Skip to main content

Lesson 11 of 25

Sanctions Fundamentals: OFAC, UN & EU

4 min read · CFCS

Build your sanctions foundation: OFAC's strict-liability regime, the SDN List, blocking versus rejecting, and the exam-favorite 50 Percent Rule across the major global programs.

What sanctions are

  • Government restrictions on dealings with targets
  • Foreign-policy and national-security tools
  • Strict liability — intent often irrelevant
  • Compliance is non-negotiable

Sanctions are government-imposed restrictions on dealing with specified countries, entities, or individuals, used as tools of foreign policy and national security. For a financial institution, they are uniquely unforgiving, because many sanctions regimes impose strict liability: you can violate them without intending to and without knowing your counterparty was sanctioned. There's no I-didn't-realize defense to a strict-liability breach.

Think of sanctions as a hard wall rather than a risk-based judgment call: where anti-money-laundering rules ask you to weigh suspicion, sanctions simply forbid the dealing outright, and a single processed payment can mean a multimillion-dollar penalty and reputational damage. That's why sanctions compliance is among the highest-stakes areas in the whole financial-crime field, and why the CFCS gives it a dedicated content area. Let's map the major regimes.

OFAC: the U.S. regime

  • Office of Foreign Assets Control, U.S. Treasury
  • Authority rooted in IEEPA (50 U.S.C. 1701)
  • Country-based and list-based programs
  • Sweeping extraterritorial reach via the dollar

The most powerful sanctions authority is the United States' Office of Foreign Assets Control, OFAC, within the Treasury. Much of its authority flows from the International Emergency Economic Powers Act, codified at 50 U.S.

C. 1701, and its detailed programs live in 31 CFR Chapter V. OFAC runs two broad kinds of programs: country-based or comprehensive programs that restrict nearly all dealings with a target jurisdiction, like Iran, Cuba, North Korea, or Syria, and list-based or targeted programs aimed at named persons.

OFAC's reach is famously extraterritorial: because so much global trade clears in U.S. dollars and touches U.

S. correspondent banks, even a non-U.S.

firm with no American office can be caught the moment a dollar payment passes through New York. The exam loves that dollar-clearing nexus, so commit it to memory.

The SDN List and blocking

  • Specially Designated Nationals and Blocked Persons
  • Assets must be frozen ('blocked'), not just refused
  • No dealing with SDNs, directly or indirectly
  • Report blocked property to OFAC

OFAC's centerpiece is the Specially Designated Nationals and Blocked Persons List, the SDN List. U.S.

persons, and often others, are prohibited from dealing with anyone on it. And note the verb: when you encounter an SDN's property, you don't simply refuse the transaction, you block it, freezing the assets in place and reporting them to OFAC, generally within ten business days. Blocking versus rejecting is a real exam distinction.

You block when the sanctioned party has an interest in the property, so the funds are held in a segregated, interest-bearing blocked account and cannot be returned to the sender. You reject when a transaction is merely prohibited but no blockable interest is present, and you send the money back. Confusing the two, returning funds you should have frozen, is itself a violation that OFAC treats as serious.

The 50 Percent Rule

  • Entities 50%+ owned by SDNs are themselves blocked
  • True even if not separately named on the list
  • Aggregate ownership across multiple SDNs
  • Ownership, not just listing, is what matters

Here's a rule the exam adores: OFAC's 50 Percent Rule. Any entity that is owned fifty percent or more, in the aggregate, by one or more blocked persons is itself blocked, automatically, even if that entity's own name never appears on the SDN List. So screening only against the literal list isn't enough; you must understand ownership.

A company that looks clean by name can be sanctioned because two SDNs each holding thirty percent together own a majority of it. Note the trap the exam sets: at exactly forty-nine percent the entity is not automatically blocked, though OFAC still cautions you to treat heavy minority ownership or control with care. This is why beneficial-ownership analysis, which we met in laundering, returns here with teeth: ownership, not just listing, determines status, and you must look through layers of holding companies to find it.

UN, EU, and recap

  • UN sanctions: binding on all member states
  • EU restrictive measures across the bloc
  • Multiple overlapping regimes must all be screened
  • Recap: OFAC, SDN, blocking, 50% Rule

OFAC isn't the only game. The United Nations Security Council imposes sanctions binding on all member states under Chapter VII of the UN Charter, often the source that national regimes then implement. The European Union maintains its own restrictive measures applied across the bloc, and the United Kingdom now runs its own post-Brexit list through OFSI.

A global institution must screen against every regime that touches it, U.S., UN, EU, UK, and relevant national lists, because a name clean under one can be sanctioned under another, and the strictest applicable rule governs.

So recap: sanctions are strict-liability foreign-policy tools; OFAC is the heavyweight, rooted in IEEPA and 31 CFR Chapter V; you block, not just refuse, SDN property; and the 50 Percent Rule extends blocking to majority-owned entities by ownership. A practical exam tip: when a question gives you a counterparty, always ask three things in order, is the name on a list, is the entity majority-owned by someone on a list, and does the payment touch a regime that binds me. Next, we put this into practice with screening and enforcement.

Test yourself first.

Sources

  • OFAC sanctions regulations (31 CFR Chapter V)
  • International Emergency Economic Powers Act (50 U.S.C. 1701)
  • OFAC SDN List and the 50 Percent Rule guidance
  • UN Security Council sanctions
  • EU restrictive measures

Test your knowledge

A few CFCS questions on this material — pick an answer to see the explanation.

  1. Q1. Under FinCEN's 2019 guidance, how are administrators and exchangers of convertible virtual currency generally classified for BSA purposes?

  2. Q2. A compliance officer wants to share a customer's transaction data with a peer institution under a 314(b) arrangement but is concerned about GDPR. Which GDPR article provides the most relevant lawful basis for processing personal data for AML purposes?

  3. Q3. A bank employee is investigating a potential SAR subject. A colleague suggests telling the customer that a report may be filed so they can explain the transactions. Why is this impermissible?

  4. Q4. What is the primary function of a national financial intelligence unit (FIU) as defined by FATF Recommendation 29?

Ready to practice?

Put this lesson to work on real CFCS questions.

Drill the full CFCS bank →