OFAC reporting in 10 business days: when the clock really starts

OFAC reporting is due within 10 business days of the event that triggers it: the date property becomes blocked, the date a prohibited transaction is rejected, or the date blocked property is unblocked or transferred. The clock does not wait for the alert to be cleared, for the file to reach compliance, or for a fintech partner's processor to send it on. Part 501 never defines "business day", so the working reading, and the one OFAC uses in its own penalty rules, is Monday to Friday without federal holidays. The days are lost quietly: in an alert queue, across a long weekend, in a partner's inbox. Botminds' OFAC Reporting starts its count at the event date, shows every day it skipped and why, and tells the analyst on arrival how many of the 10 a late hand-off has already used.

The counts on this page are from a fictional sample bank, Tessaly Community Bank, in October 2026, as its items run through the solution; the people and companies named are fictional. The rules are linked where they are quoted.

When does the OFAC reporting clock start?

On the date of the event the rule names, and nowhere else. For a block, "Reports shall be filed within 10 business days from the date that property becomes blocked" (31 CFR 501.603(b)(1)(i)). For a reject, "Reports shall be filed within 10 business days of the rejected transaction prohibited by the provisions of this chapter" (31 CFR 501.604(c)). For a release, reports are due "within 10 business days from the date blocked property is unblocked or transferred" (31 CFR 501.603(b)(3)(i)). None of the three mentions the alert, the decision or the hand-off.

For a block, the event can come earlier than the decision. Blocking happens by operation of law once a blocked person's property comes into the bank's possession, and OFAC's FAQ 53, rewritten on October 26, 2026, ties that moment to the customer's instructions: once a bank "receives payment instructions from a customer to send a wire transfer to a blocked person", it should block the funds and report "within 10 business days from the date that property becomes blocked by the bank". The same answer draws the line for rejects: a customer who only asks whether a payment to Iran is allowed leaves "nothing to reject", while instructions to send it must be rejected and reported (OFAC FAQ 53). So the hours an alert spends waiting in a queue come out of the 10 days, not before them.

That is why a procedure should record the event date as its own field, separate from the alert date, the decision date and the date the report was opened. In the sample bank all three were the same afternoon for the Iranian credit: hit at 2:36 PM, disposition at 2:51 PM, decision to reject at 2:58 PM, return posted at 3:12 PM on Friday, October 2. For the partner's item they were a week apart.

Is the OFAC deadline 10 business days or calendar days?

Business days. All three deadlines in part 501 say "10 business days", and so does OFAC's basic FAQ: parties "must report blocked property to OFAC within 10 business days of the property becoming blocked" (OFAC FAQ 9). Some older OFAC answers shorten it to "within 10 days" or "within ten days", and some procedures copied that wording. The regulation controls, and the difference is not small: 10 calendar days from Friday, October 2, 2026 end on Monday, October 12; 10 business days, with the Columbus Day holiday skipped, end on Monday, October 19, a full week later.

Do federal holidays count toward the OFAC deadline?

No, on the usual reading. Part 501 is silent, but OFAC's own procedural rules treat weekends and federal holidays as the days that are not business days. In the new Sanctions Penalties Regulations, for instance, the deadline for answering a Pre-Penalty Notice says: "If a due date falls on a Federal holiday or weekend, that due date is extended to include the following business day" (31 CFR 505.402(b)(2)(ii)). Counting Monday to Friday without federal holidays matches that usage, and it is the count the FFIEC manual's "within 10 business days of the occurrence" is normally read to mean (FFIEC manual).

Two practical rules follow. A closure that is the bank's own, such as a state holiday that is not a federal one, a storm closure or the day after Thanksgiving, does not stop the clock on this reading; a bank that treats its own closures as non-business days is giving itself days OFAC has not given. And because the term is undefined, the margin belongs in the procedure, not in the count: the sample bank counts strictly, reminds the analyst on days 3, 5 and 7, and escalates to the Deputy BSA Officer on day 8 and the Chief Risk Officer on day 9.

The due date that explains itself

The sample count: rejected Friday, filed on day 6

The sample bank's incoming international ACH credit of $2,450.00 was rejected on Friday, October 2, 2026. Saturday and Sunday do not count. Monday, October 5 to Friday, October 9 are business days 1 to 5. Columbus Day on Monday, October 12 is skipped, so Tuesday, October 13 is day 6, and the report is due on day 10, Monday, October 19.

Inside those days, the work moved like this. The drafting agent filled all seven fields of the rejected transaction report on day 1. The analyst corrected one field, the description of the transaction, and sent it to the officer on day 5. The officer signed and filed on day 6, with four business days to spare. None of that was fast in absolute terms; what made it safe was that nobody had to count, and that the day the report waited for the officer was visible to both of them.

What if a fintech partner tells us late?

The clock has already been running. If the partner's processor rejected the transfer on the bank's behalf on Tuesday, the bank's 10 business days began on Tuesday, whatever day the file arrives. Reporting cannot be handed off either: the rule says "No person is excused from filing a report by reason of the fact that another person has submitted a report with regard to the same property, except upon actual knowledge of the report filed by such other person" (31 CFR 501.603(a)(2)). A sponsor bank should know, item by item, whether a report has been filed and by whom.

The sample bank's second item shows the cost. The partner's processor rejected an outgoing $31,500.00 transfer on Tuesday, October 6, and handed it to the bank at 9:05 AM on Tuesday, October 13. Three business days had passed at the partner, Columbus Day was skipped, and the day of arrival was day 4: the analyst started with six business days, not ten, and the payment instruction the report must attach was missing. The Intake agent started the clock at October 6, flagged the missing document for the analyst to request, and moved the item's day-8 escalation to Monday, October 19.

A late hand-off: the clock counts from the event

The R16 return and the international ACH entry

R16 is the ACH return reason code for an entry stopped for sanctions reasons, "Account Frozen/Entry Returned Per OFAC Instruction" in the Treasury's guide to federal ACH payments (Bureau of the Fiscal Service). For a rejected inbound credit, the date of the return is normally the date of the rejection, and the return file is one of the documents the report should cite. A return posted days after the decision is a sign that the decision and the money moved separately, and the report should use the date the transaction was actually rejected.

International ACH entries carry an extra duty on the receiving side. The FFIEC manual makes the receiving bank answer for OFAC compliance on every inbound IAT, whether or not the sender set the entry's OFAC flag (what that costs a payments desk is in the price of an OFAC hold), and says due diligence may mean "screening the parties to a transaction, as well as reviewing the details of the payment field information" before "ultimately blocking or rejecting the transaction, as appropriate" (FFIEC manual). The sample bank's credit was caught that way: the addenda named the Tehran originator, and the addenda went into the report as part of its payment instructions.

What happens if an OFAC report is filed on day 11?

It is late, and a late report is a violation of its own, separate from anything about the payment. Under OFAC's Enforcement Guidelines as adjusted on January 15, 2025, late filing of a required report can draw a civil penalty of up to $3,642 if filed within the first 30 days after it was due and up to $7,289 if later; for a report on blocked assets, up to $1,459 more for every further 30 days overdue (90 FR 3687). Those are maximums, and OFAC weighs them with its General Factors, but the arithmetic in how OFAC calculates a penalty shows how they add up when a block goes unreported for years.

The more likely consequence is a finding at examination. Every report in ORS carries the date it was filed, every block and reject has an event date in the bank's own systems, and an examiner who samples a dozen items can compare the two in an afternoon. A bank that misses by one day because of a holiday it counted, or a partner it waited for, has the same exception as one that forgot.

How the UK's “as soon as practicable” compares

The UK sets no day count at all. OFSI's general guidance says a relevant firm must inform OFSI "as soon as practicable if it knows, or has reasonable cause to suspect, that it holds funds or economic resources" for a designated or prohibited person (OFSI, UK financial sanctions general guidance). A U.S. bank with a London branch therefore runs two clocks of different kinds on the same designation.

The U.S. rule is easier to test and harder to argue with. An examiner does not have to judge whether a delay was reasonable; the count either fits in ten business days or it does not. That is the strongest reason to make the count mechanical in the bank's own systems as well.

Clock rules to write into the OFAC reporting procedure

Most late reports come from a small number of habits, each of which can be replaced by a written rule. The list below is what the sample bank configures as versioned settings in the solution, and what we would expect any procedure to state in some form.

The requirements behind each report are set out in OFAC's reporting requirements, field by field, and the full chain of one item, from the hit to the receipt, is on the OFAC Reporting page.

Questions people ask

How many business days do you have to report a blocked transaction to OFAC?

Ten, counted from the date the property became blocked, under 31 CFR 501.603(b)(1)(i). A rejected transaction is also reported within 10 business days of the rejection, and an unblocking or transfer of blocked property within 10 business days of the release.

Does the clock start when the alert fires or when compliance decides?

Neither, strictly: it starts on the date the property is blocked or the transaction rejected. OFAC's FAQ 53 ties a block to the customer's payment instructions, not to the analyst's decision, so time an alert spends in a queue before the decision comes out of the 10 days.

What if day 10 falls on a federal holiday?

A federal holiday is not a business day on the usual reading, so it is skipped and day 10 falls on the next weekday that is not a holiday. OFAC's own penalty rules use that convention, extending a due date that lands on a weekend or federal holiday to the following business day.

Is the annual report also due in 10 business days?

No. The annual report of blocked property has a fixed calendar date: it covers property held as of June 30 and must be filed by September 30, under 31 CFR 501.603(b)(2).

What is the R16 return code?

R16 is the ACH return reason "Account Frozen/Entry Returned Per OFAC Instruction". A bank that returns an entry for sanctions reasons uses it, and the rejected transaction report should give the date of the rejection and attach the payment instructions, including any IAT addenda.

Can a fintech partner file the OFAC report instead of the sponsor bank?

Another party may file on the holder's behalf, but under 31 CFR 501.603(a)(2) primary responsibility stays with the actual holder, and no one is excused from filing because someone else did, unless they actually know of that report. A sponsor bank needs proof of each filing, not an assurance.