Foreign financial institution exposure under OFAC: compliance counsel

A European bank maintains a correspondent relationship with a regional lender in a third market. Routine screening shows no listed names. Then a regulator inquiry arrives: the regional lender, it turns out, has been processing payments for entities in a sector subject to US authority to restrict foreign financial institutions. The correspondent account is suddenly at risk. This is the pattern we see most often – the exposure was there before the inquiry; the gap was in how the institution understood the rules.

Foreign financial institution exposure under OFAC arises when a non-US bank, insurer, or card-network operator conducts or facilitates significant transactions for designated persons or specified sectors, bringing it within the reach of US authority to impose correspondent-account restrictions and related measures. As of January 2026, this authority extends well beyond banks, and the definition of conduct that triggers it is broader than most institutions expect. Name screening alone does not address it.

This page explains how the authority works, where the exposure lines are drawn, what the cross-border implications look like, and how Calder & Vance assists institutions that need to map, reduce, or respond to that exposure.

What is the foreign financial institution authority, and who administers it?

US authority allows OFAC to impose measures against foreign financial institutions that conduct or facilitate significant transactions for designated persons or specified sectors. The authority sits within IEEPA and the relevant executive-order and programme-specific rules; it is not limited to any single sanctions programme.

The most consequential measure OFAC can impose is a correspondent-account restriction (a prohibition on US financial institutions maintaining or opening a correspondent or payable-through account for the affected foreign institution). That restriction is, in practice, a severe operational consequence. Loss of US dollar clearing access can make a foreign institution unviable in international markets.

For these purposes, the definition of a financial institution extends beyond commercial banks. As currently in force and as confirmed by practitioner-facing guidance, it can reach insurers and card-network operators – a point that surprises many compliance officers. An insurer that underwrites a vessel or cargo connected to a sanctioned sector, or a card scheme that processes transactions routed through a designated entity, may fall within scope. We regularly advise clients who assumed their business model placed them outside the perimeter, only to discover otherwise.

The authority is programme-specific in its details but structurally common across the major OFAC programmes. It is distinct from the primary-sanctions prohibition against US persons dealing with designated parties, and it operates concurrently with, not instead of, the ownership-and-control analysis that determines whether a counterparty is itself blocked.

How does OFAC define "significant transactions" and "facilitation"?

OFAC does not publish a fixed monetary threshold for what makes a transaction "significant." The assessment is fact-specific and considers the volume, frequency, and nature of the transactions, the degree to which a foreign institution knew or could have known of the connection to a sanctioned sector or person, and the overall pattern of conduct.

This deliberate flexibility creates a real risk for institutions that manage exposure by reference to transaction size alone. A foreign institution processing a large number of small-value payments for a sanctioned sector may attract the same regulatory attention as one processing a smaller number of high-value transactions. The question is not purely arithmetic.

Facilitation is a distinct and broad concept. Facilitation (doing something that allows another party to complete a transaction that would be prohibited if a US person did it directly) is itself prohibited under OFAC's rules. A foreign financial institution that routes, clears, structures, or otherwise enables a payment involving a designated person or a restricted sector is potentially facilitating a prohibited act, even if the institution is not itself the ultimate transferor or transferee.

In our cross-border practice, we see the facilitation risk arise most acutely in correspondent banking chains. A bank at tier two or tier three of a chain may have no direct relationship with the sanctioned counterparty, but if the chain as a whole routes value to or from a designated person, the facilitation question is live at each node. Have you mapped your correspondent chain to the ultimate beneficiary, or only to your direct counterparty?

Where do the major regimes diverge, and why does that matter for a non-US institution?

Foreign financial institution exposure is primarily a US-law concept, but the operational consequences of a correspondent-account restriction land squarely in the UK, EU, and other jurisdictions where affected institutions operate. Understanding the divergence is essential for a non-US institution that needs to manage obligations running in multiple directions simultaneously.

Under US rules, a foreign institution can face measures even where it has no US-person involvement in the specific transaction – the extraterritorial reach of OFAC authority means that the conduct of a foreign institution in a third country can, depending on the programme and the facts, give rise to US-side consequences. The Foreign Direct Product rules in the export-control context provide an analogy: the US asserts jurisdiction not because a US person acted, but because a US regulatory interest was engaged.

Under UK rules, OFSI's regime focuses on whether a UK-nexus financial institution has dealt with a designated person or made funds available, directly or indirectly, to a designated person. OFSI can impose monetary penalties on a strict-liability basis; as currently in force, the maximum civil penalty is the greater of £1,000,000 or 50 percent of the breach value, verify the current position before relying on it. The UK does not replicate the foreign-institution-specific authority in the same structural form, but a UK institution subject to an OFAC finding may face separate OFSI scrutiny for its own conduct.

Under EU rules, asset-freeze prohibitions extend to making funds or economic resources available, directly or indirectly, to or for the benefit of listed persons. The EU control test also looks to whether a non-listed entity is effectively controlled by a listed person, which can affect whether a correspondent relationship involves a designated counterparty even if no list match appears. The EU Blocking Regulation adds a further layer: it can prohibit EU operators from complying with specified US measures, creating a direct conflict of obligations for EU institutions that face OFAC pressure and are within the Blocking Regulation's scope simultaneously.

Where two regimes both apply, the stricter prohibition governs. A non-US institution facing concurrent OFAC and EU obligations must resolve any conflict through its own legal analysis – there is no automatic exemption from one by reason of the other. This is precisely the kind of multi-regime conflict that requires cross-border counsel rather than a single-jurisdiction view.

What are the practical risk flags for a foreign financial institution?

A foreign financial institution's exposure under OFAC is not always visible in a name-screening result. Screening flags direct matches; it does not, on its own, identify programme-level sector exposure, ownership chains that aggregate to a blocked threshold, or the significance of a payment pattern as a whole.

The following risk flags recur in the matters we handle. None is individually determinative, but each warrants specific review.

• Sector-level exposure: The institution maintains relationships with counterparties in sectors subject to US executive-order restrictions – energy, defence, financial services, or other sectors named in a programme-specific rule – even where those counterparties are not themselves listed.
• Correspondent-chain opacity: The institution receives or routes payments from correspondent banks whose own correspondent relationships are not transparent, particularly where the chain passes through jurisdictions with a higher risk of sanctioned-party access.
• Ownership aggregation: A counterparty is not on a list but is owned 50 percent or more in the aggregate by one or more designated persons. The 50 percent rule (OFAC's rule treating entities owned 50 percent or more by blocked persons as themselves blocked) means that the entity is blocked regardless of its own listing status. Standard name screening misses this unless ownership data is actively analysed.
• Insurance and card-network exposure: The institution insures vessels, cargo, or facilities connected to a restricted sector, or processes card transactions for merchants that are directly or indirectly owned by designated persons.
• Trade-flow anomalies: A sharp change in the volume or routing of payments to or through a specific jurisdiction is treated as a diversion red flag. Where a correspondent's flows have shifted materially, that shift requires explanation and analysis.
• AIS gaps and maritime exposure: For institutions active in trade finance or cargo insurance, gaps in vessel AIS transmission and ship-to-ship transfers are recognised risk indicators under maritime sanctions compliance guidance.

The position above covers the standard case. Your facts – the counterparty, the sector, the correspondent chain, the programme in play – change the analysis materially. To discuss a specific exposure, contact Calder & Vance at info@caldervance.com.

What is the myth that creates the biggest compliance gap?

The myth we correct most often is that name screening alone is enough to meet the rules. It is not. Name screening identifies direct matches against published lists. It does not perform ownership aggregation under the 50 percent rule, assess whether a counterparty falls within a sector subject to programme-specific restrictions, analyse the correspondent chain beyond the immediate counterparty, or evaluate whether a pattern of transactions constitutes facilitation.

Institutions that rely on a clean screening result as their complete answer to the question of foreign financial institution exposure have, in effect, answered a different and narrower question than the one OFAC's authority poses. The authority asks whether the institution has conducted or facilitated significant transactions for designated persons or restricted sectors. A name screen tells you whether a name matched a list. The two questions overlap; they are not the same.

A well-tested compliance programme for foreign financial institution exposure does five things. It screens names. It maps ownership chains to the 50 percent threshold, directly, indirectly, and in aggregate. It identifies the sectors in which counterparties operate and cross-references those sectors against active OFAC programme restrictions. It monitors correspondent-chain risk beyond the first-tier relationship. And it maintains records for the required period – five years, as currently in force – so that a voluntary self-disclosure or enforcement defence has a documentary foundation to work from.

If a transaction has already been flagged, or a correspondent relationship is under review by a US regulator, an early assessment can preserve options that narrow with time. For an immediate review, reach our team at info@caldervance.com.

How does voluntary self-disclosure affect a foreign institution's position?

Voluntary self-disclosure (a VSD – a proactive disclosure to OFAC of an apparent violation before the regulator initiates contact) is a recognised mitigating factor under OFAC's Enforcement Guidelines. For a foreign financial institution, the decision whether to submit a VSD is one of the most consequential compliance decisions it will face.

A VSD does not guarantee a favourable outcome. OFAC's Enforcement Guidelines set out a framework for categorising matters as egregious or non-egregious and for weighting disclosure against aggravating factors. The categorisation affects the penalty range that applies. What a VSD can do – when properly prepared and submitted – is move the matter into the non-egregious category and signal to OFAC that the institution has a functioning compliance culture. The absence of a VSD when a violation is later discovered by the regulator is itself an aggravating factor.

For a foreign institution, the VSD decision is complicated by the fact that the same conduct may be under review by home-country regulators simultaneously. A disclosure to OFAC does not prevent a parallel inquiry from OFSI or an EU national competent authority, and the timing and content of each disclosure may need to be coordinated. We have acted for institutions in exactly this position, managing concurrent review across US and non-US regulators, preparing each disclosure in a sequence that does not prejudice the other.

The statute of limitations for civil violations under the relevant US authority is a long window, as currently in force – verify the current position before relying on it. Institutions should not assume that older conduct is beyond reach simply because time has passed.

How Calder & Vance assists with foreign financial institution exposure under OFAC

Our work on foreign financial institution exposure covers the full range from initial mapping to enforcement response. We act for multinationals, financial institutions, and exporters on sanctions and export-control matters across the major regimes.

For institutions assessing their position, we screen the counterparty and ownership chain, surface secondary-sanctions risk, and structure the transaction or relationship to reduce the exposure. This includes mapping the correspondent chain beyond the first tier, identifying sector-level programme restrictions, and analysing ownership aggregation under the 50 percent rule.

For institutions that have received an inquiry, a finding, or a restriction notice, we scope the apparent violation, advise on voluntary self-disclosure, and prepare the penalty defence. In our experience, the quality of the documentary record available at the point of inquiry is often the most important variable in the outcome – which is why record-keeping to the required standard, and for the required period, is a structural element of the compliance programme rather than an afterthought.

We also design and test compliance programmes specifically for the foreign financial institution risk profile: screening logic, ownership analysis, correspondent due diligence, and the governance structures that allow an institution to escalate and respond when a risk is identified.

In a recent matter, an insurance group operating across multiple jurisdictions discovered that a marine cargo policy it had underwritten was connected, through an intermediate company, to a sector subject to OFAC programme-level restrictions. We mapped the ownership and control structure, assessed the policy against the applicable programme, advised on voluntary disclosure, and assisted in restructuring the group's underwriting due-diligence process. The matter proceeded without a formal enforcement action.

For an assessment of your institution's exposure under OFAC, or to discuss a compliance-programme review, contact Calder & Vance at info@caldervance.com.

Related practices

• Affiliate-level restrictions under BIS and the EAR – entity-list exposure and licence strategy for controlled-technology transactions
• EU sanctions perimeter for insurers and card networks – mapping the EU asset-freeze and sector-restriction obligations for non-bank financial institutions
• Secondary sanctions risk for banks under OFAC – assessing and managing secondary-sanctions exposure in correspondent and trade-finance relationships

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.