OFAC software vendors need eight things from a bank before a reporting tool can draft a correct report: the bank's own OFAC Reporting System registration and named filers; the list of blocked accounts with the general ledger account that holds them; last year's annual report of blocked property and the ORS report ID of each block; the holiday calendar the bank counts business days by; the feeds that deliver block and reject decisions, including any fintech partner's; the signer list and escalation path; a library of the program authorities the bank cites; and its retention schedule. All of it already exists, scattered across compliance, deposit operations, finance and IT. Brought together on day one, Botminds' target is a first drafted report in the first week; the input most often missing, a partner's hand-off feed, is the one that costs days on every report afterwards. Botminds' OFAC Reporting runs on exactly these inputs, and this guide uses it as the worked case, including what it cannot do without them. Which reporting tasks belong with software at all is a separate question, set out in OFAC compliance software; this guide starts once you are talking to a vendor.
Examples refer to a fictional sample bank, Tessaly Community Bank, as configured in the solution; its people and partners are fictional. Timings on this page are targets, not measured results.
Eight inputs a provider needs for OFAC reporting, who owns each, and why
| Input | Usually held by | Why reporting needs it |
|---|---|---|
| OFAC Reporting System registration and filers | BSA/OFAC Officer | Reports are the bank’s own and are submitted under its registration |
| Blocked accounts, with product, rate and general ledger account | Deposit operations and finance | Every blocked dollar must be in an interest-bearing account and tie to the general ledger |
| Last year’s annual report and each block’s ORS report ID | BSA/OFAC Officer | This year’s report must reconcile to last year’s and cite each initial report |
| Holiday calendar | Operations | The 10 business days skip weekends and federal holidays, and nothing else |
| Decision feeds: alert review, payment screening, partner processor | Compliance technology and the partner | The clock starts at the event, which only the source system knows |
| Signers, deputies and escalation path | BSA/OFAC Officer | Nobody signs their own work; escalations land on named people |
| Program authority library | BSA/OFAC Officer | “SDN” is never a legal authority; the annual report needs program tags |
| Retention schedule and legal holds | Records management and legal | OFAC records are kept 10 years, blocked property 10 years after release |
What do OFAC software vendors need from a bank?
Access to each item's details at their source, and the bank's own rules for counting, signing and keeping. A reporting tool that is given only a spreadsheet of past reports can format the next one; a tool connected to the case management system, the payments hub, the core and the general ledger can draft it, count it and check it. The table above is the full list for reporting. Screening is a separate project, and a provider who conflates the two will spend the first month on the wrong one.
The bank also brings decisions only it can make: which holidays it counts, who signs when the officer is away, what reason codes an analyst may use when changing a draft, and how long it keeps what. In the solution these are versioned settings that a compliance systems administrator edits and the BSA/OFAC Officer approves, so a change to the escalation path in March is visible beside the reports filed under the old one.
Do we need our own OFAC Reporting System login?
Yes. ORS registration belongs to the institution: OFAC registers the institution with a primary contact and the other people it names as filers (OFAC Reporting System), and a report filed by an agent is still the holder's report under 31 CFR 501.603(a)(2). Before go-live, confirm that at least two filer administrators are active, because OFAC's 2026 guidance tells filers whose administrators are all inactive to email OFAC for help (OFAC ARBP guidance). In OFAC Reporting the filing agent submits through the bank's ORS access only after the OFAC Officer has signed, and records each receipt against the item.
What historical OFAC reports should we load?
Three sets, in this order. First, every blocked account still open, with its initial blocking report and ORS report ID, because each one is a line on the next annual report and each release will need that report attached. Second, last year's annual report as filed, so the first roll-forward can check that every line that left has a reason. Third, every report filed since January 1, so the current year's examiner file is complete from the start; the sample bank's 2026 file held 33 reports with receipts by mid-October.
The older archive can follow. OFAC requires records to stay available for examination for at least 10 years (31 CFR 501.601), and most banks already keep them somewhere; what matters at go-live is an index, so that a request about a 2019 block can be answered without a search through shared drives.
The sample bank's reporting inputs, by count
5
blocked accounts, each with its blocking report and rate
3
lines on the previous annual report, as of June 30
1
general ledger account for blocked funds
1
fintech partner processor feed, the input that needed a retry queue
How do we connect deposit operations and the general ledger?
Through the blocked accounts and the one general ledger account they roll up to, with the rules written down. The provider needs the product code used for blocked funds, the general ledger account, the rate rule and who posts and confirms entries. The rate rule is regulatory: blocked funds must earn a commercially reasonable rate, which the Global Terrorism Sanctions Regulations tie to what other depositors are paid for comparable size and maturity (31 CFR 594.203). The same section adds two constraints worth configuring: blocked funds "may not be invested in instruments the maturity of which exceeds 180 days", and "If interest is credited to a separate blocked account or subaccount, the name of the account party on each account must be the same."
The sample bank uses one blocked savings product at the money market rate for comparable balances, 3.85% in October 2026, and one general ledger account, 2185-00. The tie-out runs at each month-end and whenever a blocked account opens; the agent proposes any missing entry, deposit operations posts it and the officer confirms. Agreeing those roles before go-live is what makes the first tie-out useful instead of a list of unexplained differences.
The examiner's file, collected from the connected systems
How do fintech partner hand-offs reach the OFAC report?
Through a feed that carries the event date, and that is the input most often missing. A sponsor bank whose partner's processor rejects or blocks payments needs each decision delivered with the date it happened, the decision itself, the payment instruction and the customer record. Without the event date, the bank counts from arrival and files late; without the instruction, it cannot attach what the report requires. The FFIEC manual is blunt about where responsibility sits when someone else does the work.
A provider can draft every report and keep every file. The bank still files, and the bank still answers for what it says.
That is the examiners' position too: a bank that hands OFAC work to an agent or service provider remains responsible for how the provider does it, as it would for any outsourced duty (FFIEC BSA/AML Examination Manual, OFAC; what that means for a small institution is in OFAC requirements for credit unions).
Contracts are where these feeds fail. OFAC's 2022 Finding of Violation against MidFirst Bank turned on a screening vendor, not a reporting one, but the lesson transfers: the bank believed its vendor's daily run checked every customer against each SDN List change, when the contract covered the whole base only once a month (OFAC, MidFirst Bank; the case is traced in OFAC sanctions list updates). For reporting, the contract with a partner should say what is sent, within how many hours of the event, in what format, and what happens when the feed is down.
The same partner reject, with and without a proper feed
Without a feed: email and spreadsheets: When someone at the partner remembers to send it
With a feed carrying the event date: When the processor rejects, or when the queued item is retried
Without a feed: email and spreadsheets: Often counted from arrival, which files late
With a feed carrying the event date: Counted from the rejection; days used shown on arrival
Without a feed: email and spreadsheets: Requested afterwards, if anyone notices they are missing
With a feed carrying the event date: Checked on arrival; a missing instruction requested the same day
Without a feed: email and spreadsheets: Silent
With a feed carrying the event date: Flagged, with items held at the partner until the feed answers
Without a feed: email and spreadsheets: An email thread
With a feed carrying the event date: The feed record, the arrival time and the event date side by side
The partner's item arrives with four of its ten days gone
The signers, the escalation path and the authority library
Three small configuration tables decide whether the tool behaves like the bank's procedure. The signer list says who prepares, who approves and who approves what the officer prepared; in the sample bank, the analyst prepares, the officer files, and the deputy signs the officer's own work. The escalation path says who hears about an item on which business day; the sample bank reminds the analyst on days 3, 5 and 7 and escalates to the deputy on day 8 and the Chief Risk Officer on day 9. The authority library lists, per program, the regulation the reports cite and the OFAC program tags the annual report uses, so that no report ever reaches the signer with "SDN" in the authority field.
Retention is the last setting and the one most often copied from the wrong place. OFAC records are kept 10 years, and blocked-property records for as long as the property is blocked and 10 years after; BSA records are kept five. Where one document serves both, the longer period applies, and a legal hold for an examination or litigation should need a second approval to set and to lift.
The first four weeks: a target plan
With the eight inputs in hand, the work of the first month is connection and checking rather than configuration. The plan below is Botminds' target for a community bank with one partner program, not a measured result; a bank with several partners or a large blocked-property book will take longer, and the partner feed is the usual critical path.
A target plan for the first four weeks of OFAC reporting
- Week 1: connect, load, first draftdecision feeds, blocked accounts
- Week 2: tie-out and roll-forwardgeneral ledger, last year
- Week 3: partner feed and retriescritical path
- Week 4: parallel run, sign-offofficer approves
Testing belongs in the plan from the start, not after it. OFAC's 2026 TradeStation release is about screening, but its warning applies to any compliance system: a well-designed program can be undone by ordinary human and technical errors, and a tool installed once and never checked again is not a control (OFAC, TradeStation Securities, 2026; a test file built from such cases is in sanctions screening testing). For reporting that means re-checking the holiday calendar each year, the partner feed after every outage, and the general ledger mapping after any change to the chart of accounts.
How to choose OFAC software: questions for the vendor
OFAC's own advice is modest and still right. It notes that many packages are on the market, at very different prices and with very different abilities, and it recommends talking "to your counterparts in other banks about the systems they have in place" (OFAC FAQ 27). For reporting, the questions below test what a provider will need from the bank and what the bank keeps if it ever leaves.
Nine questions to put to any OFAC software provider about reporting
- Which of our systems will you read, and which will you write to?
Reading the core and the general ledger is expected; writing to them should be a person’s act.
- Where does the event date come from?
From the source system for each kind of item, including the partner feed.
- What happens when a feed is down?
Items should queue and retry, and the outage should be visible.
- Who can change the holiday calendar or the escalation path?
And is every change versioned and approved?
- Whose ORS registration files the reports?
It should be the bank’s, with filing only after a named signer approves.
- How is last year’s annual report used?
For a roll-forward to this year’s, line by line.
- How long are records kept, and how are legal holds set?
Ten years for OFAC records; holds with a second approval.
- Can we export everything if we leave?
Reports, receipts, sources, approvals and settings history, in a usable form.
- What can the tool not see?
Property in systems it is not connected to will not appear on any report.
Where OFAC Reporting fits, and what it needs from you
OFAC Reporting works with the systems a BSA/OFAC program already runs on: case management for decisions, the payments hub for held and returned items and IAT addenda, the core for customers and blocked accounts, the general ledger for blocked funds, the OFAC Reporting System for filing and receipts, and the partner processor for hand-offs. It does not replace screening, and it does not decide, post or sign. What it needs from the bank is the list on this page, and the one thing worth starting first is the partner feed. A bank that wants to see it first can ask for a run on a sample of its own past blocked and rejected items and blocked accounts.
The split of work between agents and people is set out in which reporting tasks move to agents, and the portal side in what the OFAC Reporting System does and leaves to you. The solution itself is on the OFAC Reporting page.
Questions people ask
How long does OFAC reporting software take to set up?
It depends mostly on the inputs, not the software. Botminds' target for a community bank with one partner program is about four weeks to a parallel run, with a first report drafted in week one; the partner hand-off feed is usually what sets the pace.
Does the provider need access to our core banking system?
Read access to customer records and blocked accounts, yes, because the report's fields and the annual report's values come from there. Posting entries or changing rates should stay with deposit operations, confirmed by the officer.
Can we keep using our current screening system?
Yes. Reporting starts from the block or reject decision, so it connects to whatever system records that decision, whether sanctions alert review, payment screening or a partner's processor.
What if we have no blocked property today?
Then the annual report has nothing to list, but blocks, rejects and releases can happen any day, and each is due within 10 business days. The blocked-funds product, the general ledger account and the rate rule should be set up before the first block, not after it.
Who is responsible if the provider's system files late?
The bank. A report may be filed on the holder's behalf by an agent, but under 31 CFR 501.603(a)(2) primary responsibility stays with the holder, and the FFIEC manual says the bank is ultimately responsible for a third party's OFAC compliance.