Office of Foreign Assets Control (OFAC) Compliance


Disclaimer

This case study is provided as an informational discussion of compliance principles and practices. It is not intended to be used as an authoritative or legal guide to the subjects discussed. Institutions are recommended to consult their legal and compliance staff before implementing or changing any compliance procedures.

At Truth Technologies we are often asked, "Why do I have to check the OFAC list. Who's in the list?" and "How should I set up my OFAC program?" This case study will investigate these questions in more detail in an effort to help you design an effective and efficient OFAC program.

Truth Technologies Sentinel Customer Verification system helps organizations implement an effective OFAC compliance program and can greatly reduce the effort needed to implant and maintain such a program. We certain hope that after you have read the following case study you will take a look at Sentinel or contact us if you have any questions.

The Need for OFAC Compliance

You have to check the OFAC list because it is the law, "All U.S. persons, including U.S. banks, bank holding companies, and non-bank subsidiaries, must comply with OFAC's regulations."1 Persons are defined broadly to cover persons and corporations. Persons are defined by OFAC as "U.S. citizens and permanent resident aliens regardless of where they are located, all persons and entities within the United States, all U.S. incorporated entities and their foreign branches."2

This is an obligation that must be taken seriously as OFAC has the authority to audit any business to ensure compliance, although they usually rely on regulators to enforce compliance. Regulators such as: FDIC, FinCEN, FED, NCUA, OCC, OTS and the SEC all enforce OFAC regulations. If you are not regulated by one of the above groups you are not off the hook; car dealers, wholesale jewelers, non-profits, lawyers and firms that do international business have all recently come under increased scrutiny and been subject to audits.

Setting up an OFAC Program

Before setting up a program you need to determine why you might be at risk and what that risk level is. Suggestions for determining your risk include, but are not limited to: how well you know your customers, percentage of high-risk customers, exposure to foreign customers, electronic banking access, international transactions and many more. For a full list see the OFAC Risk Matrix.3

Also consider that when checking customers you must take into account all parties in a business transaction. In the case of financial institutions may include co-signers, beneficiaries and collateral owners and cosigners.

Once you have started screening your customers you will invariable come to the problem of, "I have a potential match, now what do I do?" The first thing is that you must determine if you have a true verified match or a false positive. A false positive is when you customer appears to be the same as someone on the OFAC list but upon closer examination it is determined they are different people. No matter how good your introduction software or your screening policies and staff are you will always get some number of false positives because a person's or entities name is not a unique identifier, there is more than one John W. Smith in the world.

When considering whether a match is a "True Match" or a false positive it is important to verify that the type of entity matches, for instance you should not be comparing an individual to a political party, Sentinel does this automatically for you. Once that is complete go through the steps outlined by OFAC4.

For a full overview of setting up an OFAC program please consult Office Foreign Assets Control (Overview).

Who is in the OFAC List

As for who is in the list there are about 3,800 persons, entities and vessels listed in the OFAC list. About 58% of those listed are individuals, 41% are entities (corporations, charities or political groups) and about 1% are vessels.

OFAC maintains two types of programs: those that target a specific geographic or government and those that target individuals that could be in any location. About 34% of the persons and entities listed are assigned to specific sanctions programs reference to a geographic region or government. Examples include Cuba, Iran, Balkans, etc. The remaining 66% are attributed to more general sanctions programs such as Counter Narcotics Trafficking and Anti-Terrorism. The impact of this on organizations is that a majority of the entities listed in OFAC are part of programs that are geographically non-specific and thus could appear in a wide number of geographic regions.

An independent analysis of the OFAC list was conducted on February 13th, 2008. The program and address data was taken directly from the OFAC list itself. The nationality and location information was taken from World-Check.

Note that an OFAC entity may have more than one address, which explains why there are 4060 addresses in Columbia when the entire OFAC list has only about 3850 entries.

Program Break Down

Program DescriptionProgram AbbreviationsTotal EntitiesPercentage
Counter Narcotics TraffickingBPI-PA, BPI-SDNT, BPI-SDNTK, SDNT, SDNTK189749.30%
Anti-TerrorismNS-PLC, SDGT, SDT58715.30%
CubaCUBA3609.40%
IraqIRAQ2, IRAQ32215.70%
BalkansBALKANS2025.30%
SudanSUDAN, DARFUR1704.40%
ZimbabweZIMB1654.30%
Non-ProliferationNPWMD701.80%
Former Liberian Regime of Charles TaylorLIBERIA611.60%
BurmaBURMA521.40%
BelarusBELARUS180.50%
Democratic Republic of the CongoDRCONGO170.40%
IranIRAN90.20%
SyriaSYRIA60.20%
North KoreaNKOREA40.10%
Cote d'Ivoire (Ivory Coast)COTED30.10%
Persons Undermining The Sovereignty Of Lebanon Or Its Democratic Processes And InstitutionsLEBANON30.10%
  3845 

Address - Top 20 Countries

CountryAddress Records
Colombia4060
Mexico769
Sudan293
United States174
Panama156
United Kingdom103
Italy87
United Arab Emirates85
Zimbabwe76
Thailand76
Spain66
Pakistan65
Cuba64
Germany61
Iraq59
Ecuador59
Iran56
Burma53
Peru48
Palestinian41

Nationality Break Down Top 20 Countries

An OFAC entity has only one nationality and it is usually the same as the entities citizenship or place of incorporation or operations. This analysis is based on the World-Check data base

CitizenshipNumber
COLOMBIA1459
IRAQ354
MEXICO260
SUDAN172
ZIMBABWE165
PANAMA135
BOSNIA AND HERZEGOVINA114
UNITED KINGDOM84
SPAIN78
USA68
IRAN57
MYANMAR56
SERBIA & MONTENEGRO50
UNITED ARAB EMIRATES49
LEBANON45
CUBA42
TUNISIA40
PAKISTAN36
EGYPT33
SOMALIA29

Location Break Down - Top 20 Countries

An OFAC entity may have multiple locations that they are active in. Note that locations that a person is active in may be different than nationality. This analysis is based on the World-Check data base.

Location CountryNumber
COLOMBIA4106
MEXICO867
IRAQ450
SUDAN318
USA293
ZIMBABWE241
PANAMA163
BOSNIA AND HERZEGOVINA154
UNITED KINGDOM134
ITALY134
PAKISTAN132
SPAIN127
UNITED ARAB EMIRATES117
IRAN111
GERMANY94
MYANMAR90
CUBA86
THAILAND86
LEBANON69
AFGHANISTAN67

End Notes and References

1 2 Office Foreign Assets Control (Overview)
3 OFAC Risk Matrix
4 How do I determine if I have a valid OFAC match

Bank Secrecy Act / Anti-Money laundering Examination Manual