SDN List, including entity aliases and transliterations, cannot rely on the vendor's contractual representations as a substitute for its own testing obligation. OFAC's guidance is clear that responsibility for programme adequacy rests with the firm, not the vendor.
Third, firms regularly undertest the beneficial-ownership layer. A counterparty may clear screening at the entity level while a beneficial owner above the 50 percent threshold appears on a designated list. The screening system flags the entity; the beneficial owner is not in the system's data. In our cross-border practice, this gap is most acute in markets where beneficial-ownership registries are incomplete or not publicly searchable, and where the firm's onboarding process collects only the first tier of ownership.
Fourth, and frequently, the training element is treated as a tick-box exercise. Annual completion rates are recorded but the training content does not reflect the firm's actual risk profile, the most recent changes to the SDN List or the relevant thematic sanctions regulations, or the specific scenarios that staff in operational roles are likely to encounter. Training that does not change behaviour under operational pressure is not a mitigating factor in enforcement; it is evidence that the programme is cosmetic.
A widely held belief is that a compliance programme that has never produced a violation is a compliant one. That inference is wrong. OFAC's enforcement history demonstrates that apparent violations are often discovered during a regulatory examination precisely because the firm had never tested its controls rigorously enough to find them first. The absence of a known violation is not evidence of programme adequacy; it may simply be evidence that the programme was never tested.
How Calder & Vance conducts OFAC compliance audit and testing engagements
Our OFAC compliance audit and testing work begins with a scoping call that maps the firm's business model, its sanctions exposure, and the current state of its documented programme – typically completed within a short number of business days. From there, we classify the engagement: a full five-element audit, a targeted gap analysis against a specific element (most often testing or risk assessment), or a remediation-focused engagement following a prior adverse finding.
In the documentation review phase, we assess existing policies, risk-assessment outputs, testing logs, training records, and escalation documentation against OFAC's framework guidance. We use a standardised gap register that maps each identified shortfall to its potential impact on the mitigating-factor analysis under OFAC's civil-penalty guidelines.
In the testing phase, we design and run structured test cases calibrated to the firm's actual counterparty and transaction types. The test set includes entities that should be captured by the 50 percent rule, near-miss names that require fuzzy-match logic to detect, and payment-instruction scenarios that test the screening coverage of correspondent relationships. Where we identify a control failure that may constitute an apparent violation, we advise immediately on the VSD question.
In a recent engagement, a financial services firm had operated a compliance programme that satisfied internal audit review for several years. Testing against realistic scenarios revealed that the payment-instruction screening did not cover transactions routed through a specific intermediary. We scoped the exposure, assessed the apparent violations against OFAC's voluntary-disclosure framework, advised on the VSD submission, and restructured the screening coverage. The matter proceeded without an escalation to a formal enforcement proceeding.
We deliver findings in a written report structured around OFAC's five elements, with a prioritised remediation roadmap and, where requested, board-level briefing materials. Where cross-border exposure requires review of OFSI or EU controls, we advise on those in parallel or coordinate with local counsel in the relevant jurisdiction.
Related practices
- OFSI compliance audit and testing – structured review of UK financial-sanctions controls against OFSI's enforcement standards
- Australian sanctions compliance audit – regime-specific testing under the Australian autonomous-sanctions regime
- Singapore sanctions compliance audit – programme review and testing under the applicable Singaporean regime
Frequently asked questions: OFAC compliance audit and testing
How long does audit and test compliance programme take under OFAC?
The timeline depends on the scope of the engagement and the maturity of existing documentation. A targeted gap analysis against a single element of OFAC's five-element framework can be completed within a few weeks. A full five-element audit and testing cycle for a mid-sized multinational or financial institution typically takes longer, running across several weeks to two months. Where an apparent violation is discovered during testing, the VSD advisory layer runs in parallel and does not materially extend the audit timeline.
What are the main risks in compliance audit and testing under OFAC?
The principal risk is discovering an apparent violation during testing. That risk is best managed by instructing counsel before testing begins, so that legal-privilege considerations are addressed from the outset and the VSD question can be handled promptly if needed. A secondary risk is that a gap-register finding is misclassified as low-priority and left unremediated. OFAC's enforcement guidance identifies a failure to remediate identified gaps as an aggravating factor – making the audit finding itself a liability if not acted upon.
Do we need specialist counsel for compliance audit and testing?
Specialist counsel adds value at two critical points. First, at the design stage: a well-constructed test set calibrated to the firm's actual exposure will surface real control failures; a generic checklist may not. Second, when a finding emerges: the decision whether and how to make a voluntary self-disclosure to OFAC requires an assessment of the apparent violation against the civil-penalty framework, the mitigating-factor analysis, and the cross-border implications if the same transaction also engaged OFSI or EU rules. That assessment requires cross-regime expertise that in-house teams rarely hold on a standing basis.
About the author
J. M. Aldridge advises multinationals and financial institutions on US sanctions and export controls, with a focus on OFAC licensing, secondary-sanctions risk, and BIS classification. Calder & Vance – International Sanctions & Export Control Counsel.
About Calder & Vance
Calder & Vance is an independent international sanctions and export-control boutique. We advise multinationals, financial institutions, exporters, and individuals on the major regimes – OFAC and BIS in the United States, OFSI and ECJU in the United Kingdom, the EU Council regulations and the EU General Court, the United Nations Consolidated List, and the regimes of Switzerland, Canada, Australia, the UAE, Singapore, and Japan. Our work is limited to lawful compliance, licensing, delisting, enforcement defence, and due diligence. To discuss a matter, contact info@caldervance.com.
To stress-test your screening and compliance programme and confirm it meets OFAC's five-element standard, reach our team at info@caldervance.com.
Disclaimer: This material is general information, not legal advice, and is not a substitute for advice on your specific facts. Sanctions and export-control rules change frequently and differ by regime; verify the current position before relying on anything stated here. Calder & Vance does not advise on circumventing or evading sanctions. For advice on your situation, contact info@caldervance.com.