US OFAC Sanctions Compliance Framework
U.S. sanctions compliance as OFAC sets it: 'A Framework for OFAC Compliance Commitments' (May 2019), guidance describing five components of a risk-based sanctions compliance program (management commitment, risk assessment, internal controls, testing and auditing, training) that OFAC credits in enforcement but does not require, together with the binding recordkeeping and reporting rules of 31 CFR Part 501 (10-year records since March 2025; blocking, annual, unblocking and rejected transaction reports within set deadlines) and the Economic Sanctions Enforcement Guidelines.
US OFAC Sanctions Compliance Framework is a compliance framework from United States with 7 domains and 31 controls that map to 14 other frameworks. The largest domains are Internal controls (Framework, guidance) – US OFAC Sanctions Compliance Framework (7 controls), Recordkeeping and reporting (31 CFR Part 501, binding) – US OFAC Sanctions Compliance Framework (7 controls), Management commitment (Framework, guidance) – US OFAC Sanctions Compliance Framework (5 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (7)
Enforcement Guidelines (31 CFR Part 501 Appendix A) – US OFAC Sanctions Compliance Framework
| Code | Title |
|---|---|
| us-ofac-sanctions-compliance-framework::501 App. A (III) | Expect enforcement to weigh the General Factors: willfulness, awareness, harm, compliance program, remediation and cooperation |
| us-ofac-sanctions-compliance-framework::501 App. A (VSD) | Consider voluntary self-disclosure: it halves the base penalty, but only if self-initiated, complete and authorised |
Internal controls (Framework, guidance) – US OFAC Sanctions Compliance Framework
| Code | Title |
|---|---|
| us-ofac-sanctions-compliance-framework::IC.I | Write clear SCP policies and procedures that reflect day-to-day operations |
| us-ofac-sanctions-compliance-framework::IC.II | Implement controls to identify, interdict, escalate and report prohibited activity, with calibrated and tested screening tools |
| us-ofac-sanctions-compliance-framework::IC.III | Enforce SCP policies through internal or external audits |
| us-ofac-sanctions-compliance-framework::IC.IV | Align recordkeeping policies with OFAC requirements |
| us-ofac-sanctions-compliance-framework::IC.V | On learning of a control weakness, apply compensating controls until the root cause is fixed |
| us-ofac-sanctions-compliance-framework::IC.VI | Communicate SCP policies to staff, high-risk gatekeepers and external parties performing SCP tasks |
| us-ofac-sanctions-compliance-framework::IC.VII | Appoint staff to embed SCP procedures into daily operations with business unit consultation |
Management commitment (Framework, guidance) – US OFAC Sanctions Compliance Framework
| Code | Title |
|---|---|
| us-ofac-sanctions-compliance-framework::MC.I | Have senior management review and approve the sanctions compliance program |
| us-ofac-sanctions-compliance-framework::MC.II | Give the compliance unit authority, autonomy and a direct reporting line to senior management |
| us-ofac-sanctions-compliance-framework::MC.III | Resource the SCP: a dedicated sanctions compliance officer, qualified staff and adequate systems |
| us-ofac-sanctions-compliance-framework::MC.IV | Promote a culture of compliance with speak-up without reprisal and SCP oversight of the whole organisation |
| us-ofac-sanctions-compliance-framework::MC.V | Treat apparent violations and SCP failures seriously and fix their root causes systemically |
Recordkeeping and reporting (31 CFR Part 501, binding) – US OFAC Sanctions Compliance Framework
| Code | Title |
|---|---|
| us-ofac-sanctions-compliance-framework::501.601 | Keep a full and accurate record of every transaction subject to OFAC rules for at least ten years |
| us-ofac-sanctions-compliance-framework::501.602 | Furnish complete information and documents to OFAC on demand, in OFAC's data format |
| us-ofac-sanctions-compliance-framework::501.603(b)(1) | File an initial blocked property report within 10 business days of blocking |
| us-ofac-sanctions-compliance-framework::501.603(b)(2) | File the Annual Report of Blocked Property by 30 September for holdings as of 30 June |
| us-ofac-sanctions-compliance-framework::501.603(b)(3) | Report unblocked or transferred blocked property within 10 business days |
| us-ofac-sanctions-compliance-framework::501.604 | Report rejected transactions within 10 business days |
| us-ofac-sanctions-compliance-framework::501.605 | Notify OFAC of litigation, arbitration or ADR involving blocked persons or blocked property |
Risk assessment (Framework, guidance) – US OFAC Sanctions Compliance Framework
| Code | Title |
|---|---|
| us-ofac-sanctions-compliance-framework::RA.I | Assess OFAC risk across customers, supply chain, counterparties, products, transactions and geographies, including at onboarding and M&A |
| us-ofac-sanctions-compliance-framework::RA.II | Use a documented methodology to identify, analyse and address risks, updated from testing and audit findings |
Testing and auditing (Framework, guidance) – US OFAC Sanctions Compliance Framework
| Code | Title |
|---|---|
| us-ofac-sanctions-compliance-framework::TA.I | Keep the testing or audit function independent, accountable to senior management and adequately resourced |
| us-ofac-sanctions-compliance-framework::TA.II | Use testing procedures matched to the SCP's sophistication that assess risk assessment and controls objectively |
| us-ofac-sanctions-compliance-framework::TA.III | Act on confirmed negative test results with compensating controls until remediation |
Training (Framework, guidance) – US OFAC Sanctions Compliance Framework
| Code | Title |
|---|---|
| us-ofac-sanctions-compliance-framework::TR.I | Train employees and relevant stakeholders, with tailored training for high-risk roles |
| us-ofac-sanctions-compliance-framework::TR.II | Scope training to the products, customers, partners and regions of the business |
| us-ofac-sanctions-compliance-framework::TR.III | Set training frequency by risk, at a minimum annually |
| us-ofac-sanctions-compliance-framework::TR.IV | Retrain or take corrective action with relevant staff after a negative finding or deficiency |
| us-ofac-sanctions-compliance-framework::TR.V | Keep training resources easily accessible to all relevant personnel |
Your Compliance Coverage
If you comply with US OFAC Sanctions Compliance Framework, you already cover:
NIST SP 800-53 Rev 5
7%
4 controls mapped
Compare →US ITAR and EAR - Export Control and Data Security
7%
4 controls mapped
Compare →ISO/IEC 29147:2018
7%
4 controls mapped
Compare →+ 11 more: US Automated Commercial Environment (ACE) - CBP Trade Data Requirements (7%), IAIS Insurance Core Principles (ICPs) (7%)
See all 14 mapped frameworks ↓Maps to 14 other frameworks
Coverage is not the same as your position
This page shows what US OFAC Sanctions Compliance Framework overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is US OFAC Sanctions Compliance Framework and who does it apply to?
US OFAC Sanctions Compliance Framework is a compliance framework from United States with 7 domains and 31 controls. U.S. sanctions compliance as OFAC sets it: 'A Framework for OFAC Compliance Commitments' (May 2019), guidance describing five components of a risk-based sanctions compliance program (management commitment, risk assessment, internal controls, testing and auditing, training) that OFAC credits in enforcement but does not require, together with the binding recordkeeping and reporting rules of 31 CFR Part 501 (10-year records since March 2025; blocking, annual, unblocking and rejected transaction reports within set deadlines) and the Economic Sanctions Enforcement Guidelines. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does US OFAC Sanctions Compliance Framework actually require?
US OFAC Sanctions Compliance Framework has 31 controls organised across 7 domains. The largest domains are Internal controls (Framework, guidance) – US OFAC Sanctions Compliance Framework (7 controls), Recordkeeping and reporting (31 CFR Part 501, binding) – US OFAC Sanctions Compliance Framework (7 controls), Management commitment (Framework, guidance) – US OFAC Sanctions Compliance Framework (5 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of US OFAC Sanctions Compliance Framework do I already cover?
US OFAC Sanctions Compliance Framework maps to 14 other compliance frameworks. The top mapping partners are NIST SP 800-53 Rev 5 (7% coverage), US ITAR and EAR - Export Control and Data Security (7% coverage), ISO/IEC 29147:2018 (7% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement US OFAC Sanctions Compliance Framework?
Start your US OFAC Sanctions Compliance Framework compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about US OFAC Sanctions Compliance Framework requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 31 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.
Get Started Free →Free forever, no credit card required