OFAC reporting requirements, field by field (2026)

OFAC's reporting requirements, set out in 31 CFR part 501, oblige any U.S. person that blocks property, rejects a prohibited transaction, or unblocks or transfers blocked property to report it to OFAC within 10 business days, and anyone holding blocked property to file an annual report of everything held as of June 30, due by September 30. Initial blocked, rejected and annual reports must go through the OFAC Reporting System, and records of each transaction must stay available for examination for 10 years since March 2025. Each report has its own list of required fields, and the lists differ in ways that cause real errors: a rejected report has seven elements, a blocked report nine, and neither may name "SDN" as its legal authority. Botminds' OFAC Reporting exists to get those fields right under the clock: agents draft each one from the payment message, the decision and the general ledger, cite the source, and leave the signature to the OFAC Officer.

Examples on this page come from a fictional sample bank, Tessaly Community Bank, as its items run through the solution; the people and companies named are fictional. The rules are quoted from the Code of Federal Regulations and OFAC's own guidance, linked where they appear.

What are OFAC's reporting requirements? Four reports, three clocks

There are four reports, and three of them run on the same 10-business-day clock counted from a different event. A bank that blocks a wire, rejects an ACH entry, releases funds under a license and holds a few frozen accounts in one year will file all four. The table is the short version every analyst should be able to recite.

The volume behind those four rows is larger than most people outside sanctions teams assume. In its 2024 notice to renew the paperwork approval for these collections, OFAC estimated about 10,900 unique respondents filing roughly 2,502,086 responses a year, with "the majority of filers providing a small number of responses and a small number of filers submitting a higher number of responses" (OFAC, 89 FR 74375). Those counts include license reports and remittance reports, not only blocks and rejects, but they show how routine the work is at scale.

What must a blocked property report include?

Nine elements, (A) through (I) of 501.603(b)(1)(ii), and every one is required. Most are what any operations team would expect: who holds the property and whom to call, the transaction and every party to it with locations, the sanctions target, a description of the property with account numbers, the date blocked, the value in U.S. dollars, and copies of the instructions and documents received.

Three elements are where blocked reports go wrong. The target's interest: where it is not evident, the report must give "a narrative description of the interest(s) of the target(s) in the property", which matters most when the target is an entity blocked under the 50 percent rule and appears nowhere in the payment. The value: loans, credit card receivables and other negative balances go in at $0.00 with the amount owed in a narrative, trade finance documents at $0.00 with the shipment value, and foreign-currency items in dollars with the foreign amount and notional rate. Action taken: the rule's own example is depositing the property into a blocked, interest-bearing account "that is labeled as such" and identifies the blocked person's interest, so the report records a step that deposit operations, not compliance, performs.

What must a rejected transaction report include?

Seven elements, listed in 501.604(b)(1)–(7), but only "to the extent the information is available to the person submitting the report at the time the transaction is rejected". OFAC explained what that limit means in two 2020 FAQs. It "generally does not expect reporters to seek further information from their counterparty solely to obtain additional information", but it sets a floor.

OFAC would expect at a minimum that all rejected transaction reports include required information that is applicable in all reject scenarios (e.g., information regarding the submitter of the report, the date the transaction was rejected, the legal authority or authorities under which the transaction was rejected, and any relevant documentation received in connection with the transaction).

OFAC FAQ 820, Filing Reports with OFAC

The rejected report also reaches further than many banks realize. Since the June 2019 amendment, it applies to every U.S. person, not only banks, where before only U.S. financial institutions had to report rejected funds transfers (31 CFR 501.604). And "transaction" is defined broadly in 501.604(a)(3), to include "wire transfers, trade finance, transactions related to securities, checks, or foreign exchange, and sales or purchases of goods or services".

The seven elements of a rejected transaction report, each with its source

Do I report unblocked or transferred property? Yes, since 2024

Yes. A third report, added by the May 2024 interim final rule and finalized on October 8, 2024, is due within 10 business days of the date blocked property is unblocked or transferred (31 CFR 501.603(b)(3)). The rule gives the obvious example of release under a court or agency order, including a judgment under the Terrorism Risk Insurance Act or a forfeiture order. It must include a copy of the original blocking report and its OFAC Reporting System identification numbers, which is why a bank that cannot find its old blocking report has a problem on the day it releases the money.

Four releases need no report: authorized debits for normal service charges; transfers between blocked accounts in the bank's own branches; unblocking explicitly authorized by a general or specific license, unless the license demands a report; and unblocking because OFAC removed the person from the SDN List. That last exception is narrower than it sounds. Property can stay blocked after one owner is delisted if another blocked person still has an interest in it, and an analyst who releases on the delisting alone is reporting nothing for property that was never free.

Why “SDN” is never the legal authority

Because SDN names a list, not a law. Both report rules carry the same parenthetical, and it is one of the most quoted lines in OFAC reporting training.

(Note: For this purpose, the term “SDN” is generic and cannot be used to identify the legal authority for blocking property)

31 CFR 501.603(b)(1)(ii)(H)

The legal authority is what made the block or reject mandatory: the sanctions program, the CFR part that implements it (31 CFR part 515 for Cuba, for example), an Executive order such as E.O. 13224, or a statute such as the Foreign Narcotics Kingpin Designation Act. A person on the SDN List may be designated under several authorities at once, and the report should name the ones that apply to this property. The sample bank's rejected Iranian payment names the Iranian Transactions and Sanctions Regulations, 31 CFR part 560. The annual report adds one twist: OFAC's 2026 filing guidance asks for the program tags from its Program Tag Definitions page, separated by commas, which the guide to the blocked property report template works through row by row.

Do you have to use the OFAC Reporting System?

For initial blocked reports, rejected reports and the annual report, yes. The May 2024 interim final rule, effective August 8, 2024, made ORS compulsory for reports on blocked property and rejected transactions and, in OFAC's words, "removed the mail option for certain other types of OFAC submissions" (OFAC final rule, 89 FR 81358). A filer that cannot use it must show "unique and extraordinary circumstances", such as no internet access, and ask for an alternative, which OFAC presumes to deny and grants only in writing.

Unblocking and transfer reports are the exception: 501.603(d)(2) lets them go by email to OFACReport@treasury.gov, with the section number in the subject line, or through ORS. OFAC's older FAQs still say that complete information "may be emailed" for blocking and reject reports too; the regulation has overtaken them. What the OFAC Reporting System does, and what it leaves to the bank, covers registration, report IDs and amendments.

How long must OFAC records be kept? 10 years, not five

Ten years. The current text of 31 CFR 501.601 requires a full and accurate record of each transaction subject to OFAC's rules to be "available for examination for at least 10 years after the date of such transaction", and for blocked property "for the period of time that such property is blocked and for at least 10 years after the date such property is unblocked" (31 CFR 501.601). The change followed the statute: the 21st Century Peace through Strength Act, signed April 24, 2024, extended the statute of limitations for IEEPA and TWEA violations from five years to 10, and OFAC said it "may now commence an enforcement action ... within 10 years of the latest date of the violation if such date was after April 24, 2019" (OFAC guidance, July 22, 2024).

The examination manual has not caught up. The FFIEC's OFAC section still gives five years for rejected-transaction records, and five years after unblocking for blocked property (FFIEC manual; the manual's lines are set beside the rule in OFAC requirements for credit unions). Follow the regulation. A bank whose retention schedule was written from the manual, or that applies the five-year BSA retention period of 31 CFR 1010.430(d) to its sanctions files, is purging records OFAC can still ask for. Where a document serves both regimes, the longer period applies.

One honest complication: banks with European operations told OFAC that EU data rules can require deletion after five years. OFAC acknowledged "potential tension between EU and U.S. retention requirements" and pointed to General Factor K of its Enforcement Guidelines as the place it accounts for conflict of laws, but adopted the rule unchanged (90 FR 13286).

What changed between 2024 and 2026

The reporting rules have moved more in the last three years than in the previous twenty, and a procedure written before 2024 is probably wrong in at least one place. The September 2026 rules moved provisions rather than adding duties: the penalty provisions went to a new part, and the program parts were reorganized, so citations in procedures and training need checking.

What a complete OFAC reporting file holds

A complete file is the report plus everything an examiner needs to test it ten years later. The rule itself asks that "A copy of reports submitted pursuant to this section shall be retained for the submitter's records" (31 CFR 501.603(d)(1)), and the FFIEC manual adds that blocking reports are no substitute for a SAR when the bank holds more information than the report asks for, or when the transaction would be suspicious without the sanctions match.

In the sample bank's file for its rejected Iranian payment, the solution keeps the payment message, the disposition, the decision, the return file, the agent's draft, the analyst's change with its reason code, the officer's approval and the OFAC receipt, sealed with a checksum and kept until October 2, 2036. The same file feeds an examiner's export, redacted to the last four digits of every account.

Filed on day 6, the file sealed until 2036

The whole set, from the first hit to the sealed file, is on the OFAC Reporting page.

Questions people ask

Do I have to report a rejected payment if no SDN is involved?

Yes. 31 CFR 501.604 covers any transaction "that is not blocked" but where processing it "would nonetheless violate" OFAC's rules, which is exactly the case of a sanctioned country or sector with no blocked person. The report is due within 10 business days of the rejection, and the sanctions target field is completed only "if applicable".

Does the 10-business-day deadline apply to the annual report?

No. The annual report of blocked property has a fixed calendar: it covers property held as of June 30 and is due by September 30. OFAC's 2026 guidance adds that the reporting period begins July 1 and that failing to submit a completed report by September 30 is itself a violation.

Do I need to file a SAR as well as an OFAC report?

Not always. The FFIEC manual says banks "no longer need to file SARs based solely on blocked narcotics- or terrorism-related transactions, as long as the bank files the required blocking report", but it expects a SAR when the bank holds information the blocking report does not ask for, or when the transaction would be suspicious anyway.

Are OFAC's paper forms still used?

Only by filers OFAC has excused from electronic filing. Its 2024 paperwork notice lists TD-F 93.02 for blocked financial property, TD-F 93.08 for non-financial property and TD-F 93.07 for rejected transactions as forms for "filers who have been granted an exception"; everyone else uses the forms inside ORS. The annual report is the TD F 90-22.50 spreadsheet for everyone.

Can the bank keep OFAC records for only five years like other BSA records?

No. BSA records under 31 CFR 1010.430 are kept five years, but OFAC records under 31 CFR 501.601 are kept 10 years, and for blocked property 10 years after it is unblocked. Where one document serves both, keep it for the longer period.