OFAC requirements for credit unions with one compliance officer

The OFAC requirements for credit unions are the same as for any bank: a credit union is a U.S. person, so it may not deal with anyone on OFAC's lists or in a sanctioned jurisdiction unless a license allows it, it must block or reject and report within 10 business days, and it must keep the records for 10 years. There is no credit-union version of the rules and no size exemption. What the examiners scale to size is the program around them, and at a small credit union that program can be one compliance officer who screens members, clears alerts, files reports and answers every "can we send this?" from the teller line. Botminds' OFAC Sanctions Search exists for that last part: a member service representative asks in plain words, agents find the program and the license in force that day and cite the passage, and the officer confirms instead of researching from scratch.

The research figures below come from OFAC, the FFIEC and the NCUA, linked where they appear. The worked examples come from the solution's fictional sample bank, Tessaly Community Bank, a community bank with one BSA/OFAC Officer.

What are the OFAC requirements for credit unions?

A credit union must comply with OFAC because it is a U.S. person, not because of any rule written for credit unions. OFAC's own answer is broad: every U.S. citizen and permanent resident wherever they live, everyone in the United States, and every U.S.-incorporated entity with its foreign branches (OFAC FAQ 11). Who exactly counts as a U.S. person, and where foreign subsidiaries come in, is set out in who must comply with OFAC.

The obligations themselves are few and absolute. Do not deal with a blocked person or property in which one has an interest. Do not process a transaction a program prohibits. Block what must be blocked and reject what must be rejected, then report either to OFAC within 10 business days. Keep full records. Liability is strict: OFAC "may impose civil penalties for sanctions violations based on strict liability", even where the person "did not have knowledge" the transaction was prohibited (OFAC FAQ 65). A credit union that pays a newly listed member on the day of designation has violated the rule; how good its screening was then shapes OFAC's response.

The program around those obligations is where the examiners come in. NCUA's own BSA resources page points credit unions to OFAC's regulations in 31 CFR chapter V and to the interagency FFIEC BSA/AML Examination Manual (NCUA). The manual's OFAC section is candid that the program itself is "not required by specific regulation", but expects one "as a matter of sound banking practice", written and "commensurate with their OFAC risk profile (based on products, services, customers, and geographic locations)" (FFIEC manual, OFAC section).

Does a small credit union need OFAC software?

Not necessarily: OFAC leaves the choice to the risk and to the examiner. Asked whether expensive software is required, OFAC points the question to the institution's regulator, notes that the packages on the market differ widely in price and capability, and says its sanctions lists can be "manually scanned" or searched with its "free, online search engine" (OFAC FAQ 27). The FFIEC manual says the same from the examiner's side: "Banks with lower OFAC risk and those with low volumes of transactions may decide to manually filter for OFAC compliance" (FFIEC manual).

Manual filtering is a permission, not a default. The same paragraph ties the sensitivity of any filter to the institution's own risk and transaction volumes, and expects higher-risk, high-volume areas to catch close variants of listed names (sanctions screening threshold explains how that sensitivity is set). A credit union that sends a handful of international wires a month can defend a person searching each party on OFAC's Sanctions List Search. One that runs a remittance product or a fintech partnership will struggle to, because hand-searching thousands of names leaves no record of what was searched and no way to rescreen them all when the list changes.

OFAC's practical advice on choosing is to ask peers which package they use and whether it works for them (OFAC FAQ 31; a side-by-side of the approaches is in sanctions screening software comparison). For a credit union that usually means the core processor's screening module, a vendor list service, or the free tools, and what the free check leaves open, and what each answer really costs is worked through separately.

How often should a credit union screen its members against the OFAC list?

New members before the account opens or shortly after, and existing members whenever the list changes, at a frequency the risk assessment can defend. The FFIEC manual wants new accounts checked before they open or shortly after, in that night's batch for instance, and an institution that checks after opening should hold back anything but the initial deposit until the check is done. For the existing base it expects a check whenever OFAC adds or changes an entry, and lets lower-risk institutions run the base on a fixed weekly, monthly or quarterly cycle instead (FFIEC manual; how fast list changes arrive is in OFAC sanctions list updates).

The lower end of that range has a known cost. In 2022 OFAC issued a Finding of Violation to MidFirst Bank, whose screening vendor checked new customers daily but ran the whole existing base only monthly. MidFirst had believed the daily run covered everyone, and two customers added to the SDN List kept transacting "for 14 days post-designation": 34 payments, starting within two hours of the designation (OFAC, MidFirst Bank FOV). A quarterly rescreen is permitted for a low-risk shop, but the officer should read the vendor contract as OFAC read MidFirst's.

"Institutions should be aware that OFAC is updating its sanctions lists at an ever increasing pace."

OFAC FAQ 88, on downloading the lists

The one seat: five duties the examiners expect one person to own

At a credit union with one compliance officer, the FFIEC's "responsible individual" is also the BSA officer, the trainer, the person who files the reports and the person everyone else asks. The manual asks that this person know OFAC's rules as well as the institution's risk profile demands (what the role signs and attests is in OFAC compliance officer). It does not ask that they answer every licensing question from memory, but in practice that is where the job goes.

Where the officer's week goes when the questions are not name matches

A whole class of OFAC questions never raises a screening alert. A member wants to send money to a relative in Cuba, pay a supplier in Dubai for goods bound for Iran, or buy from a seller in a city whose name the filter knows. Screening software answers "is this name listed?"; it does not answer which program applies, whether a general license covers the payment, or whether the member's facts meet every condition. Those questions go to the officer.

How long each one takes is easiest to see on a single example. The solution's own estimate splits the working minutes on one license question with a payment attached, answered by email, into six steps; the waiting time in the inbox is not counted. The research steps, finding the program and then the license with its conditions and dates, take more than a third of the time. The back-and-forth for a missing fact takes nearly a fifth.

Multiply that by the questions a week brings. In the fictional sample bank the one BSA/OFAC Officer answers about 90 questions a week from 41 branches, payments operations and a fintech partner program; a small credit union may see far fewer, but each takes the same research. The questions also cluster on the days the rules move. In the eight weeks from August 24 to October 21, 2026, OFAC suspended the Iran general license for personal remittances, set a presumption of denial for Iran-related license requests, rewrote parts of the Cuba rules and issued a new version of a Russia general license; every one of those changed the right answer to a question someone at a teller line could ask.

The question box a member service representative sees

Where can a one-person department get OFAC answers?

From OFAC's own published material first, then from OFAC's hotline, the regulator and peers, in roughly that order. OFAC's FAQs, program pages, regulations and recent-actions notices answer most questions, if the reader finds the right page and checks it is current; how to tell whether an OFAC answer is still right covers the dating problem in detail.

OFAC's Compliance Hotline now takes written queries through an online portal, and the hotline page sends anyone with a possible list match to FAQ 5 before they write in (OFAC Compliance Hotline). FAQ 5, rewritten as six steps on September 9, 2026, ends with a line every small institution should know: OFAC will not confirm a match or clear a false positive, and expects the institution to make its own risk-based call (OFAC FAQ 5; the six steps are walked in OFAC hit: what to do). A one-person department cannot hand the judgment to OFAC; it can only document it well.

The regulator answers questions about the program, not about a member's wire. Peers help with tools and procedures. What is left is the question that needs an answer before the member leaves the branch, and that is the gap a cited-answer service is built for.

Records: ten years since March 2025, not the five the exam manual prints

OFAC now requires records of each transaction to be kept for 10 years after it, and blocked-property records for 10 years after unblocking (31 CFR 501.601). The change from five years took effect on March 12, 2025 under an interim rule and was made final, unchanged, on March 21, 2025, "consistent with the statute of limitations" for civil enforcement (90 FR 13286).

The examination manual has not caught up, and a small institution that writes its policy from the manual will be out of date. The table sets the two side by side.

Where a cited-answer service fits a small institution, and where it does not

A cited-answer service fits the questions that are not name matches, the ones that today go by email to the officer. In OFAC Sanctions Search, the person who meets the member asks in plain words and can attach the payment; agents read the payment's fields, screen every party, find the program and every general license in force that day, and answer in one line: prohibited, authorized under a general license, or not covered. Each license condition is matched to a fact with its source passage and dates, and when a fact is missing the agents ask one plain question instead of guessing.

The officer stays the decision. The person who asks never confirms; the bank's policy names which answers the officer must confirm, on what clock, and with a reason code, and a rejection needs a second person. In the sample bank, answers wait on a 30-minute clock when the member is at the branch and 2 hours for a held payment, and the officer confirmed 1,361 answers this year at a median of 38 minutes, all figures from the fictional sample data.

One queue for the compliance officer, each answer on its own clock

It does not fit everything. It is not a screening engine: it sits beside the core's or the vendor's list screening and calls it, and it does not clear possible matches, which go to alert review. It does not decide ownership questions under the 50 percent rule; it opens a review with the facts filled in. And for a credit union that sees two OFAC questions a month, the free tools and a careful officer may be enough. The test is volume and stakes: how many questions a week reach the one desk, and how many of them touch Cuba, Iran, Russia or a license.

Questions people ask

Do OFAC rules apply to credit unions the same way as banks?

Yes. OFAC's prohibitions bind every U.S. person, and federally insured credit unions are examined against the same interagency FFIEC manual as banks. The FFIEC scales the expected program to risk, which is why a low-risk credit union may filter manually and rescreen periodically.

Can a credit union screen for OFAC manually?

It can if its risk and volume are low. The FFIEC manual says institutions "with lower OFAC risk and those with low volumes of transactions may decide to manually filter", using OFAC's lists or its free Sanctions List Search. The credit union should still record each search, because the record is what an examiner tests.

Who is responsible for OFAC compliance at a credit union?

The board and management are accountable, and the FFIEC recommends naming one or more qualified people to run the program day to day. At a small credit union that is usually the BSA officer. Using a vendor does not move the responsibility: the manual says the institution "is ultimately responsible for that third party's compliance".

How long must a credit union keep OFAC records?

At least 10 years after the transaction, and for blocked property 10 years after it is unblocked, under 31 CFR 501.601, in force since March 12, 2025 and made final on March 21, 2025. The FFIEC manual's OFAC section still says five years, so a policy written from the manual needs updating.

Does OFAC have to be reported within a set time?

Yes. A blocked-property report and a rejected-transaction report are both due within 10 business days, and an annual report of blocked property held on June 30 is due by September 30. All three are filed through OFAC's Reporting System.

Will OFAC tell us if a member is a true match?

No. FAQ 5, updated September 9, 2026, says OFAC will not confirm or rule out a match and expects a risk-based determination. The credit union compares the listing's details with what it knows about the member and records how it decided.