Yes. OFAC sanctions apply to US businesses of every size, and there is no small-business exemption. A five-person company that pays a supplier through QuickBooks Online is bound by the same OFAC prohibitions as a large bank.
What changes with size is how much compliance work makes sense. OFAC expects a program that fits your risk. For most small businesses that means checking names against the sanctions lists and keeping a record that you did.
The short answer: OFAC rules apply to every US business
OFAC answers this in its own FAQ 11. "All U.S. persons must comply with OFAC sanctions." The answer then lists who that covers: US citizens and permanent residents wherever they are, all individuals and entities within the United States, and all US-incorporated entities and their foreign branches.
The FAQ does not set a minimum revenue, headcount or transaction size. If your company is incorporated in the US, or you operate inside the US, the rules apply to you.
Size does come up later, in a different place. When OFAC decides how to respond to a violation, one of the things it may weigh is "the size of a Subject Person's business operations and overall financial condition." The same guidelines say that qualifying as a small business under the Small Business Regulatory Enforcement Fairness Act "may also be considered." That is a factor OFAC can take into account after the fact. It does not switch the rules off.
Strict liability, in plain words
OFAC can fine you for a sanctions violation even if you did not know the other party was sanctioned. This is called strict liability.
OFAC put it this way in a 2020 advisory:
OFAC may impose civil penalties for sanctions violations based on strict liability, meaning that a person subject to U.S. jurisdiction may be held civilly liable even if it did not know or have reason to know [it was dealing with a prohibited person].
For a small business, the practical point is simple. "I didn't check" is not a defense. Paying a vendor or selling to a customer who turns out to be on the SDN list can be a violation on its own, whatever your intent.
Intent still matters for how hard OFAC comes down. That is the next section.
What OFAC looks at when it sets a penalty
OFAC publishes its Economic Sanctions Enforcement Guidelines as Appendix A to 31 CFR Part 501. They list eleven General Factors, labelled A to K. OFAC uses them to decide whether to act at all and, if it imposes a fine, how large it should be.
The factors a small business is most likely to touch are these:
- A. Willful or reckless violation of law. Did you know it was a violation, or ignore warning signs?
- B. Awareness of conduct at issue. Did you know, or have reason to know, the transaction happened?
- D. Individual characteristics. This covers commercial sophistication, size of operations, volume of transactions and sanctions history.
- E. Compliance program. In the guidelines' words: "the existence, nature and adequacy of a Subject Person's risk-based OFAC compliance program at the time of the apparent violation."
- F. Remedial response. What you did once you found the problem, including whether you set up a compliance program if you had none.
- G. Cooperation with OFAC. This includes whether you told OFAC yourself.
The guidelines do not end at fines. Possible outcomes include no action, a cautionary letter, a Finding of Violation, a civil monetary penalty and, in appropriate cases, a criminal referral.
Egregious and non-egregious cases
When OFAC decides a fine is appropriate, it first decides whether the case is "egregious." The guidelines say OFAC gives "substantial weight" to factors A, B, C and D here, with particular emphasis on A and B. An egregious case is one that "represents a particularly serious violation of the law calling for a strong enforcement response."
The guidelines say that call is made by OFAC's Director or Deputy Director.
Voluntary self-disclosure
A voluntary self-disclosure means you tell OFAC about the apparent violation yourself, before or at the same time as OFAC or another government agency finds it. It has to be followed by a report detailed enough for OFAC to understand what happened.
The starting penalty changes with both questions:
- Non-egregious, self-disclosed: one-half of the transaction value, up to a cap.
- Non-egregious, not self-disclosed: an amount from a schedule set by transaction value, up to a cap.
- Egregious, self-disclosed: one-half of the statutory maximum.
- Egregious, not self-disclosed: the statutory maximum.
OFAC then adjusts that base amount up or down using the General Factors.
OFAC's compliance framework, sized for a small business
In May 2019 OFAC published "A Framework for OFAC Compliance Commitments." It says each risk-based program "will vary depending on a variety of factors," including "the company's size and sophistication." It then names five components every program should rest on.
The framework also says plainly that "OFAC regulations do not require a formal SCP," meaning a sanctions compliance program. It encourages one anyway, especially for businesses that trade internationally or have customers or counterparties outside the US. It lists the lack of a formal program as a root cause in many past penalty cases.
Here is what each component looks like for a small business on QuickBooks Online.
1. Management commitment
The owner reads and signs off on the policy. The framework notes that one person can cover sanctions compliance alongside other roles, depending on size and complexity. In a small business, that person is often the owner or the bookkeeper. If you are an accountant setting this up for clients, see sanctions compliance for accountants.
2. Risk assessment
Write down who you pay and who pays you, what you sell and where those parties are. The framework names these areas: customers, supply chain, intermediaries and counterparties; products and services; and geographic locations.
3. Internal controls
This is the screening itself, plus written steps for what happens on a possible match. The framework says a program should adjust to changes OFAC publishes, including updates to the SDN List and other sanctions lists. It also lists failing to update screening for SDN List changes as a known cause of past violations.
4. Testing and auditing
Check now and then that the process is actually happening. For a small business this can be a short review: pick a few recent new vendors and confirm each one has a dated screening record.
5. Training
The framework says training should happen "at a minimum, annually" for appropriate employees. For a two-person finance function, that can be a short annual walkthrough of the policy and of what to do on a hit.
Keep records for 10 years
Two separate 10-year rules matter here.
The first is how long OFAC has to bring a case. For violations of sanctions based on the International Emergency Economic Powers Act or the Trading with the Enemy Act OFAC can now start an enforcement action within 10 years of the latest date of the violation. Before this change the limit was five years.
The second is how long you must keep records. Under 31 CFR 501.601, every person engaging in a transaction subject to OFAC's regulations must keep "a full and accurate record of each such transaction." The record must be available for examination "for at least 10 years after the date of such transaction."
A screening record you cannot find in year eight does not help you. Store the date, the name you checked, the lists covered and the result somewhere that survives staff changes and software migrations.
A proportionate setup for a small business
This setup covers the five components without a compliance department.
Screen at onboarding
Check every new vendor and customer before the first payment or invoice. OFAC's website has a Sanctions List Search tool you can use for manual checks. For a QuickBooks Online business, onboarding usually means the moment someone creates a new vendor or customer record. The steps are in how to screen QuickBooks vendors against the OFAC list.
Rescreen when the lists change
A vendor who was clear in March can be added to the SDN List in June. OFAC's framework expects a program to keep up with list updates, so a one-time check at onboarding is not enough. Re-check your existing vendors and customers when the lists change, or on a fixed schedule you can defend. Sanctions Clear, opening to QuickBooks Online and Xero users, will recheck a contact against the latest lists whenever it changes or appears on a new bill or invoice, rescreen everyone monthly, and save the dated result for you.
Keep a dated record
For each check, record the date, the name searched, the lists covered, the result and who reviewed it. Keep it for at least 10 years.
Write a one-page policy
One page is enough. Cover who screens, when screening happens, which lists are checked, how possible matches are reviewed, where records are stored and who signs off. Have the owner sign and date it. Review it once a year as part of the training.
Know who to call on a hit
OFAC's FAQ 5 sets out how to check one. Compare details such as name, date of birth, identification numbers, nationality and address. If you can reasonably decide the match is not valid, you may proceed.
If the match looks real, stop the payment or transaction and escalate. OFAC says that where sanctions require blocking, you must freeze the property. Blocked property and rejected transactions must be reported to OFAC within 10 business days. For questions, use the OFAC Compliance Hotline. Get legal advice before you release anything you have blocked.
