Under OFAC regulations, when a customer’s funds are blocked, the individual or entity may apply to OFAC for a specific license to authorize the release or movement of the funds. Only OFAC has the authority to approve the unblocking of assets.

Attempting new transactions (A) is prohibited. Banks cannot refund blocked funds (B). Notifying local authorities (C) does not resolve the issue, because OFAC authorization is required.

Within sanctions compliance programs, one of the core components identified as essential for effective management of sanctions risks is audit and testing. The Sanctions and Compliance Domains describe that sanctions programs require independent review, periodic testing, and validation to assess whether internal controls, screening systems, and escalation processes operate effectively. Audit and testing units provide the independent assurance needed to detect program weaknesses, evaluate the adequacy of controls, and confirm compliance with regulatory requirements.

Sanctions frameworks emphasize that the ability to identify deficiencies, monitor adherence to procedures, evaluate risk-control effectiveness, and ensure continuous improvement is fundamental to maintaining a sound sanctions compliance environment. Audit and testing functions are responsible for reviewing the design and effectiveness of sanctions policies, validating the performance of screening tools, and ensuring corrective action is taken where deficiencies are found. For this reason, the function is identified as critical for managing sanctions risks across financial institutions and regulated entities.

References from Sanctions and Compliance Domains:

Requirements for independent auditing and testing as a core component of an effective sanctions compliance program.

Expectations for regular review of sanctions controls, screening performance, and risk assessment processes.

Emphasis on independent validation to ensure ongoing compliance with regulatory obligations and to detect gaps in sanctions controls.

OFAC regulations apply broadly to US persons , which include US citizens, permanent residents, entities organized under US law, and individuals located in the United States. These obligations apply regardless of where the US person is physically located.

Foreign companies, foreign financial institutions, or foreign persons are only obligated under OFAC regulations when a US nexus exists (e.g., US origin goods, US dollars, US-based transactions). US persons, however, must always comply.

In sanctions compliance frameworks applied globally by bodies such as OFAC, the EU, the UN, the UK, Canada, and Australia, transactions involving humanitarian goods, including medicine and medical supplies, are treated under specific regulatory categories. These frameworks include humanitarian exemptions, general licenses, and permitted transactions for medical or health-related items. The standard compliance expectation requires an analyst to determine whether the activity is already authorized before taking restrictive action.

The Sanctions and Compliance Domains specify that when a transaction involves potential humanitarian goods, the analyst must confirm whether a general license or exemption applies. General licenses commonly authorize exports of medicines, medical devices, and humanitarian materials to sanctioned jurisdictions. The rule requires verification of these authorizations prior to escalation, rejection, or requesting a specific license.

If a general license exists for the type of goods or activity, the transaction may proceed in accordance with regulatory conditions. Only when no exemption or general license applies should a specific license be sought. Therefore, the correct immediate step for the analyst is to check applicable general licenses or exemptions related to medical exports.

References from Sanctions and Compliance Domains:

Regulatory requirements relating to humanitarian exemptions under sanctions programs.

General license structures for medical and humanitarian goods in sanctions regimes.

Compliance procedures directing analysts to verify authorizations or exemptions before rejecting or escalating transactions.

Standard sequencing: determine applicability of general licenses or exemptions prior to requesting a specific license.

Sanctions and Compliance Domains specify that sanctions screening must include all fields that contain names, identifiers, or descriptive information that could reveal a connection to a sanctioned party or jurisdiction. This includes:

• Remitter and beneficiary fields – Core parties to the transaction must always be screened.

• Agents, intermediaries, correspondent banks, and financial institutions – These fields often contain additional parties that may be sanctioned or present sanctions exposure.

• Free text fields – These can include narrative descriptions, vessel names, ports, goods, or locations that may represent sanctions risk.

Currency, value, dates, and internal references do not contain identifiers relevant to sanctions screening and therefore are not required screening fields.

The Wolfsberg 2019 Guidance identifies risk assessment as a foundational component of sanctions screening programs. Screening systems, list management, and alert handling must reflect the institution’s assessed sanctions risk exposure.

External audit and reporting are relevant compliance functions but are not listed as fundamental pillars of screening programs in the Wolfsberg framework. Risk management is a broader corporate discipline, while screening specifically starts with a clear sanctions risk assessment.

Sanctions and Compliance Domains highlight that sanctioned individuals may attempt to evade restrictions by transferring assets, ownership rights, or operational control to family members or close associates. These transfers may appear legitimate but are often structured to conceal continuing beneficial ownership or influence.

Asset transfers to relatives or trusted associates are recognized as classic sanctions evasion red flags across EU and UK ownership and control guidance.

Opening bank accounts in non-aligned jurisdictions may create exposure, but the specific red flag of evasion is the movement of assets to associates. Changes in corporate strategy or reduced trading activity are not inherently indicative of sanctions evasion.

OFAC regulations permit the use of USD for Cuba-related transactions only when explicitly authorized under specific exceptions or general licenses. These include certain remittances, humanitarian transactions, and authorized travel-related transactions.

General USD use with Cuba is otherwise prohibited unless OFAC has expressly allowed it through a license or regulatory exemption.

Vendor contracts must explicitly require that third-party service providers comply with all applicable sanctions laws and regulations . This ensures the bank’s sanctions exposure is minimized when vendors perform outsourced functions.

Tuning procedures, risk assessments, and alert investigation procedures are internal controls—not contract requirements imposed on vendors.