OFAC Penalties Explained: Fines and Enforcement

OFAC penalties are one of the few compliance risks that can move a company's balance sheet in a single line item. The Office of Foreign Assets Control, the US Treasury bureau that administers economic sanctions, can fine a company hundreds of thousands of dollars per violation — and it doesn't need to prove the company knew it was breaking the rules. That last point trips up more businesses than any other feature of the regime, so it's worth understanding properly before you assume "we didn't know" is a defence.

Key takeaways

• OFAC's civil penalty regime is strict liability: a violation can occur, and be fined, even without knowledge or intent.
• The statutory maximum civil penalty under IEEPA is periodically adjusted for inflation and is currently the greater of $377,700 per violation or twice the value of the underlying transaction.
• Actual settlements are usually far below the statutory maximum, because OFAC applies published Enforcement Guidelines that weigh aggravating and mitigating factors.
• Voluntary self-disclosure is the single biggest lever a company has to reduce a penalty — often cutting the base amount roughly in half before other factors are applied.
• Real settlements range from tens of thousands of dollars for a small, self-disclosed slip to well over $200 million for egregious, undisclosed conduct.

How OFAC actually calculates a penalty cap

Most OFAC sanctions programmes are enforced under the International Emergency Economic Powers Act (IEEPA), and IEEPA sets the outer boundary on what OFAC can fine per violation. That statutory maximum is the greater of a fixed dollar figure or twice the value of the transaction at issue, and the fixed figure is adjusted every year for inflation under the Federal Civil Penalties Inflation Adjustment Act. As of the most recent adjustment, the IEEPA maximum sits at $377,700 per violation, or twice the transaction value if that's larger — so a single sanctioned transfer worth several million dollars can carry an exposure far above the flat-rate figure.

It's important to separate this statutory ceiling from what OFAC actually collects. The ceiling defines the largest number OFAC is legally permitted to impose per violation; the real settlement figure is calculated using OFAC's own published methodology, which starts from a "base penalty" tied to the transaction value and the egregiousness of the conduct, then adjusts up or down for the factors described below. In practice, most settled cases land well under the statutory maximum — often by a wide margin — precisely because the guidelines reward cooperation and a functioning compliance programme.

Can a company be fined for an OFAC violation it didn't know about?

Yes. This is the part of the regime that surprises people who assume fines require some kind of wrongdoing. OFAC's own guidance is explicit that its civil penalty authority is strict liability: a person or company can be held liable for a violation even without knowledge that the underlying transaction was prohibited. Ignorance of a counterparty's sanctioned status, or of the fact that a shipment ultimately touched a blocked jurisdiction, doesn't prevent a violation from existing — it only affects how OFAC responds once one is found.

That distinction — liability versus penalty severity — is the crux of the whole system. Lack of knowledge, reasonable diligence performed beforehand, and a documented sanctions compliance programme all weigh heavily in OFAC's favour when it decides how hard to come down on a given case. A company that unknowingly processes a single prohibited transaction despite screening its counterparties in good faith is treated very differently from one that turned a blind eye to obvious red flags.

A worked example: the freight forwarder that didn't check closely enough

Picture a mid-sized freight forwarder that arranges a shipment of industrial parts on behalf of a longstanding customer. The immediate counterparty isn't sanctioned, but three steps down the supply chain, the ultimate consignee turns out to be a company more than 50% owned by a party on the SDN list — a detail that a name-only check against the counterparty on the invoice would never surface. The freight forwarder had no reason to suspect anything and ran basic due diligence, but the shipment still constitutes a prohibited transaction the moment it's processed. Under strict liability, that's a violation regardless of intent. What determines the outcome from here — a warning letter, a modest settlement, or a seven-figure fine — is everything that happens next: whether the company catches it itself and self-discloses, how quickly it remediates, and how robust its screening process was in the first place. This scenario is illustrative, not a real case, but it mirrors the fact pattern behind several actual freight-forwarder settlements OFAC has published.

What OFAC weighs when setting the actual penalty

OFAC's Economic Sanctions Enforcement Guidelines, published at 31 CFR Part 501, Appendix A, set out eleven "General Factors" used to decide both whether a case is egregious and how the final number should move up or down from the base penalty. The two factors OFAC says it gives the most weight are what the Guidelines call "willful or reckless violation of law" and "awareness of conduct at issue" — in other words, did the company mean to do it, and how much did it know or have reason to know. The other factors cover things like harm to the sanctions programme's objectives, the size and sophistication of the company, the quality of its compliance programme, its remedial response, and its cooperation with OFAC's investigation.

Why voluntary self-disclosure matters so much

Of every factor in the table above, voluntary self-disclosure (VSD) has the most direct, quantifiable effect. Under OFAC's methodology, a qualifying VSD generally reduces the base penalty by half before any other adjustment is applied, and it's frequently the difference between an eye-watering settlement and a fraction of it. The Guidelines describe VSD as a factor OFAC gives "significant weight" to, on the theory that a company that comes forward voluntarily is doing exactly what the enforcement regime is designed to encourage.

Two real settlements show the range this produces. In July 2025, Interactive Brokers LLC agreed to pay $11,832,136 to resolve 12,367 apparent violations spanning sanctions on Iran, Cuba, Syria, Crimea, Russia and Venezuela, plus Chinese military-industrial complex restrictions, arising between 2016 and 2024. Despite the very large number of individual violations, OFAC's own published notice describes the case as non-egregious, and the company's voluntary self-disclosure and substantial cooperation reduced the outcome to a small fraction of its potential exposure. By contrast, in a separate December 2024 action, Córdoba Music Group LLC — a much smaller company — settled apparent Iran-related sanctions violations for just $41,591 after discovering the issue internally and self-disclosing, a figure OFAC's notice describes as dramatically below the applicable statutory maximum for that case. Both details are drawn from OFAC's published enforcement notices, not estimates.

Is a settlement the same as an admission of guilt?

Not quite. Most published OFAC settlements resolve "apparent violations" without OFAC making a formal finding that the underlying conduct was, legally, a violation — and settlement agreements typically say so explicitly. That's a deliberate feature of the process: it lets both sides resolve a matter without years of litigation over liability, while still producing a public, dollar-denominated consequence and a factual account of what happened that other companies can learn from. OFAC publishes a summary of the conduct, the applicable programme, and the factors it weighed for every settled case on its Civil Penalties and Enforcement Information page and its running Recent Actions feed, which is worth monitoring if your business operates in a sanctions-exposed sector.

What this means for day-to-day screening

The practical lesson isn't that fines are unavoidable — it's that the size of a fine is largely within a company's control long before OFAC ever gets involved. A documented, risk-based screening process, applied consistently and re-run as lists update, is the single factor that shows up across nearly every published Enforcement Guideline case as evidence of good faith. It's also the factor most within reach: screening a counterparty against the OFAC SDN list and the Consolidated list doesn't require expensive infrastructure, and understanding who actually needs to screen and how to run a proper check closes most of the gap between "we had no idea" and "we had a programme and it worked as intended." You can screen a name for free right now and see exactly how a match is scored and cited.

The bottom line

OFAC penalties aren't calculated on a single fixed scale — they move between a statutory ceiling that runs into hundreds of thousands of dollars per violation and settlements that, in practice, can be a fraction of a percent of that maximum. What decides where a given case lands is almost entirely the factors a company controls before a violation ever happens: whether it had a working compliance programme, whether it caught the issue itself, and whether it came forward. Building that habit starts with routine screening — try it on the next counterparty you're unsure about at Screen100's free screening tool.