Secondary sanctions exposure for non-domestic banks under OFAC: support

A bank outside the United States closes a correspondent account with a large regional institution. The decision is commercial: the relationship has become unprofitable. Six months later, the bank's US dollar clearing bank flags a pattern of transactions that passed through that correspondent in the preceding year. Several involve counterparties connected to persons on OFAC's SDN List (the Specially Designated Nationals and blocked persons list). The question is no longer whether a relationship should end. The question is whether the bank's dollar-clearing access is at risk. As of January 2026, that risk has a name: secondary sanctions exposure.

Secondary sanctions exposure for non-domestic banks under OFAC refers to the risk that a foreign financial institution conducting or facilitating transactions connected to designated persons, prohibited sectors, or US-sanctioned activity faces US-imposed consequences, even where the bank itself has no US presence and the transactions clear outside the United States. The primary instrument is OFAC's authority to restrict or terminate correspondent and payable-through account access for foreign banks that fall within scope. The test is not conviction; it is OFAC's determination that the bank conducted or facilitated a "significant transaction" for a designated person or a prohibited sector. Every non-domestic bank with US dollar business carries some version of this exposure.

This page explains the legal basis for secondary sanctions risk, how OFAC's significant-transaction test operates, where the analysis diverges across the UK and EU regimes, what the common risk failure points look like in practice, and how Calder & Vance assists foreign banks in assessing and managing this exposure.

Why non-domestic banks face OFAC consequences without a US nexus

A foreign bank's connection to the US does not require a branch, a subsidiary, or a US-licensed operation. US dollar clearing is the mechanism. Almost every international dollar payment passes through a US correspondent at some point in the chain. That passage creates a touchpoint that US authorities treat as a basis for jurisdiction over the underlying transaction – and, in a secondary sanctions context, over the foreign bank that initiated or processed it.

OFAC's authority to act against foreign financial institutions derives from the same statutory base – IEEPA and related authority – that underpins the primary sanctions programme. The relevant authority permits the imposition of measures including the prohibition or strict conditions on the maintenance of correspondent and payable-through accounts in the United States. In our experience, compliance teams at non-domestic banks underestimate this risk precisely because it does not require a primary sanctions violation: the foreign bank need not itself be dealing with a blocked person. It is enough that the bank conducts or facilitates, in aggregate, transactions that OFAC characterises as significant for a designated person or a prohibited sector.

The word "facilitate" is doing considerable work here. A bank that processes a payment on behalf of a customer who is itself moving value for a designated counterparty has facilitated a transaction for that counterparty. The chain of removal from the SDN does not automatically break the nexus. And "significant" is not a clean bright line: OFAC applies a totality-of-circumstances analysis that takes in volume, frequency, the nature of the sanctioned activity, and whether the bank took steps to detect and prevent the conduct.

The exposure is real and it is not hypothetical. OFAC has used this authority across multiple sectors. The practical consequence for a bank found within scope is loss of US dollar clearing access – an outcome that can effectively end the bank's ability to conduct international business.

What the significant-transaction test means in practice

OFAC does not publish a fixed numerical threshold for "significant." The assessment is fact-intensive and considers a cluster of factors: the size and frequency of the transactions, the bank's role in them (originator, intermediary, beneficiary institution), the degree of any connection to the sanctioned programme, and whether the bank's compliance controls were adequate and applied in good faith.

For definition, a specific licence (a case-by-case OFAC authorisation) can in some circumstances permit a category of transactions that would otherwise be prohibited. But no licence immunises a foreign bank from a secondary-risk finding if the totality of its conduct points toward facilitation. The licence analysis and the secondary-risk analysis run in parallel, not in sequence.

Several practical implications follow. First, aggregation matters. A bank processing individually modest payments for a counterparty that is in turn connected to a designated sector can, over time, accumulate a picture that meets the significant-transaction threshold, even where no single payment was large. Second, the bank's awareness is a relevant factor in the consequences even if it is not required for the finding itself. A bank that had no workable system for detecting the exposure will fare differently in any dialogue with OFAC from one that detected it, escalated it, and disclosed it. Voluntary self-disclosure (a VSD – a self-initiated report to OFAC before a formal investigation begins) is a recognised mitigating factor under OFAC's Enforcement Guidelines, and the same logic applies in secondary-risk contexts when those Guidelines govern the outcome.

Third, the definition of "financial institution" in this area extends beyond banks. Insurers and card-network operators can fall within scope where they provide services that enable or facilitate the relevant transactions. A correspondent relationship with a bank that itself has these exposures can pull the relationship bank in.

How the UK and EU regimes create parallel exposure

A non-domestic bank that clears through London as well as New York faces a second layer of exposure under OFSI, the UK's financial-sanctions authority under SAMLA and the relevant thematic regulations. OFSI's regime is asset-freeze focused rather than correspondent-account focused: the prohibition is on making funds or economic resources available to designated persons. But OFSI can also impose monetary penalties on a strict-liability basis – no need to prove knowledge – with the maximum penalty set at the greater of £1,000,000 or 50 percent of the value of the breach, as currently in force, verify before reliance.

The EU regime operates through Council Regulations that are directly applicable in EU member states. The asset-freeze prohibition extends to making funds or economic resources available directly or indirectly to or for the benefit of listed persons. A non-domestic bank with EU operations, EU-based customers, or payments denominated in euros may face simultaneous exposure under OFAC's secondary-risk authority and the EU's direct asset-freeze prohibition – with the two regimes tested independently and potentially leading to different conclusions on the same set of facts.

Where two regimes both apply, the stricter prohibition governs the conduct of a person subject to both. That is not arithmetic: a bank cannot net its OFAC and EU positions and take the midpoint. It must satisfy both. In our cross-border practice, the common failure point is a compliance programme designed around one regime's list and control architecture, without a structural mapping of where the other regime's rules produce a different answer on the same transaction.

The UK's ownership-and-control test further diverges from OFAC's mechanical fifty-percent rule. OFAC's 50 percent rule (the rule treating entities owned 50 percent or more in the aggregate by blocked persons as themselves blocked) is binary at the threshold. OFSI and the EU apply a control test that can capture a non-listed entity where a designated person exerts actual control, even below the fifty-percent line. A foreign bank's counterparty screening must account for both tests or it will produce false negatives.

Where screening programmes fail: the gap between name matching and sanctions risk management

The most persistent myth in non-domestic bank compliance is that name screening alone is sufficient to manage OFAC exposure. It is not. Screening is one layer of a required control architecture, and it addresses only the most direct form of exposure: a direct counterparty on the SDN List. Secondary sanctions exposure arises from a different pattern – transactions connected to sanctioned activity, sectors, or geographies, mediated through layers of counterparties none of whom may themselves be named.

In our experience advising financial institutions, screening gaps that surface only after a breach typically share a common structure. The bank screens its direct counterparty at onboarding and perhaps at periodic review. It does not screen transaction-level beneficiaries in real time. It does not assess ownership chains beyond the first legal owner. It applies a single-regime list without mapping whether the EU control test or the UK ownership-and-control test produces a different answer. And it treats a clean hit-rate as evidence of programme adequacy.

None of those practices, individually or together, constitutes a complete control. OFAC's Enforcement Guidelines make clear that the adequacy of a compliance programme is evaluated as part of the aggravating and mitigating circumstances assessment. A bank that cannot demonstrate a systematic, documented approach to secondary-risk identification will be treated differently from one that can.

The practical consequences of this gap are asymmetric. Correspondent-account restrictions imposed by a US clearing bank in response to OFAC pressure can take effect rapidly, with little procedural recourse for the foreign bank. The bank is not the subject of a formal designation proceeding. It is the subject of a commercial decision by a US-regulated entity that cannot afford its own OFAC exposure. Restoring the relationship requires persuading the US bank that the foreign bank's compliance controls are adequate – a task that requires documentary evidence, not representations.

The position above covers the standard case. Your facts – the correspondent relationships, the customer sectors, the clearing currencies, the geographies of your transaction book – change the analysis materially. For an assessment of your secondary sanctions exposure under OFAC, contact Calder & Vance at info@caldervance.com.

When secondary sanctions exposure becomes a correspondent-banking crisis

A foreign bank that has already received a notification from its US correspondent – a restriction, a notice of conditional continuation, or a request for enhanced documentation – is in a different position from one conducting a precautionary review. The options narrow with time.

In a recent matter, a regional bank received notification from its primary US dollar clearing institution that the relationship was under review following a transaction-monitoring alert. The issue centred on a cluster of payments to counterparties with indirect links to a sector subject to US secondary-risk measures. We scoped the apparent exposure under the applicable regime, assessed the coverage of the bank's existing screening and control architecture, prepared a documented compliance assessment for submission to the clearing institution, and worked with local counsel to address the EU-parallel position. The matter reached a defined outcome without escalation to a formal OFAC proceeding.

That pattern is not unusual. But it depends on early action. A bank that delays investigation, fails to preserve transaction records, or cannot produce contemporaneous evidence of its control operation will face a more constrained set of options. OFAC requires that sanctions records be kept for five years, as currently in force, verify before reliance. A bank that cannot produce transaction-level records for the period under review is in a materially weaker position in any dialogue with either OFAC or a clearing institution.

If a transaction has already been flagged, or a correspondent relationship is at risk, an early review can preserve options that narrow with time. For a confidential review of your position, contact us at info@caldervance.com.

How Calder & Vance assesses and manages secondary sanctions exposure for non-domestic banks

We advise non-domestic banks at two points in the exposure cycle: before a problem crystallises, as a precautionary programme review, and after a triggering event, as an urgent compliance and response matter. The work is different in each case, but the analytical foundation is the same.

For precautionary engagements, we test the screening logic against the OFAC secondary-risk standard rather than only the SDN match rate; map ownership and control across OFAC, OFSI, and EU tests for the bank's key counterparty populations; and redesign control architecture where the existing programme has identifiable gaps. We document the review to produce evidence of good-faith compliance effort – the kind of contemporaneous record that matters in any subsequent OFAC or enforcement dialogue.

For response engagements, we scope the apparent exposure under the applicable regime, advise on whether voluntary self-disclosure is appropriate and how to structure it, and prepare the penalty or correspondence defence. Where the matter involves a UK or EU parallel position, we co-ordinate the positions rather than addressing them in sequence. We act for multinationals, financial institutions, and exporters on sanctions and export-control matters across the major regimes. That cross-regime coverage is the structural advantage in a secondary sanctions matter, where the US, UK, and EU analyses must run together.

We operate on transparent fixed-fee entry points for defined scopes, including initial exposure assessments and programme reviews. For complex or time-critical matters, we offer rapid engagement.

Related practices

• Affiliate-level restrictions under BIS and the EAR – understanding how export-control restrictions can reach related entities
• Sham transaction indicators under OFAC – identifying red flags that suggest a transaction is not what it appears

This publication is general information and does not constitute legal advice. For advice on your situation, contact info@caldervance.com.