Who this is for: London market and international insurers, reinsurers, MGAs and brokers whose book touches US risk, US dollars or US persons. It sets out what OFAC actually requires, with the source for every obligation. It is general information, not legal advice.
Last reviewed 23 August 2026. Penalty figures and guidance references were checked against Treasury and OFAC sources current at that date.
The Office of Foreign Assets Control is part of the US Treasury. Its programmes bind all US persons: US citizens and permanent residents wherever located, anyone physically in the United States, and entities organised under US law including their foreign branches.
That is not where the exposure ends for a London market carrier. A non-US insurer can be drawn in wherever a transaction has a US nexus. The common routes are:
A firm with no US office and no US licence can therefore still face an OFAC enforcement action. Writing a book that never intentionally touches the United States is not the same as having no US nexus.
OFAC’s civil enforcement operates on a strict liability basis. A person can be liable for a prohibited transaction without knowing that the counterparty was sanctioned. Under OFAC’s Economic Sanctions Enforcement Guidelines at Appendix A to 31 CFR Part 501, willfulness and recklessness are aggravating factors that increase the penalty. Their absence does not prevent one.
The practical consequence for an insurer is that a screening failure is not excused by good faith. The question OFAC asks is whether the transaction happened, not whether anyone meant it to.
The statutory maximum civil penalty under the International Emergency Economic Powers Act is the greater of $377,700 per violation or twice the value of the underlying transaction.
That figure is normally adjusted for inflation each January. There was no adjustment for 2026. The Office of Management and Budget confirmed on 17 April 2026 that agencies including OFAC should continue using 2025 levels, because the Bureau of Labor Statistics did not publish October 2025 CPI-U data during the federal government shutdown. The 2025 figures therefore remain current.
| Statute | Maximum civil penalty per violation |
|---|---|
| International Emergency Economic Powers Act | $377,700, or twice the transaction value if greater |
| Trading With the Enemy Act | $111,308 |
| Foreign Narcotics Kingpin Designation Act | $1,876,699 |
OFAC’s Enforcement Guidelines run a two by two matrix. The two variables are whether the case is egregious, and whether the firm made a voluntary self-disclosure before OFAC found out.
| Voluntary self-disclosure | No voluntary self-disclosure | |
|---|---|---|
| Non-egregious | One-half of the transaction value, capped at $188,850 per violation | The applicable schedule amount |
| Egregious | One-half of the statutory maximum | The statutory maximum |
Self-disclosure is worth roughly half the exposure. That is only available to a firm that finds the problem before OFAC does, which is a detection question rather than a legal one.
Section 3111 of the 21st Century Peace through Strength Act, Public Law 118-50, signed on 24 April 2024, extended the statute of limitations for civil and criminal violations of IEEPA and TWEA from five years to ten.
OFAC then aligned its recordkeeping rule. A final rule effective 21 March 2025 extended the retention requirement at 31 CFR 501.601 from five years to ten.
For an insurer this changes the shape of the risk in two ways. Conduct from 2016 onward can still be examined. And the evidence file behind a cleared alert has to survive a decade, not five years, which is an archiving and reproducibility problem as much as a screening one.
An entity is blocked if it is owned 50 percent or more in the aggregate by one or more blocked persons, whether the ownership is direct or indirect.
Three features of the rule catch firms out:
Control without 50 percent ownership does not automatically block an entity under this rule, though OFAC may designate such an entity separately.
The implication for underwriting is that name screening alone is insufficient where the insured is a corporate entity. Beneficial ownership has to be resolved.
OFAC issued new and amended insurance-related FAQs on 25 November 2024, modifying FAQs 61 to 65, 68, 69 and 102 to 104, and adding FAQs 1199 and 1200. The key positions:
| FAQ | Position |
|---|---|
| 62 | An insurer may issue a policy to a blocked person only with express authorization from OFAC. Deposits must be blocked and reported within 10 business days. |
| 64 | Any premium payments made by or on behalf of a blocked person must be blocked. |
| 65 | Insurers should use a risk-based approach to screen all issued policies at exposure points including policy renewal, policy amendment, claim submission and claim payment. Responsibility extends to underwriters, brokers and agents. |
| 104 | Worldwide travel assistance payments under a global policy, for incidents or damage occurring in a sanctioned country, could be prohibited without OFAC authorization. |
| 1199 | Payments to innocent third parties, meaning policy beneficiaries, require OFAC authorization where the policy has been blocked. |
FAQ 65 is the operationally significant one. OFAC does not treat screening at inception as sufficient. It names four separate points in the policy lifecycle at which screening is expected, and it extends the expectation down the distribution chain to brokers and agents.
OFAC’s Framework for OFAC Compliance Commitments sets out five components. They are the structure against which a programme is assessed after something has gone wrong, and remedial credit in an enforcement action is measured against them.
It can. OFAC binds US persons directly, but a non-US insurer is exposed wherever a transaction has a US nexus. The most common routes are US dollar payments clearing through a US correspondent bank, US-domiciled risk written on a global policy, US reinsurance in the chain, and conduct that causes a US person to violate sanctions. Having no US office does not remove the exposure.
Yes for civil penalties. A person can be liable for a prohibited transaction without knowing the counterparty was sanctioned. Under OFAC’s Economic Sanctions Enforcement Guidelines, willfulness and recklessness are aggravating factors that raise the penalty, but their absence does not prevent one.
Under IEEPA, the greater of $377,700 per violation or twice the value of the transaction. There was no inflation adjustment for 2026: the Office of Management and Budget confirmed on 17 April 2026 that 2025 levels continue, because October 2025 CPI-U data was not published during the federal government shutdown.
Ten years. Section 3111 of the 21st Century Peace through Strength Act, signed 24 April 2024, extended the statute of limitations for civil and criminal IEEPA and TWEA violations from five years to ten. OFAC then extended its recordkeeping requirement at 31 CFR 501.601 from five to ten years, effective 21 March 2025.
An entity is blocked if it is owned 50 percent or more in the aggregate by one or more blocked persons, directly or indirectly. Ownership aggregates across multiple blocked owners and across different sanctions programmes. Critically, the resulting entity is blocked by operation of the rule and does not appear on the SDN List, so screening names against the published list alone will not detect it. Beneficial ownership has to be resolved.
No. OFAC FAQ 65 expects a risk-based approach that screens issued policies at exposure points including policy renewal, policy amendment, claim submission and claim payment. The expectation extends to underwriters, brokers and agents, not just the carrier.
Substantially. Under the Enforcement Guidelines, a non-egregious case with voluntary self-disclosure has a base penalty of one-half the transaction value capped at $188,850 per violation, against the applicable schedule amount without disclosure. An egregious case with disclosure is capped at one-half the statutory maximum rather than the full maximum. Disclosure is only available to a firm that detects the problem before OFAC does.
Global RADAR screens against OFAC, including the SDN and Consolidated lists, alongside more than 1,400 sanctions and watchlists on a daily update cycle, and resolves ultimate beneficial ownership so that entities blocked by the 50 Percent Rule are surfaced rather than missed. Every disposal carries a reason code, a rationale and a confidence score, and the record is exportable and reproducible for the full ten year look-back.
Read the full alert clearing methodology and model governance, or see how clearing is delivered and priced.
