16.3 OFAC Reports, Records, Licensing and Screening Controls

Mandatory OFAC Reporting Requirements

Under 31 CFR § 501.603 and § 501.604, depository institutions must adhere to strict reporting deadlines:

• Initial Reports of Blocked or Rejected Property: The bank must file a formal written report with OFAC within 10 business days of blocking or rejecting any asset, account, or funds transfer. Reports must be submitted electronically through the OFAC Reporting System (ORS) and contain transaction dates, parties, dollar amounts, and copies of payment orders.
• Annual Report of Blocked Property: Every depository institution holding blocked property must file an Annual Report of Blocked Property with OFAC by September 30 of each year, detailing all blocked assets held as of June 30 of that calendar year.
• Record Retention Rule: All records related to blocked or rejected transactions, required sanctions transaction and license records; retain screening and investigation evidence under the applicable rule and policy must be retained for at least 10 years from the transaction date or, in the case of blocked property, for the entire duration the property remains blocked plus 10 years following release.

OFAC Licensing Architecture

• General Licenses: Authorizations published directly within OFAC regulations or on OFAC's public website permitting specific categories of transactions (e.g., agricultural commodities, medical devices, emergency humanitarian assistance, or legal representation) without requiring an individual application.
• Specific Licenses: Written authorizations issued directly by OFAC to a specific applicant upon formal written petition. A bank cannot process a prohibited transaction relying on a specific license until it inspects and verifies the scope and conditions of the valid OFAC license.

---

4. Bank OFAC Compliance Program Architecture

While OFAC regulations do not explicitly dictate specific program structures, federal banking regulators assess an institution's OFAC compliance program under the FFIEC BSA/AML Examination Manual based on five core elements:

1. Enterprise OFAC Risk Assessment

The institution should maintain a documented OFAC risk assessment appropriate to its risks evaluating its unique operational profile:

• Customer base demographics (e.g., non-resident alien accounts, foreign embassies, international import/export firms);
• High-risk geographic locations (border branches, regions with high concentrations of designated entities);
• Transactional volume and velocity of high-risk payment mechanisms (international Fedwire, CHIPS, SWIFT MT103/MT202 messages, cross-border ACH International ACH Transactions [IATs], commercial letters of credit, and prepaid access cards).

2. Internal Controls and Interdiction Screening

• Real-Time Interdiction Software: Risk-based screening and controls for electronic funds transfers (wires, cross-border ACH, letters of credit) prior to settlement or transmission to intercept potential SDN matches.
• Batch Screening: Comprehensive periodic screening of the entire existing customer database, beneficial owners, signatories, borrowers, and guarantors whenever OFAC updates the SDN List or other sanctions rosters.
• Screening Parameters and Fuzzy Logic: Utilizing advanced name-matching algorithms, Soundex phonetics, and fuzzy logic settings to detect alternate spellings, transliteration differences, acronyms, and intentional obfuscations.

3. False Positive Clearing and Escalation Protocols

• False Positive Clearing: Screening systems generate high alert volumes due to common names. The bank must establish documented procedures requiring compliance analysts to compare potential matches against full identifying data: complete name, date of birth, nationality, passport number, and address.
• Escalation to OFAC Officer: True matches or unresolvable potential matches must be escalated to the OFAC Compliance Officer. When an alert cannot be definitively cleared using documentary evidence, the bank must contact the OFAC Compliance Hotline or submit an inquiry via the OFAC portal while holding the transaction.

4. Independent Testing and Training

• Regular independent testing by internal audit or external experts validating screening algorithms, threshold sensitivities, data mapping, and list update procedures.
• Ongoing, role-tailored training for frontline personnel, wire operators, and compliance investigators.

---

5. Comparison Matrix: OFAC Blocking vs. Rejecting Decisions

Current sanctions and retention

OFAC extended the relevant recordkeeping period from five to ten years effective March 12, 2025. For blocked property, retain records throughout blocking and for ten years after unblocking. Screening software is a control, not legal permission: a no-match result can miss an unlisted entity blocked under the aggregate 50 Percent Rule. Conversely, a name match requires analysis of identifiers, the operative prohibition and licenses. The United States revoked the comprehensive Syria sanctions program effective July 1, 2025; targeted sanctions remain. Do not reject every Syria-related transaction under the repealed comprehensive program.

OFAC sanctions program information.