OFAC Sanctions: The Money Screen and Sanctions as the New FCPA

Educational only; not legal advice. SPP explains diligence issue-spotting, evidence collection, risk triage, and the accountant and certified-fraud-examiner workflow. It does not give sanctions legal opinions, licensing advice, export classifications, or filing advice. Regulatory status is current as of drafting (2026-06-15); see the status note at the end.

A buyer can close a clean-looking deal and still buy a sanctions problem. The target’s products may be ordinary, the customers may be commercial, and the seller’s compliance certificate may say all the words a purchase agreement is supposed to say. The trouble is not always on the face of the counterparty list. It can sit one layer down, in an owner who is not listed but is owned by a listed person, in a payment that touches the United States financial system, in a supplier whose cargo is cheaper than the market can explain, or in a legacy subsidiary whose sales team learned to route around red flags before the buyer ever arrived.

This is why sanctions has started to feel, in deal work, like the new Foreign Corrupt Practices Act (FCPA). Not because the statutes are the same. They are not. The FCPA is an anti-bribery and accounting-controls law. Sanctions are a national-security and foreign-policy system built around blocked property, prohibited transactions, licenses, civil penalties, and, where the conduct is willful, criminal prosecution. The analogy is practical, not doctrinal. A generation ago, serious buyers learned that anti-corruption diligence was not a boutique legal issue to be left until the night before signing. It was a buy-side money question: who paid whom, why, through which intermediary, in which jurisdiction, and what happens if the answer was hidden. Sanctions now demands the same treatment.

The Office of Foreign Assets Control (OFAC), a Treasury office inside the Office of Terrorism and Financial Intelligence, is the center of the civil system. It administers and enforces economic and trade sanctions programs that can be comprehensive or selective, using asset blocking and trade restrictions to advance foreign-policy and national-security goals. The Department of Justice (DOJ), especially its National Security Division (NSD), is the criminal counterpart when the facts move from apparent civil violation to willful conduct, concealment, conspiracy, false statements, money laundering, or export-control overlap. The Bureau of Industry and Security (BIS), Homeland Security Investigations (HSI), Customs and Border Protection (CBP), bank regulators, and United States Attorneys can all show up depending on the facts. A deal team that treats sanctions as one database search is not running diligence. It is checking whether the easiest part of the problem is visible.

The money screen asks a more concrete question: could this target, fund, customer, supplier, cargo, payment route, or owner cause the buyer to deal in blocked property, provide services to a sanctioned jurisdiction, cause a United States person to violate sanctions, or inherit a remediation and disclosure problem after closing? A certified public accountant (CPA) or certified fraud examiner (CFE) is not rendering a sanctions opinion. The skill is narrower and more valuable: trace the money, trace the ownership, preserve the source for each conclusion, and know when the fact pattern must go to sanctions counsel before the deal documents harden around a false assumption.

What sanctions were built to solve

Start with the problem, because it explains why this regime behaves differently from ordinary commercial compliance. Sanctions are not merely a list of bad names. They are a financial-control architecture. The United States uses them to block property and restrict transactions tied to foreign governments, regimes, persons, entities, sectors, and conduct that the government has determined to implicate national security, foreign policy, or the economy of the United States. OFAC’s own description is spare: the office administers and enforces sanctions programs primarily against countries and groups of individuals, and those sanctions can use blocked assets and trade restrictions to achieve national-security and foreign-policy objectives.

The modern engine is the International Emergency Economic Powers Act (IEEPA), codified at 50 U.S.C. 1701 to 1708. Section 1701 lets the President exercise the authorities in Section 1702 to deal with an unusual and extraordinary threat that has its source in whole or substantial part outside the United States, if the President declares a national emergency with respect to that threat. Section 1702 is the operating lever: it is the authority used, through executive orders and implementing regulations, to regulate, prohibit, investigate, block, and otherwise control transactions and property interests that come within the statute’s reach. Older sanctions programs can also rest on the Trading with the Enemy Act (TWEA), especially Cuba. Many program-specific statutes add their own instructions and mandates. For a diligence team, the exact program matters, but the working posture is constant: read the executive order, read the Code of Federal Regulations (CFR) part for that program, and do not assume that a clean name search answers a property question.

That property question is the reason sanctions diligence belongs in buy-side work. If property is blocked, the United States person who holds or controls it generally does not get to move it, pay it, sell it, transfer it, or paper over it while the business team sorts out commercial consequences. A blocked party is not just a bad counterparty. It can be a stop sign attached to funds, receivables, inventory, debt, equity, collateral, vessels, accounts, or rights. In a transaction, that means sanctions can reach the purchase price, an escrow, a seller note, a supply agreement, a customer receivable, or the enterprise value itself.

The other reason sanctions belongs at the front of diligence is strict civil liability. The 2024 tri-agency compliance note from Commerce, Treasury, and DOJ states the point bluntly: OFAC may impose civil penalties based on strict liability, which means a person subject to United States jurisdiction may be held civilly liable even without knowing or having reason to know that the transaction was prohibited. That does not mean knowledge is irrelevant. OFAC’s enforcement guidelines give weight to willfulness, awareness, concealment, compliance program quality, remediation, cooperation, harm to sanctions objectives, and the subject person’s size and sophistication. But it does mean that “we did not know” is not a jurisdictional escape hatch. It is a factor, not an answer.

The FCPA analogy becomes useful here. A corruption screen asks whether money moved through an agent, consultant, distributor, or state-linked counterparty in a way that could conceal an improper payment. A sanctions screen asks whether money, goods, technology, services, or ownership moved through a person, place, bank, vessel, wallet, or entity chain that could be blocked or prohibited. In both screens, the legal conclusion belongs to counsel. The diligence conclusion belongs to the evidence file: here is the ownership chart; here are the payment rails; here are the red flags; here is what the public list search proves; here is what it does not prove; here is the escalation path.

Who runs, investigates, and enforces the sanctions screen

OFAC is the civil administrator. It writes and maintains the program regulations in Title 31, Chapter V of the CFR; publishes the Specially Designated Nationals and Blocked Persons List (SDN List) and other sanctions lists; issues general and specific licenses; receives blocked-property and rejected-transaction reports; processes voluntary self-disclosures; and resolves civil matters through no-action responses, cautionary letters, findings of violation, civil penalties, and settlements. Its civil-penalty framework is Appendix A to 31 CFR Part 501, the Economic Sanctions Enforcement Guidelines.

The institutional point is that OFAC is not only a list publisher. Its enforcement guidance is a decision system. Appendix A defines an apparent violation, defines voluntary self-disclosure, lists the general factors OFAC considers, describes the civil penalty process, and gives the base penalty logic for egregious and non-egregious cases with and without voluntary self-disclosure. The framework asks the same questions a good diligence file asks: was the conduct willful or reckless; did the person know or have reason to know; how much harm did it cause to sanctions program objectives; how large and sophisticated was the person; what was the compliance program; what did the person do after discovery; and how much cooperation did the person provide?

The DOJ enters when the conduct is criminal or potentially criminal. In March 2026, the Department released a department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy (CEP) for corporate criminal matters. Later that month, DOJ issued specific guidance for national-security-law disclosures under that policy. The guidance identifies sanctions and export-control regimes, including IEEPA, as core national-security-law matters handled by NSD. It also tells companies to send voluntary self-disclosures concerning potential criminal violations of national-security laws to NSD. The policy architecture matters to buyers because it treats post-closing discovery as a governance event, not only a regulatory filing. If a buyer finds a target’s sanctions problem after closing, the question is no longer just whether to disclose to OFAC. It may also be whether the facts belong with NSD, whether the disclosure is voluntary and timely, whether remediation is real, and whether any aggravating facts defeat the presumption of a declination.

The White Deer and Unicat matter shows the machinery in the setting this series cares about: acquisition diligence and post-closing remediation. On June 16, 2025, DOJ announced that NSD and the United States Attorney’s Office for the Southern District of Texas declined prosecution of private equity firm White Deer after it discovered and voluntarily self-disclosed criminal sanctions and export-law violations committed by an acquired company, Unicat Catalyst Technologies. DOJ said Unicat’s former chief executive officer pleaded guilty in 2024 to conspiring to violate sanctions and related offenses; the release described 23 unlawful sales of chemical catalysts to customers in Iran, Venezuela, and Cuba, about 3,330,000 dollars in revenue from unlawful sales, and false statements in export and financial records. The same release said Unicat agreed to pay OFAC 3,882,797 dollars for apparent sanctions violations, BIS 391,183 dollars for export-control violations, and CBP 1,655,189.57 dollars for underpaid duties, taxes, and fees. That is not a law-firm hypothetical. It is DOJ using a sanctions and export-control acquisition case to show what it expects from an acquirer that finds old misconduct.

Investigations can therefore come from several directions. A blocked or rejected payment may surface at a bank and be reported. OFAC may issue an administrative subpoena. A public designation can make yesterday’s counterparty today’s blocked property. A whistleblower, competitor, customs examiner, HSI agent, bank monitor, or internal audit can create the first record the government sees. In the Adani Enterprises Limited settlement announced by OFAC on May 18, 2026, the origin of the problem was not a listed-name hit. OFAC described red flags around Iranian-origin liquified petroleum gas (LPG), suspicious vessel activity, implausible pricing, documents that should have prompted deeper inquiry, and United States dollar payments processed through United States financial institutions. The settlement was civil and described apparent violations, not criminal findings. But the facts are a clean reminder that the money screen is not only a name screen.

What changed from 2024 to 2026

The “new FCPA” label is not SPP branding alone. In March 2023, Deputy Attorney General Lisa Monaco used that phrase in American Bar Association remarks while announcing a national-security corporate-enforcement surge: more than 25 additional prosecutors for sanctions evasion, export-control violations, and similar economic crimes, plus the National Security Division’s first Chief Counsel for Corporate Enforcement. The lesson for diligence is not that sanctions and the Foreign Corrupt Practices Act are doctrinal twins. The lesson is that DOJ wanted boards, acquirers, and compliance leaders to treat sanctions as a board-level corporate-enforcement risk.

For a buyer, the most important 2024 to 2026 change is that sanctions exposure now has a longer tail. On April 24, 2024, the President signed the 21st Century Peace through Strength Act. Section 3111 extended the statute of limitations for civil and criminal violations of IEEPA and TWEA from five years to 10 years. OFAC issued guidance on July 22, 2024, explaining that the new 10-year period is codified at 50 U.S.C. 1705(d) and 50 U.S.C. 4315(d), became effective on April 24, 2024, and applies to violations that were not already time-barred on that date. OFAC then adopted a final rule effective March 21, 2025, extending certain recordkeeping requirements in 31 CFR 501.601 and related provisions from five years to 10 years.

That one change rewrites acquisition diligence. A five-year lookback was already uncomfortable. A 10-year lookback reaches across ownership changes, old enterprise-resource-planning migrations, decommissioned bank accounts, missing employees, and pre-acquisition periods that a seller may barely remember. It is not realistic to review every invoice in a decade of operations before signing every middle-market deal. It is realistic to build a risk-based lookback: high-risk jurisdictions, high-risk product lines, United States dollar payments, freight forwarders, distributors, resellers, vessels, beneficial owners, legacy subsidiaries, and any counterparties connected to Russia, Iran, North Korea, Cuba, Syria, Venezuela, sanctioned regions, terrorism, narcotics, proliferation, cyber, corruption, or human-rights programs. The statute-of-limitations change does not require every diligence project to become an investigation. It does require the buyer to stop pretending that a two-year sample is enough when the source facts say otherwise.

The second change is the public enforcement signal. OFAC’s civil-penalties page, checked on June 15, 2026, showed five 2026 penalty, settlement, or finding-of-violation entries through June 1, 2026, totaling 282,657,661 dollars. One entry, Adani Enterprises Limited, accounts for 275,000,000 dollars of that total. OFAC described the Adani apparent violations as egregious and not voluntarily self-disclosed. It said 32 United States dollar payments totaling about 192,104,044 dollars were processed by United States financial institutions for shipments of Iranian-origin LPG, and it treated the company’s response, cooperation, and remedial measures as mitigation. The case is useful not because every buyer is an energy importer. It is useful because the pattern is portable: a discount too good for the market, a supplier story that depends on paperwork without corroboration, vessel behavior that does not fit the claimed origin, and a payment route that turns foreign conduct into a United States sanctions problem.

The third change is DOJ’s corporate-policy consolidation. The March 2026 department-wide CEP now applies across corporate criminal matters, with NSD guidance telling companies how national-security disclosures fit inside it. The policy says the Department will decline to prosecute a company when the company voluntarily self-discloses to an appropriate Department criminal component, fully cooperates, timely and appropriately remediates, and lacks aggravating circumstances. It also states that declinations require payment of disgorgement or forfeiture, restitution, and victim compensation resulting from the misconduct. The point for diligence is not that a buyer can count on a declination. It cannot. The point is that DOJ has made the disclosure, cooperation, remediation, and disgorgement sequence part of the acquisition-risk calculus.

The fourth change is less dramatic but more operational: sanctions list and program updates are now simply part of the weather. OFAC’s active sanctions programs page showed multiple program updates in 2026, including Russia-related, Iran, counter-terrorism, Burma, Global Magnitsky, and other programs. The Sanctions List Search tool itself states that it is a tool to assist users and not a substitute for appropriate due diligence. On June 15, 2026, the tool displayed the SDN List as last updated June 11, 2026. A diligence file built from yesterday’s export of a screening database is already a historical artifact. For a live closing, the final screen needs to run close to signing and again close to funding, and the file needs to record the search date, list source, matching logic, and how false positives were cleared.

Put those four changes together and the 2026 sanctions screen becomes sharper. The lookback is longer. The penalties page is active and current. DOJ has a live national-security corporate enforcement policy. OFAC list and program changes are frequent enough that stale screening is no longer an administrative nuisance. It is a diligence defect.

What trips the wire

Sanctions triggers in a deal fall into four practical buckets: the listed party, the owned party, the prohibited place or sector, and the payment or service that causes a United States nexus.

The listed party is the one everyone knows. A customer, supplier, beneficial owner, bank, vessel, aircraft, wallet, officer, director, or other counterparty appears on the SDN List or another OFAC list in a way that creates a prohibition. The screening problem here is not trivial. Names transliterate. Entities use aliases. Vessels change names, owners, flags, and management. OFAC’s own Sanctions List Search uses approximate string matching and program codes, and OFAC warns that users should pay attention to the program codes because they indicate how a true hit should be treated. A search result is a lead until resolved. It becomes a finding only after the team compares identifiers, program codes, ownership, geography, dates, and source records.

The owned party is the sanctions issue that deal teams miss most often. OFAC’s 50 Percent Rule says that an entity owned 50 percent or more, directly or indirectly, in the aggregate by one or more blocked persons is itself considered blocked, even if the entity is not named on the SDN List. The word “aggregate” is doing the work. If two blocked persons each own 25 percent of the entity, the entity is blocked. If ownership runs through entities that are themselves blocked because the blocked person owns them 50 percent or more, the indirect interest can block the downstream entity. OFAC’s FAQ 401 gives examples showing how the chain works. OFAC’s FAQ 398 adds the counterpoint: control alone, without 50 percent or greater ownership, does not automatically block an entity under the 50 Percent Rule, although OFAC can designate controlled entities under available criteria and urges caution where a blocked person has a significant minority interest or practical control.

That distinction is exactly where a CPA or CFE can add value. Sanctions counsel answers the legal question. The diligence team builds the ownership evidence. Who owns each layer; on what date; through which share class; with what voting rights; with what options, warrants, pledges, trusts, side letters, nominee arrangements, or undisclosed beneficial ownership? The 50 Percent Rule is formal enough to calculate, but only if the data is real. A vendor master that says “no SDN hit” proves very little if the diligence team never obtained the ownership chart.

The prohibited place or sector is the third trigger. Some programs are comprehensive or near-comprehensive. Others are sectoral, conduct-based, or targeted. The answer depends on the program. A transaction with a person located in a comprehensively sanctioned jurisdiction can raise a different issue from a transaction with a non-listed person in a country where only certain sectors, securities, services, debt, equity, vessels, commodities, or government entities are restricted. Program codes and legal authorities matter. A buyer cannot resolve those differences from a generic “sanctions clear” stamp. The file needs to say which list and program were checked, whether the counterparty or transaction touched a sanctioned jurisdiction or sector, and whether counsel reviewed any program-specific restriction.

The United States nexus is the fourth trigger, and it is the one that turns foreign commercial activity into a United States issue. The 2024 tri-agency compliance note states that United States sanctions laws apply to United States citizens and permanent residents wherever located, persons within the United States, United States-incorporated entities and their foreign branches, and, in certain programs, foreign entities owned or controlled by United States persons. It also states that non-United States persons can be subject to certain prohibitions, including causing or conspiring to cause United States persons to violate sanctions or engaging in conduct that evades sanctions. OFAC’s framework identifies use of the United States financial system, often through United States dollar payments, as a common root cause of apparent violations by non-United States persons. This is why the payment file matters. The buyer needs to know not only who sold the goods, but which banks cleared the money, in what currency, with what message fields, through which correspondents, and whether any payment was blocked, rejected, returned, stripped, rerouted, or explained away.

None of these triggers lives neatly in a legal folder. They live in accounts receivable, accounts payable, bank statements, customer files, beneficial-ownership records, shipping documents, enterprise-resource-planning exports, compliance tickets, blocked-payment notices, licenses, email approvals, distributor contracts, and board minutes. That is why sanctions diligence is accounting work before it is legal advice.

What the government can do

The first remedy is blocking. If property or an interest in property is blocked, the holder generally freezes it and reports it. The commercial consequence can be immediate: a payment stops, a shipment stalls, an escrow cannot release, a receivable cannot be collected, and the target’s apparent working capital is no longer fully usable. Blocking is not a penalty in the ordinary sense. It is the operating effect of the sanctions program.

The second remedy is licensing. OFAC may authorize otherwise prohibited transactions by general license or specific license. A general license is published and available to anyone who fits its terms. A specific license is issued to a named applicant for a specific transaction or set of transactions. In a deal, licensing questions belong to sanctions counsel. The diligence role is to identify whether the target has used licenses, whether it complied with their conditions, whether any pending license application is material to operations, and whether a transaction assumes a license that has not been granted.

The third remedy is civil enforcement. Appendix A to 31 CFR Part 501 gives OFAC a range of administrative responses, including no action, a request for additional information, a cautionary letter, a finding of violation, a civil monetary penalty, referral for criminal investigation or prosecution, and other administrative measures. If OFAC believes a civil penalty is appropriate, it issues a pre-penalty notice. The subject person may respond. A penalty notice is a final agency action and creates a debt owed to the government.

The amount can be large. Under IEEPA, the statute states a civil maximum of the greater of 250,000 dollars or twice the amount of the transaction. The eCFR version of Appendix A, updated for inflation, lists the current IEEPA maximum as the greater of 377,700 dollars or twice the amount of the underlying transaction. Willful criminal violations under IEEPA can be punished by a fine of not more than 1,000,000 dollars and, for a natural person, imprisonment of not more than 20 years. Do not mix these up. Civil strict liability and criminal willfulness are different tracks. A diligence memo should not imply a crime where the official record says “apparent violations” and a civil settlement.

The fourth remedy is a disclosure and remediation pathway. OFAC treats a qualifying voluntary self-disclosure as a mitigating factor, and Appendix A gives different base-penalty calculations depending on whether the case is egregious or non-egregious and whether the apparent violation was voluntarily self-disclosed. The July 2023 tri-seal compliance note states that a qualifying OFAC voluntary self-disclosure can result in a 50 percent reduction in the base amount of a proposed civil penalty. But the definition is technical. A disclosure may fail if the apparent violation was already reported by a third party, if the disclosure is false or misleading, materially incomplete, not self-initiated, or made without senior-management authorization.

The fifth remedy is criminal enforcement. The White Deer and Unicat matter is useful because it shows the deal-side fork. DOJ declined to prosecute the acquirer, while entering a non-prosecution agreement with the acquired entity and pursuing the former chief executive. That is not a free pass. It is a policy outcome tied to discovery, prompt disclosure, cooperation, remediation, accountability, and payment. The article’s “new FCPA” thesis lives here. Sanctions has acquired the same boardroom logic anti-corruption already had: find the issue early, stop the conduct, preserve the evidence, disclose where appropriate, remediate the control failure, and make individual accountability possible.

The sixth remedy is forfeiture or disgorgement. This piece is not the forfeiture article, and sanctions should not be collapsed into forfeiture. Still, sanctions cases can involve blocked property, criminal proceeds, money judgments, forfeiture, disgorgement, or crediting across parallel resolutions. DOJ’s current CEP states that a declination under the policy requires payment of disgorgement or forfeiture, plus restitution or victim compensation resulting from the misconduct. For a buyer, this means a sanctions issue can become a purchase-price issue, a working-capital issue, an indemnity issue, or a valuation issue long before anyone uses the word penalty.

What a buyer asks for

The sanctions request list should not start with “provide sanctions compliance policy.” That document matters, but it is not evidence by itself. The first ask is the counterparty population. The buyer should request complete customer, supplier, distributor, agent, reseller, broker, freight forwarder, bank, lender, investor, owner, officer, director, vessel, aircraft, and other relevant counterparty lists for the review period, with legal names, aliases, addresses, country fields, tax or registration identifiers where available, bank details where relevant, and date ranges of activity. If the review period is risk-based rather than full 10-year coverage, say why.

The second ask is ownership. For the seller, the target, major counterparties, high-risk customers and suppliers, and any entity that touches sanctioned jurisdictions or sensitive sectors, the buyer needs ownership charts traced to ultimate beneficial owners. The chart should show percentages, dates, indirect chains, control rights, and any documents supporting the ownership. The 50 Percent Rule makes this a mathematical exercise only after the evidence is collected.

The third ask is payment flow. A sanctions issue often becomes visible in bank data before it becomes visible in a contract. The buyer should obtain bank-account lists, payment processors, correspondent-bank information where available, United States dollar payment volumes, blocked and rejected payment notices, returned wires, payment-message repair logs, and any payment instructions involving third-party payors or payees. For higher-risk businesses, the team should sample invoices against bank records and shipping documents, not just against the customer master.

The fourth ask is geography and goods. Sales by country, ship-to and bill-to addresses, place of performance, end users, intermediaries, product descriptions, harmonized tariff codes if available, export classifications where the target has them, and freight records all help separate a simple name screen from a transaction screen. This is where B1 hands off to B2. Sanctions tells you who and where you may not deal with. Export controls tell you what technology, software, goods, or services may require a license and who may not receive them. The same invoice can implicate both.

The fifth ask is historical government contact. The buyer should request OFAC submissions, voluntary self-disclosures, subpoenas, administrative requests, cautionary letters, findings of violation, pre-penalty notices, penalty notices, settlement agreements, licenses, license applications, blocked-property reports, rejected-transaction reports, communications with banks about OFAC hits, BIS voluntary self-disclosures, DOJ subpoenas, HSI interviews, CBP seizures or inquiries, and board or audit-committee materials relating to sanctions. If the seller says there are none, the representation should say that clearly.

The sixth ask is the compliance program as lived, not merely as written. OFAC’s framework names five essential components: management commitment, risk assessment, internal controls, testing and auditing, and training. The buyer should ask for evidence under each one. Who owns sanctions compliance. How risk assessments are performed. How screening lists update. How false positives are cleared. Who can override a hit. What systems generate exception reports. How often audits occur. What findings were remediated. Which employees are trained, and on what schedule. A sanctions policy that nobody tests is not a control; it is a PDF.

The seventh ask is the red-flag file. The Adani settlement is a good example of why this matters. OFAC did not describe a simple SDN hit. It described third-party warnings, suspicious maritime behavior, implausible origin and pricing, and reliance on documents and assurances that were not enough. A buyer should ask for escalations, hotline reports, whistleblower complaints, internal audit findings, compliance exceptions, blocked or rejected transactions, distributor concerns, and any unusual payment or shipping practice. The red flags are often already in the building. Diligence fails when nobody asks for the room where they were stored.

What belongs in the sanctions risk memo

The memo should be short, sourced, and divided into conclusions, not organized around the order in which documents arrived. Start with scope: review period, entities covered, systems reviewed, countries and business lines included, and known exclusions. If the review was limited, say so. If data was unavailable, say so. A sanctions memo that hides its own blind spots is worse than no memo, because it creates false comfort.

Next, state the list-screening result. This is not just “no hits.” It is the date of the screen, the source list or tool, the party population screened, the threshold or matching logic, the number of potential matches, and how they were resolved. If any true hit exists, the memo should stop pretending it is a normal diligence issue and escalate.

Then state the 50 Percent Rule result. For every high-risk entity where ownership was reviewed, the memo should identify the source documents, ownership percentages, indirect chains, date of the ownership evidence, and whether one or more blocked persons own 50 percent or more in the aggregate, directly or indirectly. If ownership is incomplete, the conclusion is not “clear.” The conclusion is “ownership unresolved,” and that is itself a risk.

Then state the transaction exposure. Which countries, regions, sectors, programs, goods, services, banks, currencies, vessels, end users, and intermediaries matter. Where United States persons participated. Where United States financial institutions processed payments. Whether any foreign subsidiary of a United States person was involved in a program where that matters. Whether any transaction appears to have caused a United States person to provide a prohibited service or process a prohibited payment. Each sentence should point to a source: bank records, invoices, bills of lading, contracts, screening output, OFAC guidance, CFR provisions, or official enforcement examples.

Then state the control assessment. Use OFAC’s five-component framework as the skeleton. Management commitment; risk assessment; internal controls; testing and auditing; training. The memo should distinguish design from operating effectiveness. A company may have a sanctions policy and still fail if the customer master is stale, the screening software misses non-Latin spellings, the escalation queue is ignored, the compliance officer lacks authority, or the audit function never tests payment messages.

Then state the disclosure and remediation posture. If the review found apparent violations, the memo should not decide the legal filing strategy, but it should tee up the decision. Was the conduct stopped. Has evidence been preserved. Who knew. Was management involved. Was there concealment. Were transactions blocked or rejected by a bank. Has any regulator already discovered the issue. Would an OFAC voluntary self-disclosure be self-initiated and complete. Is there potential criminal exposure that belongs with NSD. Does the DOJ CEP or acquisition-policy posture matter. What restitution, disgorgement, forfeiture, customer remediation, clawback, discipline, or control enhancement is already underway.

Finally, translate the finding into deal terms. Sanctions diligence should affect signing and closing conditions, representations, covenants, indemnities, escrows, purchase-price adjustments, insurance exclusions, transition-services agreements, and post-close integration. The buyer may need a special indemnity for legacy sanctions violations, a condition that no true sanctions hit exists at closing, a covenant to cooperate in disclosures, a holdback for potential penalties or disgorgement, a closing bringdown screen, a termination right if a high-risk counterparty proves blocked, and a post-close plan for screening, training, and controls integration.

When to escalate to counsel

Escalation is not failure. It is the point of the screen. A CPA or CFE should escalate when a party, owner, vessel, wallet, bank, or counterparty appears to be a true sanctions-list match; when an entity may be 50 percent or more owned, directly or indirectly, by one or more blocked persons; when a transaction touches a comprehensively sanctioned jurisdiction or a program-specific prohibition; when a United States person, United States bank, United States-origin good, or United States service appears to create a nexus; when blocked or rejected transactions appear in the bank file; when a seller has made or considered a voluntary self-disclosure; when there are subpoenas, pre-penalty notices, findings, licenses, or unresolved OFAC correspondence; when documents look falsified or payment messages appear stripped or rerouted; when management appears to have ignored red flags; and whenever potential criminal conduct, concealment, money laundering, export-control overlap, or individual accountability is plausible.

The escalation should be written. It should say what was found, what source supports it, what is unknown, what immediate preservation step is needed, what business activity may need to stop, and which decisions belong to sanctions counsel. It should not say the target violated sanctions unless counsel has reached that conclusion or the government record already says so. The language matters. “Potential apparent violation,” “red flag,” “unresolved ownership,” “possible blocked-property issue,” and “requires sanctions counsel review” are different from “violation.” The former are diligence findings. The latter is a legal conclusion.

This is the same discipline fraud examiners use in every other context. A fraud examiner does not call a theft because a ledger looks strange. The examiner identifies the irregularity, preserves the records, traces the funds, tests alternative explanations, and escalates when the evidence requires it. Sanctions work is the same posture applied to national-security finance.

Practitioner Skill Built By This Article

The skill this article builds is the ability to run a sanctions ownership and payment-flow screen and reduce the result to a defensible deal memo.

What you can now recognize: listed-party hits, 50 Percent Rule ownership problems, sanctions-jurisdiction touchpoints, United States dollar and United States-person nexus, voluntary self-disclosure triggers, and the difference between a civil apparent violation and a criminal allegation.
What source you verify it against: IEEPA at 50 U.S.C. 1701, 1702, and 1705; OFAC program regulations in 31 CFR Chapter V; Appendix A to 31 CFR Part 501; OFAC’s 50 Percent Rule guidance and frequently asked questions (FAQs); OFAC’s Framework for Compliance Commitments; OFAC’s civil-penalties page; DOJ’s 2026 Corporate Enforcement and Voluntary Self-Disclosure Policy; and official DOJ or OFAC enforcement releases for examples.
What you can produce: the sanctions section of a diligence report, the ownership and payment-flow checklist below, and a post-close remediation and disclosure decision tree for counsel.
When you escalate: at any true or unresolved sanctions hit, any 50 Percent Rule issue, any blocked or rejected transaction, any potential United States nexus to prohibited conduct, any apparent violation, any possible criminal fact pattern, or any ownership chain you cannot verify from source documents.

The portable skill is not memorizing every sanctions program. No diligence team can do that from memory, and doing so would be reckless. The skill is building a sourced screen that starts with the live official lists and regulations, then moves through ownership, payment flows, geography, goods, services, controls, and red flags until the legal questions are isolated for counsel. In a deal, that is the difference between buying a company and buying the government’s next fact pattern.

The shipped artifact: OFAC money-screen checklist

Use this at intake on any deal with cross-border customers, suppliers, owners, lenders, cargo, payment processors, distributors, energy exposure, defense or dual-use overlap, sanctioned-region touchpoints, or United States dollar payment flows. It produces leads for the memo, not legal conclusions.

Party population

Compile customers, suppliers, distributors, agents, resellers, freight forwarders, banks, payment processors, lenders, investors, owners, officers, directors, vessels, aircraft, wallets, and high-risk employees.
Capture legal names, aliases, addresses, country fields, registration numbers, tax IDs, bank details, and active date ranges.
Record the source system and extraction date.

List screen

Screen against OFAC’s SDN List and relevant non-SDN lists using a documented source, date, and match threshold.
Preserve potential hits and false-positive resolutions.
Re-screen close to signing and close to funding.

50 Percent Rule ownership

Trace ownership to ultimate beneficial owners for the target and high-risk counterparties.
Aggregate direct and indirect ownership by blocked persons.
Treat unresolved ownership as unresolved, not clear.

Transaction and geography

Map sales, purchases, services, shipments, and payments by country, region, sector, customer, supplier, bank, and currency.
Identify comprehensively sanctioned jurisdiction exposure and program-specific sector exposure.
Flag United States-person, United States-bank, United States-origin, and United States-service touchpoints.

Payment-flow review

Review blocked or rejected transactions, returned wires, payment-message repairs, third-party payors or payees, non-standard routing, and changes in bank instructions.
Compare bank records to invoices, shipping documents, and customer records for high-risk samples.

Licenses and government contact

Obtain OFAC licenses, license applications, blocked-property reports, rejected-transaction reports, subpoenas, cautionary letters, findings, settlement agreements, voluntary self-disclosures, and related DOJ, BIS, HSI, or CBP contact.
Identify open obligations and deadlines.

Compliance program

Test management commitment, risk assessment, internal controls, testing and auditing, and training against OFAC’s framework.
Confirm list-update cadence, false-positive workflow, escalation authority, override controls, and audit findings.

Red flags

Look for prices that do not fit the market, implausible origin documents, unusual vessel behavior, affiliated intermediaries without a clear commercial role, sanctions allegations from third parties, stripped or vague payment messages, and management instructions to avoid written records.

Disclosure and remediation

If an apparent violation is plausible, stop the conduct, preserve evidence, notify counsel, identify who knew what and when, and assess OFAC and DOJ disclosure pathways.
Do not make a legal conclusion in the diligence memo.

Deal terms

Translate the finding into representations, covenants, closing bringdown screens, special indemnities, escrows, termination rights, purchase-price adjustments, and post-close controls integration.

Applied DD Lab: Replicate the Screen

The B1 lab exercise is deliberately synthetic. It does not screen a client, target, or actual counterparty. It teaches the 50 Percent Rule and the difference between a list hit and an ownership finding.

Dataset: a synthetic ownership table with entities, owners, percentages, dates, and a small synthetic sanctions-list file containing imaginary blocked persons. No real target, client, customer, supplier, or case data is used.
Diligence relevance: the exercise shows why a counterparty can be blocked even when its own name is absent from the SDN List. It also shows why control and ownership are not the same question under OFAC’s 50 Percent Rule.
Code execution: build a directed ownership graph; mark listed blocked persons; propagate blocked status through entities owned 50 percent or more, directly or indirectly, in the aggregate by blocked persons; output an exceptions table for entities that are not automatically blocked but have significant minority ownership or control red flags.
Sample output: entity name, direct blocked-owner percentage, indirect blocked-owner percentage, aggregate percentage, blocked under 50 Percent Rule yes or no, control red flag yes or no, source document ID, and escalation note.
What it can prove: whether the synthetic facts, if real and verified, would create a 50 Percent Rule lead that needs sanctions counsel.
What it cannot prove: that any real person or company is blocked, that a real ownership chart is accurate, that a license is available, or that a transaction is legal.

The lab guardrail is the same one used across this series. Code produces leads, not findings. Public or synthetic data only. Actual case data does not enter the lab unless it has been cleared through the separate public case-data matter and publication-clearance process. The B1 lab should be treated as a training tool for ownership reasoning, not as a sanctions opinion engine.

Terms used in this article

The full glossary lives in the section’s master glossary; the terms you need for this piece:

OFAC (Office of Foreign Assets Control): the Treasury office that administers and enforces United States economic and trade sanctions programs.
IEEPA (International Emergency Economic Powers Act): the emergency-powers statute, codified at 50 U.S.C. 1701 to 1708, that supplies the authority for many modern sanctions programs and penalties.
TWEA (Trading with the Enemy Act): an older sanctions statute, now most important in this context for Cuba-related sanctions and the 10-year statute-of-limitations change.
SDN List (Specially Designated Nationals and Blocked Persons List): OFAC’s list of persons whose property and interests in property are blocked.
50 Percent Rule: OFAC guidance under which an entity owned 50 percent or more, directly or indirectly, in the aggregate by one or more blocked persons is itself considered blocked, even if not separately listed.
Blocked property: property or interests in property that may not be transferred, paid, exported, withdrawn, or otherwise dealt in without authorization.
Voluntary self-disclosure (VSD): self-initiated notification to OFAC or DOJ of an apparent or potential violation, subject to agency-specific requirements and timing rules.
Sanctions compliance program (SCP): a risk-based compliance program built around management commitment, risk assessment, internal controls, testing and auditing, and training.
Apparent violation: conduct that constitutes an actual or possible violation of sanctions law, regulation, order, license, or other OFAC-administered authority.
United States nexus: the fact that brings a transaction within United States sanctions concern, such as a United States person, United States bank, United States-origin good or service, or conduct in the United States.
Merger and acquisition (M&A) safe harbor: DOJ policy treatment for misconduct discovered in lawful acquisition diligence, where the acquirer self-discloses, cooperates, remediates, and lacks disqualifying aggravating facts.
Egregious case: an OFAC enforcement-guidelines classification for particularly serious apparent violations, with emphasis on willfulness or recklessness, awareness, harm, and subject-person characteristics.

Selected sources

Statute: International Emergency Economic Powers Act, 50 U.S.C. 1701, 1702, and 1705, uscode.house.gov; Trading with the Enemy Act statute-of-limitations provision at 50 U.S.C. 4315(d).
Regulations: 31 CFR Part 501 and Appendix A to Part 501, Economic Sanctions Enforcement Guidelines, eCFR.
Agency overview and programs: OFAC, About OFAC; OFAC, Sanctions Programs and Country Information; OFAC, Sanctions List Search.
Ownership guidance: OFAC, Revised Guidance on Entities Owned by Persons Whose Property and Interests in Property Are Blocked, August 13, 2014; OFAC FAQs 398, 399, and 401.
Compliance framework: OFAC, A Framework for OFAC Compliance Commitments, May 2, 2019.
2024 to 2025 changes: OFAC, Guidance on Extension of Statute of Limitations, July 22, 2024; 90 FR 13286, final rule extending certain recordkeeping requirements to 10 years, effective March 21, 2025.
Enforcement and examples: OFAC, Civil Penalties and Enforcement Information page, 2026 chart checked June 15, 2026; OFAC, Adani Enterprises Limited settlement release, May 18, 2026; DOJ, White Deer and Unicat release, June 16, 2025; OFAC, Unicat settlement, June 16, 2025.
DOJ policy: Deputy Attorney General Lisa Monaco, American Bar Association National Institute on White Collar Crime remarks, March 2, 2023; DOJ, Corporate Enforcement and Voluntary Self-Disclosure Policy, March 10, 2026; DOJ, Reporting Voluntary Self-Disclosures of Violations of National Security Laws Under the Department-wide Corporate Enforcement Policy, March 30, 2026; DOJ National Security Division, In re White Deer Management LLC and In re Unicat Catalyst Technologies LLC case page.
Cross-agency notes: Commerce, Treasury, and DOJ, Tri-Seal Compliance Note on Voluntary Self-Disclosure of Potential Violations, July 26, 2023; Commerce, Treasury, and DOJ, Tri-Seal Compliance Note on Obligations of Foreign-Based Persons to Comply with United States Sanctions and Export Control Laws, March 6, 2024.

Status note

Last reviewed: 2026-06-15.
Next scheduled review: 2026-09-15.
Current watch items: OFAC 2026 civil-penalty chart and any additional high-value settlements; OFAC list and program updates, especially Russia, Iran, counter-terrorism, Global Magnitsky, cyber, and Venezuela; DOJ implementation of the March 2026 department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy; any further OFAC rulemaking on recordkeeping and reporting under the 10-year statute of limitations; future DOJ or OFAC acquisition-related sanctions resolutions after White Deer and Unicat.

By Noah Green CPA CFE, for Sheepdog Prosperity Partners. Educational only; not legal advice.