OFAC compliance software usually means screening software: interdiction filters that check payments and customer names against OFAC's lists and raise alerts. Reporting is a different job that starts where screening stops, once an officer has decided to block or reject, and it is the part most banks still do by hand: finding the payment message and the core record, typing each field into OFAC's form, counting 10 business days on a calendar, tying blocked funds to the general ledger and saving the receipt. OFAC's own estimate is 15 minutes to 2 hours per form-based report, but the work around the form is larger. Agents can now take most of the mechanical tasks: start the clock at the event, gather the sources, draft every field with a citation, reconcile blocked accounts and keep the 10-year file. People keep the decision, any change to a draft with its reason, the signature and every posting to the general ledger. Botminds' OFAC Reporting is built on that split.
The examples come from a fictional sample bank, Tessaly Community Bank, as its items run through the solution; the people and companies named are fictional. Hours on this page are Botminds' estimate for a community bank, labelled as such, not a measurement.
Where the hours on one OFAC report go, by hand and with agents
By hand today · about 5.8 hours of an analyst’s and an officer’s time
- Finding the payment message, core record and disposition · 26%
- Counting the due date, chasing hand-offs · 9%
- Typing the report into OFAC’s form · 26%
- Officer’s review by email · 17%
- Tying blocked funds to the general ledger · 14%
- Saving the receipt and the file · 8%
With the agents · about 1.2 hours
- Checking the gathered sources · 17%
- Reading the counted due date · 8%
- Reviewing and correcting the draft · 34%
- Officer’s review and signature · 25%
- Confirming the proposed entry · 8%
- Checking the sealed file · 8%
What OFAC compliance software do banks use?
Three kinds, which are often confused. Interdiction or screening software compares wires, ACH entries and customer records with OFAC's lists and raises potential matches; it is what most people mean by OFAC software, and the FFIEC manual expects it to be tuned to risk, catching close variants of listed names wherever risk and volumes are high (FFIEC manual; how that sensitivity is set is in sanctions screening threshold). Case management records how each alert was dispositioned and who decided. Reporting covers what happens after a decision: the report to OFAC, the blocked account, the annual report and the file.
The first two are mature markets. The third is often a spreadsheet, a shared drive and OFAC's own portal. That is not a criticism of any bank: OFAC's regulations require the reports, not a system for producing them, and at a bank that files a few dozen a year it has been rational to do them by hand. What has changed is the rule set around them. Since 2024 and 2025, reports go only through the OFAC Reporting System, releases must be reported, and records are kept 10 years, so the hand-built process now carries more steps and a longer tail than it did.
Is OFAC software required?
No. OFAC has said so directly: "There is no legal or regulatory requirement to use software or to scan. There is a requirement, however, not to violate the law by doing business with a target or failing to block property" (OFAC FAQ 43). The same holds for reporting. What is required is the outcome: every report complete and on time, every blocked dollar in the right account, every record kept for 10 years. OFAC's 2019 framework expects "Sufficient control functions exist that support the organization's SCP—including but not limited to information technology software and systems—that adequately address the organization's OFAC-risk assessment and levels" (OFAC Framework), which is a test of fit, not of any particular product.
How long does an OFAC report take to prepare?
OFAC's estimate is 15 minutes to 2 hours for a report on one of its forms, and the work around the form takes longer. In its 2024 paperwork notice, OFAC put "an average time estimate for reports associated with forms ranging from 15 minutes to 2 hours", across roughly 2,502,086 responses a year and 86,223 burden hours in total (OFAC, 89 FR 74375). Divided out, that is about two minutes per response, which implies that most of the 2.5 million are short filings, such as the remittance and general license reports the same notice counts, rather than blocked or rejected reports.
OFAC's own estimate of the reporting burden
10,900
unique respondents across OFAC’s reporting collections
2,502,086
responses a year, from 1 to 17,800 per filer
15 min–2 h
average time for a report on one of OFAC’s forms
86,223hours
total annual reporting burden
OFAC's estimate measures completing the form. Botminds' estimate above measures the job at a community bank: finding the sources in three or four systems, counting the date, typing, the officer's review, the general ledger and the file, about 5.8 hours of two people's time on one item. The difference is the part of OFAC reporting that software can change most, because almost none of it is judgement.
Which reporting tasks move to agents
The tasks that move are those with a right answer that can be checked: a date counted from an event, a value copied from a system of record, a total that should equal the general ledger. In OFAC Reporting each of them belongs to one agent with a written limit, and each agent's output carries the source it came from.
One OFAC report, task by task: who does it, and why
| Task | Agent or person | Why it sits there |
|---|---|---|
| Open the item when a block or reject is decided | Intake agent | The decision already exists in case management or the partner feed; collecting it is clerical |
| Start and count the 10 business days | Clock agent | A rule applied to an event date and a holiday calendar; it can show every day it counted |
| Draft each field with its source | Report drafting agent | Most fields are copies from the payment message, the decision and the core; each draft value is cited |
| Check every link from hit to receipt | Chain agent | A missing return file or journal entry is visible in another system, found by looking |
| Tie blocked accounts to the general ledger, check rates | Blocked funds agent | An arithmetic test at each month-end and whenever an account opens |
| Draft the annual report on July 1 | Annual report agent | Built from the June 30 tie-out in OFAC’s layout |
| Submit after signature, keep the file | Filing and records agent | A mechanical step that must never run before a person signs |
| Block, reject or process | OFAC Officer | A legal judgement on a valid match and a program |
| Change a drafted field | BSA/OFAC Analyst | Judgement on what the source means, recorded with a reason code |
| Approve and file | OFAC Officer | The bank’s attestation to OFAC |
| Post an entry or change a rate | Deposit Operations, confirmed by the officer | Moves money; two people |
The seven OFAC Reporting agents, each with one job and one thing it may never do
Agent
Intake agentTakes each block or reject decision, attaches the payment message, disposition and customer record.
Never: changes a decision, or starts the clock at the hand-off date
Agent
Clock agentCounts 10 business days from the event; reminds on days 3, 5 and 7; escalates on days 8 and 9.
Never: counts a calendar day, or moves a due date by hand
Agent
Report drafting agentDrafts blocked, rejected and unblocking reports and customer notices, each field cited.
Never: writes “SDN” as a legal authority, or submits a report
Agent
Chain agentProves each link of the item against its system of record and opens any gap with the person who must close it.
Never: closes a gap itself
Agent
Blocked funds agentTies every blocked account to the general ledger and checks its rate.
Never: posts an entry or changes a rate
Agent
Annual report agentBuilds the June 30 report from the month-end tie-outs, ready on July 1.
Never: files
Agent
Filing and records agentSubmits after the officer signs, records the receipt, seals and dates the file.
Never: submits unsigned, or deletes a record early or under a legal hold
What stays with people
Every decision that changes what the bank owes OFAC, a customer or its own books. The officer decides block, reject or process, because that is the legal judgement OFAC's FAQ 5 describes as a risk-based determination the organization makes for itself, since OFAC will neither confirm a match nor clear one (OFAC FAQ 5). The analyst prepares, and any change to an agent's draft is the analyst's, with a reason code the officer sees beside it. The officer signs and files. Deposit operations posts blocked-funds entries and changes rates, and the officer confirms them. What the officer prepared, such as a notice of blocked funds, goes to her deputy.
In the sample bank's rejected Iranian credit, that meant five human steps in a nine-step chain: the analyst's disposition, the officer's decision, deposit operations' return and, later, the analyst's change to one field and the officer's signature. Fields below 0.90 confidence are marked for the analyst, and none was; the one he changed, the description of the transaction at 0.93, he changed because the draft left out the invoice and the gateway operator.
Each drafted field carries a confidence and its source
Can software file OFAC reports?
Yes, through the OFAC Reporting System, on the bank's behalf. The regulation lets an attorney, agent or other person file for the holder, while leaving primary responsibility with the holder itself (31 CFR 501.603(a)(2)). Software that files is therefore a delegate whose mistakes are the bank's. The control that matters is the one in front of the submit button: in OFAC Reporting the Filing and records agent can submit only after the OFAC Officer has signed, and nothing that reaches OFAC is approved in bulk.
Does OFAC compliance software keep the 10-year record?
It should, and the buyer should ask how. 31 CFR 501.601 requires records to be available for examination for at least 10 years after each transaction, and for blocked property for as long as it is blocked and 10 years after it is unblocked (31 CFR 501.601). A tool that keeps reports but not the payment message, the decision and the approvals behind them keeps the wrong half. OFAC Reporting seals each item's documents with a checksum at filing, sets a retention date from the event or the release, requires a second approval for a legal hold, and exports a redacted pack for an examiner or internal audit.
How to judge OFAC compliance software for reporting
Ask what it does after the alert is cleared, and what it refuses to do. The supervisory guidance on models does not settle the question for agents: the Federal Reserve's SR 26-2, issued with the OCC and FDIC, puts generative and agentic AI outside its scope and leaves the controls for them to each bank's own risk management and governance (Federal Reserve SR 26-2; what that means in an alert queue is in AI for sanctions screening). The Wolfsberg Group's principles ask firms to "understand the potential impact of the use of these technologies before implementation to ensure that it results in fair, effective, and explainable outcomes" (Wolfsberg AI and ML principles). For reporting, explainable is concrete: every value has a source, every date its count, every change its reason.
Three kinds of OFAC compliance software, measured on reporting
Screening tool, or a spreadsheet: Only if someone logs the decision and the date
Reporting agents with sources: Opens an item from the decision and counts from the event
Screening tool, or a spreadsheet: By hand, from three or four systems
Reporting agents with sources: Drafted from the systems of record, each value cited
Screening tool, or a spreadsheet: Email threads
Reporting agents with sources: Draft and change side by side, with reason codes
Screening tool, or a spreadsheet: At year end, if at all
Reporting agents with sources: Each month-end and when an account opens
Screening tool, or a spreadsheet: Built in September
Reporting agents with sources: Drafted July 1 from the June 30 tie-out
Screening tool, or a spreadsheet: A shared drive, until the retention schedule purges it
Reporting agents with sources: Sealed, dated, kept 10 years, with legal holds
Eight questions for any OFAC reporting software demonstration
- Show me a due date and how it was counted
From the event date, with each skipped day and its reason.
- Show me the source of every drafted value
One click from the field to the passage it came from.
- Show me what the analyst changed
Draft and change side by side, with a reason the officer sees.
- Try to submit without the officer’s signature
It should be impossible, not discouraged.
- Try to write “SDN” as the legal authority
It should be refused, with the program regulation suggested instead.
- Open a blocked account with no journal entry
The gap should appear the same day, with a proposed entry, not a posted one.
- Hand in an item four business days late
The clock should show the days already used on arrival.
- Ask for the examiner’s file for this year
Every item, report, receipt, approval and tie-out, redacted for the audience.
Where OFAC Reporting fits, and where it does not
OFAC Reporting is not a screening system. It takes block and reject decisions from the bank's sanctions alert review, its payment screening and any fintech partner's processor, and it is only as complete as the systems it is connected to: a blocked asset held somewhere it cannot read will not appear until that system is connected or the item is recorded. It does not decide whether a hit is valid or whether to block or reject, and its agents never post, sign or file on their own. What it changes is the work between the decision and the receipt, which is where the sample bank's analyst spent most of his hours.
Every open report on one runway of business days
The people side of the same split is in who signs each OFAC report and what it attests, and what a bank should have ready before a provider starts is in what to bring on day one. The full chain is on the OFAC Reporting page.
Questions people ask
What is the difference between OFAC screening software and OFAC reporting software?
Screening software compares payments and customers with OFAC's lists and raises potential matches. Reporting software starts after an officer has decided to block or reject: it prepares the report due in 10 business days, tracks blocked funds and the annual report, and keeps the 10-year file.
Can an agent decide whether to block or reject?
Not in OFAC Reporting, and we would not recommend it anywhere. OFAC's FAQ 5 leaves the determination to the organization and says OFAC does not confirm matches; the decision, and the legal authority behind it, should rest with a named officer.
Does OFAC approve or certify compliance software?
No. OFAC's FAQ 25 says it is not itself a bank regulator, and its FAQs on software tell banks to judge packages against their own needs and to talk to peers. Examiners judge whether the bank's program, including its systems, fits its risk.
Is sanctions compliance software the same as OFAC compliance software?
Often the terms are used interchangeably, but sanctions compliance can also cover UK, EU and UN regimes, which have different reporting rules. The UK, for example, requires reports to OFSI "as soon as practicable" rather than within 10 business days.
How many OFAC reports does a typical bank file?
It varies enormously. OFAC's 2024 estimate is between 1 and 17,800 responses a year per filer, with most filers sending a small number. The fictional sample bank in this guide filed 33 OFAC reports between January 1 and October 13, 2026, all within 10 business days.