What OFAC Compliance Means
OFAC compliance means running a working program that keeps your crypto business out of prohibited dealings, not just knowing the rules. Regulators grade the program: management backing, a risk assessment, controls that screen and block, testing, and training. This page walks all five parts the way an examiner reads them. The OFAC sanctions hub collects the related guides.
The word "program" is doing real work in that sentence. A one-time checklist is not compliance in OFAC's eyes; a repeatable system that catches listed parties, records what it does, and improves when it fails is. The office made its expectations explicit in A Framework for OFAC Compliance Commitments, a document that names five essential parts, and enforcement settlements regularly quote the gaps in those five parts when setting penalties.
Scope matters too. OFAC compliance is the sanctions slice of the wider anti-money-laundering stack, alongside duties like monitoring and reporting that the AML side of the house owns under FinCEN's legal authorities. For a virtual asset business, both slices run on the same inputs, customers and addresses, which is why teams often build them together. The border question, what a licensed institution owes versus what a U.S.-sanctions-exposed firm owes, is where the VASP family picks up.
The Five Parts of an OFAC Compliance Program
The framework names five parts: management commitment, risk assessment, internal controls, testing and auditing, and training. Each part covers a failure mode the other four miss, and an examiner reads them as one machine. Crypto teams fail the same five ways everyone else does, just with addresses added.
| Part | What it looks like in a crypto firm |
|---|---|
| Management commitment | A named senior owner, budget, and stated policy |
| Risk assessment | A written view of where sanctions risk touches you |
| Internal controls | Screening, blocking, and licensing procedures that run |
| Testing and auditing | Scheduled checks that the controls actually fired |
| Training | Staff who know what an alert means and what to do |
Management commitment sounds soft until an enforcement case quotes its absence. The office expects a senior person who owns sanctions risk, not a shared inbox. The risk assessment then maps your exposure: which customer types, which chains and assets, which payment routes and counterparties, and where the U.S. nexus sits. The next section slows down on this one, because everything downstream inherits its quality.
Internal controls are where the program meets the pipeline: screening at onboarding and after, hit triage with named deciders, blocking and refusal procedures, and record keeping that survives an audit. The sanctions screening guide covers the screening core, and the OFAC check guide covers the single lookup, which is where most controls start and where most of them leak.
Testing asks the uncomfortable question: if a listed party walked in today, would we catch it? Scheduled audits, sample re-checks, and post-incident reviews are the honest answers. Training closes the loop, because the alert lands on a person first, and that person's next click decides whether the control worked.
Reading the five as a checklist misses the point, because they feed each other. The risk assessment tells the controls where to look; the controls tell testing what to sample; testing tells training what to teach; and management, seeing all four, decides where the next dollar goes. A weakness in one shows up as noise in the others, which is how examiners locate it.
Each of the five parts has a dedicated guide, all filed under the OFAC sanctions hub.
Sanctions Risk Assessment: Where Programs Start
A risk assessment is a written map of where sanctions exposure enters your business: customer types, products, chains, and transaction patterns, ranked by likelihood and damage. It is the part teams skip and the part examiners read first, because every other control is justified or exposed by what the map says.
The method is unglamorous. Inventory what you offer and who uses it. For a crypto firm that means listing customer segments, deposit and withdrawal flows, the assets and chains supported, and any service that touches U.S. persons or dollars. Then ask, per item, what a listed party would look like arriving through it, and what the damage would be if one did.
Ranking turns the inventory into decisions. High-traffic withdrawal paths with anonymous senders score high; a small verified-business onboarding lane scores lower. The ranking then drives spend: where screening runs continuously, where a manual check suffices, and where a policy of refusal is cheaper than any control. A risk accepted on paper, with a reason, reads as judgment. The same risk, undocumented, reads as a gap.
The assessment ages like the lists do. New chains, new products, new customer countries: each change reopens the map, and the working habit is to revisit it on a schedule and on every major launch. Teams that treat it as a living document find the rest of the program follows naturally.
Two habits keep an assessment honest. Write down what you decided not to worry about, with the reason, because an unexplained acceptance reads as an oversight while an explained one reads as judgment. And date every version, because the question an examiner actually asks is not whether you have a map but whether it was current when the conduct happened.
What Running Records Prove
Running records are what a program shows instead of claiming: dated screening results, named decisions, blocking reports, and training logs. When a regulator asks how a specific party was handled, those records must be retrievable. Screening tools can record their own events as they run; the institution maintains the decisions, reports, training records, and other evidence that make up its wider program.
The exam question arrives in a specific shape: show me this customer, this address, this date. A program with running records pulls the history with the list version attached, and the conversation moves on. A program reconstructing history from screenshots and memory has already conceded the finding, whatever its screening actually did.
This is the quiet argument for screening that lives inside the pipeline. Phalcon Compliance handles the address and transaction side, with sanctioned entities among the risk categories it flags. Each check provides a dated screening record that supports, rather than completes on its own, the institution's wider compliance file. When a case needs reporting under applicable rules, paid-plan STR drafts for Hong Kong and Singapore give your team a starting document to review, edit, and submit through its own process. The Phalcon Compliance page covers plans.
Scale changes the volume, never the shape. A hundred checks a day and a hundred thousand produce the same six-field row, and the smaller operation gets no discount on the reconstruct question. That symmetry is why records belong in the tooling conversation from day one rather than as a retrofit after the first audit letter.
Records also close the loop back to risk assessment: patterns in the alerts tell you where the map was wrong. For the full family, from the office itself to the enforcement numbers that price these gaps, start at the OFAC sanctions hub.