Who must comply with OFAC? The US person rule, in plain words

All U.S. persons must comply with OFAC: every U.S. citizen and permanent resident wherever they live, every person physically in the United States, and every company organized in the United States together with its foreign branches. Under the Cuba and Iran programs, and for North Korea where a U.S. bank is the owner, foreign subsidiaries that a U.S. person owns or controls are bound as well. Non-U.S. persons are not bound by most prohibitions directly, but they may not cause a U.S. person to violate them or evade them, and some programs threaten foreign banks with secondary sanctions. For a bank the question arrives as "does this apply to my customer?", attached to a payment. Botminds' OFAC Sanctions Search answers it from the program's own definitions, cited with their dates, and leaves the decision on a payment with a named officer.

The definitions and cases below are OFAC's, linked where they appear. Payment examples come from the solution's fictional sample bank.

Who must comply with OFAC regulations?

Every U.S. person, and in some programs more. OFAC's own answer to "Who must comply with OFAC sanctions?" is: "All U.S. persons must comply with OFAC sanctions, including all U.S. citizens and permanent residents regardless of where they are located, all individuals and entities within the United States, and all U.S. incorporated entities and their foreign branches. ... In the case of certain programs, foreign subsidiaries owned or controlled by U.S. persons also must comply" (OFAC FAQ 11).

The same FAQ reaches past U.S. persons in two ways. "Non-U.S. persons are also subject to certain sanctions prohibitions. For example, non-U.S. persons are prohibited from causing or conspiring to cause U.S. persons to violate U.S. sanctions, as well as engaging in conduct that evades U.S. sanctions." And "certain programs also require foreign persons reexporting certain goods, technology, or services from the United States to comply with U.S. sanctions, even if no U.S. persons are involved in the reexport."

Compliance is not a matter of intent. Each program's prohibitions apply to the transaction, and the penalty rules now gathered in 31 CFR part 505 allow a civil penalty on "any person who violates, attempts to violate, conspires to violate, or causes a violation" of a regulation issued under IEEPA, up to $377,700 or twice the value of the transaction, whichever is greater (31 CFR part 505; how OFAC sets the actual figure is in OFAC penalty calculation).

What is a U.S. person under OFAC?

Each program defines it in its own regulations, and the definitions are close but not identical. The Iran regulations use the standard wording: a U.S. person is "any United States citizen, permanent resident alien, entity organized under the laws of the United States or any jurisdiction within the United States (including foreign branches), or any person in the United States" (31 CFR 560.314). The North Korea regulations repeat it word for word.

The Cuba regulations, the oldest, use a wider term, "person subject to the jurisdiction of the United States", which includes "Any individual, wherever located, who is a citizen or resident of the United States" and "Any corporation, partnership, association, or other organization, wherever organized or doing business, that is owned or controlled by" U.S. individuals or companies (31 CFR 515.329). That last clause is why a Colombian logistics company became bound by the Cuba embargo the day a Delaware company bought it.

Does OFAC apply to U.S. citizens and green-card holders abroad?

Yes, on both counts and in every program. A citizen who lives in Dubai and a permanent resident who moved back to Tehran carry the obligation with them; the definition says "wherever located". OFAC made the point for permanent residents in an enforcement release of September 10, 2026: "This case highlights that OFAC's prohibitions apply to all U.S. persons, including U.S. Lawful Permanent Residents. As is the case in most OFAC sanctions programs, OFAC's Iran sanctions program defines a U.S. person to include any U.S. citizen or permanent resident, wherever located" (OFAC, An Individual).

The case is worth reading for how ordinary the conduct looks. A permanent resident who had co-founded an Iranian software company before moving to the United States took part in 19 virtual meetings advising it, received $713,615 in Iranian-origin dividends into U.S. bank accounts through 16 wire transfers routed via Türkiye, the United Arab Emirates and Singapore, and bought four properties in Iran for relatives. OFAC found the 39 apparent violations egregious and not voluntarily disclosed; the settlement was $1,427,230. One of the three categories ran straight through U.S. banks: the dividends arrived as wires.

"Upon moving to the United States, U.S. Person-1 became subject to the same compliance obligations as other U.S. persons."

OFAC enforcement release, September 10, 2026

Do OFAC sanctions apply to foreign subsidiaries?

Under the Cuba and Iran programs, yes, and under North Korea for subsidiaries of U.S. financial institutions. Elsewhere, generally no, though the U.S. parent remains bound. The Iran rule prohibits "an entity that is owned or controlled by a United States person and established or maintained outside the United States" from "knowingly engaging in any transaction, directly or indirectly, with the Government of Iran or any person subject to the jurisdiction of the Government of Iran that would be prohibited" for a U.S. person, and defines owned or controlled to include a "50 percent or greater equity interest by vote or value" or a majority of board seats (31 CFR 560.215). The North Korea rule reaches "any person that is owned or controlled by a U.S. financial institution and established or maintained outside the United States" (31 CFR 510.214).

OFAC's July 2025 settlement with Key Holding, LLC shows how this catches companies off guard. Key Holding, a Delaware logistics company, bought a Colombian freight business in December 2021. Over the next 18 months the subsidiary managed 36 shipments to Cuba worth $3,056,264, most of them foodstuffs not eligible for a license. OFAC's finding was plain: "Key Holding U.S., a person subject to U.S. jurisdiction under the CACR, acquired Key Colombia in December 2021, thereby making Key Colombia also a person subject to U.S. jurisdiction." Neither company had a sanctions program covering the subsidiary, and Key Holding learned of the shipments in due diligence for its own sale. It paid $608,825 (OFAC, Key Holding).

Where the subsidiary rule does not apply, the parent's own conduct does. The Iran regulations bar any U.S. person, "wherever located", from approving, financing, facilitating or guaranteeing "any transaction by a foreign person where the transaction by that foreign person would be prohibited" if done by a U.S. person (31 CFR 560.208). A U.S. manager signing off a foreign affiliate's Iran deal violates the rule even if the affiliate does not.

Can a non-U.S. person violate OFAC sanctions?

Yes, by causing a violation, conspiring or evading, and most often through the U.S. financial system. OFAC's FAQ 3 makes the same point as FAQ 11 above: a foreign person who causes a U.S. person's violation, conspires in one or evades U.S. sanctions is within OFAC's reach without ever becoming a U.S. person (OFAC FAQ 3). One route runs through U.S. dollar payments: a foreign company that strips a sanctioned party's name from a wire so that a U.S. correspondent bank processes it has caused the bank's violation.

For a U.S. bank this cuts both ways. A foreign respondent's customer cannot be screened by the U.S. bank in advance of the payment message, but once the message arrives the U.S. bank is the U.S. person processing it, and the obligation to block or reject is the U.S. bank's. That is why the details of a payment message matter as much as the customer file.

Does OFAC apply to cash transactions?

Yes. OFAC's prohibitions apply to transactions and to property, and property includes cash. The Iran regulations define property to include "money, checks, drafts, bullion, bank deposits" and a long list besides, down to "services of any nature whatsoever" (31 CFR 560.325). The September 2026 Cuba rule spells it out for the Restricted List: a prohibited transaction includes one "by wire transfer, credit card, check, or payment of cash" (31 CFR 515.209).

The record-keeping rule covers cash too. Anyone who takes part in a transaction covered by OFAC's rules must keep a full record of it for 10 years (31 CFR 501.601). A teller who changes currency for a listed person has engaged in a transaction just as a wire operator has.

What are secondary sanctions, and who do they reach?

Secondary sanctions are measures aimed at non-U.S. persons, usually foreign banks, for dealings that involve no U.S. person at all. They are not prohibitions on the foreign bank; they are threats to its access to the United States. Executive Order 14404 on Cuba, implemented on September 30, 2026, lets Treasury "prohibit the opening of, or prohibit or impose strict conditions on the maintenance of, correspondent accounts or payable-through accounts in the United States" for a foreign financial institution that has carried out or helped with a significant transaction for a person blocked under it (91 FR 61748; what the order changes for payments to Cuba is in sending money to Cuba from the US).

Iran shows what that looks like in practice. OFAC's notice of October 5, 2026 warns foreign financial institutions "that continue to do business with Iran or its financial sector that they may be sanctioned under 'Operation Economic Outcast'", lists the August 28, 2026 action to "sever U.S. correspondent banking access for Banque Misr UAE", and adds that such institutions "could also be subject to civil and criminal enforcement penalties should Iran-related transactions cause U.S. financial institutions or other U.S. persons to violate sanctions" (OFAC notice). A U.S. bank's respondent banks are inside that warning.

What compliance means for a U.S. person: block, reject, report, keep records

For a bank, being a U.S. person comes down to four actions, in the order OFAC's FAQ 5 sets out. Block property in which a blocked person has an interest; reject a transaction a program prohibits where nothing is blockable; report either to OFAC within 10 business days; keep records for 10 years. The chart in FAQ 5 puts listed people and companies, blocked governments, Iranian financial institutions and Cuba or certain Cuban nationals under block, and a sanctioned country with no blocked person involved under reject (OFAC FAQ 5; the chart becomes a decision tree in OFAC block vs reject).

In the sample bank this ran on a held $18,640 wire from a U.S. furniture retailer to a supplier in Sevastopol. The retailer is a U.S. person; the goods were made in the Crimea region of Ukraine, and Executive Order 13685 prohibits "the importation into the United States, directly or indirectly, of any goods, services, or technology from the Crimea region of Ukraine" (79 FR 77357); no general license covers them; and no blocked person had an interest, so the answer was reject, not block. The rejection was proposed by payments operations, confirmed by the BSA/OFAC Officer and checked by the Deputy, and the report was due within 10 business days.

A rejection takes two people, and the customer is told only what policy allows

Which jurisdictions trigger the reject branch in 2026 is set out in why there is no single OFAC sanctioned countries list, and how one country's remittance rules moved on September 30, 2026 in sending money to Cuba from the US.

Questions people ask

Does OFAC apply to dual citizens?

Yes, if one of the citizenships is American. OFAC's definitions cover "any United States citizen" wherever located, and a second nationality does not remove it. A U.S.–Iranian dual national living in Iran is a U.S. person under the Iran regulations.

Does OFAC apply to a U.S. company's foreign branch?

Yes. A branch is part of the U.S. entity, and the standard definition says so in terms: an entity organized in the United States "(including foreign branches)". A subsidiary is a separate legal person and is bound only where a program extends to it, as the Cuba and Iran programs do.

Do OFAC sanctions apply to non-U.S. persons?

Not directly, for most prohibitions. A non-U.S. person may not cause a U.S. person to violate, conspire to, or evade, and under some orders a foreign bank can lose U.S. correspondent access or be designated for significant transactions with listed persons.

Who enforces OFAC sanctions?

OFAC imposes civil penalties and Findings of Violation; willful violations can be prosecuted criminally, with fines of up to $1,000,000 and, for individuals, up to 20 years' imprisonment under IEEPA. The penalty provisions now sit in 31 CFR part 505, added effective September 25, 2026.

Does OFAC apply to green card holders living abroad?

Yes. A permanent resident is a U.S. person "wherever located". OFAC's September 2026 settlement for $1,427,230 with a lawful permanent resident turned on that rule.