What Is OFAC Compliance? A Simple Guide for Lenders, Dealers, and Business Owners
What Is OFAC & Why Every Business That Touches Money Needs to Understand It
There’s a government list you’ve probably never thought about. It doesn’t care about credit scores. It doesn’t care how long someone has been in business. It doesn’t care that the deal looks clean, the income checks out, and the customer is perfectly pleasant.
If the person you’re about to do business with is on it, the transaction is illegal.
That list belongs to OFAC, the Office of Foreign Assets Control, and it is one of the most consequential compliance requirements in American commerce that most people couldn’t define if their livelihood depended on it.
Spoiler: it kind of does.
What Is OFAC?
OFAC is a division of the U.S. Department of the Treasury. Its job is to administer and enforce economic and trade sanctions against foreign countries, governments, terrorist organizations, international narcotics traffickers, and individuals who threaten national security or U.S. foreign policy objectives.
To do that, OFAC maintains the Specially Designated Nationals and Blocked Persons List, more commonly called the SDN List. Think of it as the federal government’s “do not do business with” roster. It currently contains thousands of names: individuals, companies, vessels, aircraft, and entities from dozens of countries.
When OFAC says a party is sanctioned, it means U.S. persons and businesses are prohibited from engaging in virtually any financial or commercial transaction with them. That means no loans, no sales, no payments, no nothing. Violations can result in civil penalties reaching into the millions of dollars and criminal penalties that include prison time.
The scary part? “I didn’t know” is not a legal defense. OFAC operates on a strict liability standard in many cases, which means the government doesn’t have to prove you intended to violate sanctions, only that you did.
Why OFAC Checks Exist (And Why They Matter More Than Ever)
OFAC’s enforcement authority dates back to World War II, but the modern SDN List gained serious teeth after September 11, 2001, when Congress passed the USA PATRIOT Act and dramatically expanded the federal government’s financial surveillance and enforcement infrastructure.
The purpose is straightforward: cut off the money. Terrorist groups, rogue regimes, drug cartels, and human trafficking networks all need access to financial systems to operate. OFAC compliance is one of the mechanisms that makes it harder for them to get it. When a business extends credit or loans money to a sanctioned entity, those funds might end up in Venezuela, Iran, or in the hands of a cartel, which is exactly the kind of outcome OFAC was designed to prevent.
OFAC updates the SDN List constantly. Names are added and removed as geopolitical situations change. That means a one-time check isn’t enough. The question isn’t just “was this person clean six months ago?” It’s “are they clean right now?”
Who Is Required to Run OFAC Checks?
Here’s where it gets important: technically, every U.S. person and every U.S. business is legally obligated to comply with OFAC regulations. This isn’t a bank-only rule. It applies across industries, transaction types, and business sizes.
Financial Institutions and Business Lenders
Banks, credit unions, and non-bank lenders are among the most heavily scrutinized OFAC obligors. Before any loan closes, commercial, consumer, or otherwise, the lender must screen the borrower (and often related parties, beneficial owners, and guarantors) against the SDN List. The consequences for a missed hit are severe: the bank could be fined, the transaction could be unwound, and in extreme cases, criminal referrals can follow.
Business lenders, particularly those operating in equipment finance, commercial real estate, and working capital face compounding complexity because they’re often dealing with LLCs, corporations, and holding companies, all of which may have individual owners who appear on the SDN List even if the entity itself does not. Screening must go all the way down to the beneficial owner.
Auto Dealers
Auto dealerships occupy a fascinating and often underappreciated position in OFAC compliance. Vehicles, especially high-end vehicles, are a known mechanism for sanctions evasion. A sanctioned individual or a front company operating on their behalf may attempt to purchase a vehicle for cash or through financing, with the intent of exporting it to a prohibited country or jurisdiction.
Under FinCEN regulations and general OFAC guidelines, dealers have compliance obligations that mirror those of financial institutions in key respects. Every credit application, every cash deal above reporting thresholds, every transaction, dealers are expected to screen the parties involved. In a proficient dealership, this means OFAC screening should happen before a deal advances to funding, ideally embedded in the credit and compliance process rather than bolted on at the end.
That’s exactly how platforms like Informativ handle it: OFAC and Red Flags checks are built directly into the deal workflow, triggered automatically as part of the deal process, not as a separate manual step someone might forget on a busy Saturday.
Real Estate and Title Companies
High-value real estate has long been a vehicle for sanctions evasion and money laundering. Title companies, escrow agents, and real estate attorneys are required to screen buyers, sellers, and entities involved in transactions, particularly in cash deals. FinCEN’s Geographic Targeting Orders (GTOs) have put additional pressure on the industry in specific cities and transaction types, but OFAC screening is a baseline requirement regardless of location.
Import/Export and International Trade
If your business ships goods internationally, you are in OFAC territory. Exporters are required to screen their customers, their end-users, and sometimes their freight forwarders against the SDN List and various country-specific sanctions programs. The Export Administration Regulations (EAR) and OFAC sanctions regimes overlap significantly, and a company that exports dual-use goods to a sanctioned country faces consequences from both Commerce and Treasury.
Insurance
Insurance companies are required to screen policyholders and claimants against the SDN List. You cannot legally issue a policy to a sanctioned individual, and you cannot pay a claim to one either, even if the policy was issued before the individual was designated. This applies across property and casualty, life, and specialty lines.
Healthcare and Government Contractors
Any entity receiving federal funds or operating under federal contracts has OFAC obligations. Healthcare organizations receiving Medicare and Medicaid reimbursements must ensure that excluded or sanctioned parties are not involved in their operations, a requirement that spans employees, vendors, and contractors.
What Happens When You Miss a Hit?
OFAC enforcement actions are public and painful. Civil monetary penalties can range from thousands to tens of millions of dollars, depending on the egregious nature of the violation, the value of the transactions at issue, and whether the company had a compliance program in place at the time.
The existence of a compliance program doesn’t guarantee immunity, but its absence guarantees scrutiny. OFAC has explicitly stated that it considers the adequacy of a company’s compliance program when determining penalty amounts. Companies with no program, inadequate screening, or documented gaps in their processes face higher penalties. Companies that can demonstrate a robust, systematic compliance program may be eligible for reduced penalties or, in some cases, no penalty at all.
The message is clear: a defensible process matters as much as a clean result.
Building OFAC Compliance into Your Process
The companies that stay out of trouble aren’t the ones that run OFAC checks manually in a spreadsheet once a week. They’re the ones that have made screening automatic, systematic, and impossible to skip regardless of deal type, deal volume, staffing, or how busy it gets.
For auto dealers, that means embedding OFAC checks into the deal workflow, so they fire every time, on every deal, before anything advances to contracting. For lenders, it means screening every applicant, every beneficial owner, and every guarantor with documented results stored in the deal file.
The best compliance programs share a common trait: the process enforces itself. No one can close a deal without the check happening, because the system won’t allow it.
The Technology Behind the Questions
Out-of-wallet questions aren’t generated by a person sitting at a desk combing through your credit report. They’re produced in real time by identity verification platforms that pull from aggregated data such as credit bureau records, property databases, public records, financial histories, and algorithmically select questions that are:
- Specific enough to be hard to guess
- Recent enough to be relevant and answerable
- Varied enough that the same questions don’t repeat for the same person across multiple verifications
- A combination of credit data sourced questions and non-credit questions
The answer options typically come in multiple-choice format with plausible decoys such as nearby addresses, similar vehicle models, and adjacent years to prevent lucky guessing. The system scores not just whether you get the answers right, but how quickly and how consistently you respond.
What Out-of-Wallet Questions Can't Do Alone
A Red Flags process is not bureaucratic busy work. It is a warning system that pays for itself the first time it catches something real.
Whether you’re a dealership financing vehicles, a lender approving commercial credit, a healthcare provider billing after treatment, or a retailer offering payment plans, the Red Flags Rule applies to you. The question isn’t whether you need a program. The question is whether yours actually works.
The Bottom Line
Out-of-wallet questions are one of the most elegant tools in the identity verification toolkit; simple in concept, powerful in execution, and built on the fundamental insight that a real person’s life leaves a data trail that’s nearly impossible to fully replicate.
For auto dealers, lenders, insurers, and anyone else making high-value decisions based on identity, they’re not a nice-to-have. They’re a frontline defense in a fraud environment that’s only getting more sophisticated.
The fraudster can fake your license. They can fake your SSN. What they can’t fake is the name of the mortgage company on the house you sold twelve years ago.
Looking for identity verification and dealer fraud prevention built into your workflow from the first touchpoint to funded deal? Check out Informativ’s multi-layered fraud detection including real-time identity verification and out-of-wallet questions.