OFAC penalty calculation: what a missed or late report can cost

OFAC calculates a civil penalty in two steps set out in its Economic Sanctions Enforcement Guidelines (appendix A to 31 CFR part 501). First, a base amount from a matrix: for a case that is not egregious, half the transaction value if the bank voluntarily self-disclosed it, or a schedule amount by transaction size if it did not; for an egregious case, half the statutory maximum or the full maximum. Second, an adjustment for OFAC's General Factors, such as a 25 to 40 percent reduction for substantial cooperation. Since September 25, 2026, the maximum itself sits in a new part 505: for IEEPA programs, the greater of $377,700 or twice the transaction. Reporting failures have their own price list, up to $7,289 for a report filed more than 30 days late plus $1,459 for every further 30 days on blocked assets. Those amounts are small beside the penalties for the payments themselves, but late and missing reports are among the cheapest violations to prevent, which is what Botminds' OFAC Reporting is for: every report counted from its event, drafted with its sources and filed under the OFAC Officer's signature.

Worked examples on this page are illustrative arithmetic under the Guidelines, labelled as such; enforcement figures are OFAC's own, linked where they appear.

How does OFAC calculate a penalty?

It sets a base amount from two determinations, then moves it up or down. Part 505 points to where the method lives: "Guidelines for the imposition or settlement of civil penalties by OFAC are contained in appendix A to part 501 of this chapter" (31 CFR 505.402(d)). The first determination is whether the case is egregious, which OFAC decides at Director or Deputy Director level with "particular emphasis" on two General Factors, willful or reckless violation and awareness of the conduct. The second is whether the violation was voluntarily self-disclosed.

The base amount then moves with the General Factors, eleven in all, from harm to sanctions program objectives to the compliance program in place at the time. Two adjustments are written as numbers: "in cases involving substantial cooperation with OFAC but no voluntary self-disclosure", the base "generally will be reduced between 25 and 40 percent", and for a first violation it "generally will be reduced up to 25 percent", a first violation being one with no penalty notice or Finding of Violation in the preceding five years (appendix A, section V.B.2.b). Throughout, "neither the base amount nor the proposed penalty will exceed the applicable statutory maximum amount".

Where the penalty rules sit now: part 505

Since September 25, 2026, the statutory penalties for IEEPA and UNPA programs are in the new Sanctions Penalties Regulations, 31 CFR part 505, and OFAC says the move changed nothing of substance. The final rule reproduces penalty provisions "currently located in individual parts of 31 CFR chapter V into a new part" and states: "No substantive changes to these penalty provisions are being made with this rule" (91 FR 60821). A second rule, effective September 30, 2026, removed the duplicate penalty subparts from the program parts and pointed them to part 505.

IEEPA provides for a maximum civil penalty not to exceed the greater of $377,700 or an amount that is twice the amount of the transaction that is the basis of the violation with respect to which the penalty is imposed.

31 CFR 505.401(a)(2), Sanctions Penalties Regulations

What did not move matters as much. The Enforcement Guidelines, with the base penalty matrix, the late-reporting amounts and the definition of voluntary self-disclosure, remain appendix A to part 501, and the reporting duties remain in 501.601 to 501.604. Procedures that cite the old program-part penalty sections, such as a "subpart G" of a program's regulations, need their citations updated, not their substance.

The OFAC base penalty matrix

The matrix has four cells, and the one most banks land in is the non-egregious, not self-disclosed cell, where the base is the "applicable schedule amount" for the transaction's value. That schedule is a step function, so a small transaction can carry a base penalty several times its own value.

The schedule itself has seven steps: a transaction under $1,000 carries a schedule amount of $1,000; $1,000 to under $10,000, $10,000; $10,000 to under $25,000, $25,000; $25,000 to under $50,000, $50,000; $50,000 to under $100,000, $100,000; $100,000 to under $200,000, $200,000; and $200,000 or more, the statutory maximum (appendix A, section I.B).

Take the sample bank's rejected Iranian credit of $2,450.00 as an illustration of the step. Had it been processed instead of rejected and come to OFAC's attention through another bank, the non-egregious base would have been the $10,000 schedule amount for a transaction of $1,000 to under $10,000, about four times the payment. Self-disclosed, the base would have been half the transaction value, $1,225. That gap is the whole argument for finding and reporting your own errors first.

How much is the penalty for a late OFAC report?

Up to $3,642 if it is filed within 30 days of the due date, up to $7,289 if later, and, for a report on blocked assets, up to $1,459 more for every 30 days it stays overdue. Those are the amounts OFAC set on January 15, 2025 (90 FR 3687); the eCFR's text of appendix A, section IV.B still prints the 2024 amounts of $3,550, $7,104 and $1,422. The current text does show the extension that matters most: for blocked-asset reports the additional amount runs "for every 30 days that the report is overdue, up to 10 years" (appendix A, section IV.B).

OFAC's own cases show how the increments add up. In the Gracetown penalty, the statutory maximum for the reporting violations was $71,094 (OFAC, Gracetown). That equals $7,104 plus 45 increments of $1,422, the pre-2025 amounts, which matches the 45 months the report was overdue; the arithmetic is ours. At the 2025 amounts the same delay would reach $7,289 plus 45 × $1,459, or $72,944.

Failing to answer OFAC's demands for information is priced separately, and monthly. Under section IV.A, failure to furnish information under 31 CFR 501.602 can bring up to $29,150, or up to $72,876 where the transactions involved exceed $500,000, and "the penalties described above may be imposed each month" the failure continues. GVA Capital's subpoena response took 28 months to complete, "resulting in 28 violations of § 501.602", and the reporting part of its statutory maximum was $1,988,868 (OFAC, GVA Capital), which is 28 times the pre-2025 monthly amount of $71,031.

How much does voluntary self-disclosure save?

In a non-egregious case, it changes the base from a schedule amount to half the transaction value, which for most bank payments is the difference between a multiple of the payment and a fraction of it. But the definition is strict, and one exclusion bites banks in particular.

Notification to OFAC of an apparent violation is not a voluntary self-disclosure if: a third party is required to and does notify OFAC of the apparent violation or a substantially similar apparent violation because a transaction was blocked or rejected by that third party (regardless of when OFAC receives such notice from the third party and regardless of whether the Subject Person was aware of the third party's disclosure)

31 CFR part 501, appendix A, section I.I

That is the reporting system working against the bank that missed something. When a payment a bank should have stopped is blocked or rejected by the next bank in the chain, that bank's report reaches OFAC within 10 business days, and the first bank can no longer self-disclose. A disclosure must also be complete: OFAC "will generally expect such a report within 180 days after the initial notification" when the first notice does not include it (OFAC FAQ 13).

The 2026 Bank of America settlement shows both cells of the matrix in one number. Of 475 apparent violations, OFAC found 413 not voluntarily self-disclosed and 62 self-disclosed, and the base of $11,662,930 was "the sum of (i) the applicable schedule amount for each non-voluntarily self-disclosed apparent violation and (ii) one-half of the transaction value for each voluntarily self-disclosed apparent violation". The settlement "reflects no reduction to the base penalty, including no mitigation for remedial measures or cooperation" (OFAC, Bank of America, 2026); OFAC's release also notes that the bank "did not promptly respond to all requests for information".

What is the maximum IEEPA penalty in 2026?

The greater of $377,700 or twice the value of the transaction, per violation, for civil penalties; up to $1,000,000 and, for an individual, 20 years in prison for willful violations (31 CFR 505.401). The $377,700 figure took effect on January 15, 2025, and the September 2026 rule that created part 505 restates it. Civil amounts are adjusted for inflation under the Federal Civil Penalties Inflation Adjustment Act, so the figure should be checked against the Federal Register each year. The limitation period is now 10 years for violations after April 24, 2019, which is why records are kept for 10 years too (OFAC guidance, 2024).

Cautionary letter or Finding of Violation?

A cautionary letter is a warning without a finding; a Finding of Violation is a finding without a fine. The Guidelines draw the line in one phrase each: a cautionary letter "does not constitute a final agency determination as to whether a violation has occurred", while a Finding of Violation "constitutes a final agency determination that a violation has occurred" (appendix A, sections II.C–D). Both count later. A Finding of Violation in the previous five years removes the first-violation reduction, and cautionary letters feed the General Factors: Bank of America's settlement listed "multiple cautionary letters regarding substantially similar conduct" among its aggravating factors.

Three reporting cases, priced

Reporting violations rarely stand alone; they ride with the transactions they should have reported, and OFAC prices both. The table separates the reporting component where OFAC's release does.

OFAC penalties by year, 2020 to 2026

OFAC's yearly totals swing by two orders of magnitude, and a year is usually made by one or two cases. The counts are steadier: between 12 and 20 actions in each full year since 2020. A compliance budget built on the totals would be built on Binance and British American Tobacco.

What the arithmetic means for OFAC reporting controls

Late-report penalties are small; what they reveal is not. A blocking report filed late usually means a block was not recognized, an account was not opened, or the decision sat in a queue, and OFAC's penalty for the underlying conduct dwarfs the reporting amount. Reporting is also how OFAC learns of other banks' failures, which is why a missed block found by the next bank in the chain removes the self-disclosure discount. The cheapest control is a clock that cannot be miscounted and a report that cannot be filed without its sources, which is the part of the problem counting 10 business days from the event and tying the annual report to the general ledger address.

In OFAC Reporting, a late hand-off shows the days already used, so nobody finds them on day 11

In the sample bank, every report in 2026 reached OFAC within 10 business days, and the solution's file for each one holds the event date, the count, the sources, the approvals and the receipt, which is also what OFAC will ask for if a case ever comes. The whole chain is on the OFAC Reporting page.

Questions people ask

Is a late report penalized even if the payment was blocked correctly?

It can be. Late filing of a required report is its own violation under appendix A, section IV.B, with maximums of $3,642 within 30 days and $7,289 after, plus $1,459 for each further 30 days on blocked assets. A correct block reported late is still a reporting violation.

Does OFAC publish every penalty?

For entities, yes: 31 CFR 505.102 requires OFAC to publish, at least monthly, the entity's name and location, the programs, a description of the violation, whether it self-disclosed and the amount. For individuals, OFAC releases aggregate information and generally not names.

How long does OFAC have to bring a case?

Ten years from the latest date of the violation, for IEEPA and TWEA violations after April 24, 2019, under the 21st Century Peace through Strength Act. Issuing a Pre-Penalty Notice or a Finding of Violation counts as starting the action.

Can the final penalty be higher than the Pre-Penalty Notice?

Only slightly. Appendix A says the penalty in the Penalty Notice will not exceed the proposed penalty "by more than 10 percent", or add new violations, unless OFAC first sends a revised Pre-Penalty Notice.

How long does a bank have to answer a Pre-Penalty Notice?

Thirty days, under 31 CFR 505.402(b)(2); failing to respond waives the right to respond. If the due date falls on a weekend or federal holiday, it moves to the following business day.