August 16, 2026

OFAC Compliance Checklist for Fintechs

Axle Team

Key takeaways

OFAC's 2019 framework is the checklist: management commitment, risk assessment, internal controls, testing and auditing, and training. Enforcement settlements are evaluated against these five components.
Sanctions compliance is strict liability. Intent doesn't matter, so control design matters more than policy language.
Fintechs fail in predictable places: location data they already hold but never screen, risk assessments that go stale after product launches, and match thresholds tuned once at go-live and never revisited.
OFAC has explicitly acknowledged AI screening tools that reduce false positives — the bar is showing your work, not avoiding the technology.
Tie your risk assessment refresh to product launches, not the calendar.

An OFAC compliance checklist for a fintech covers five areas, taken directly from OFAC's own framework: documented management commitment, a current sanctions risk assessment, internal controls (screening, blocking, rejecting, reporting), independent testing and auditing, and role-specific training. Every control should trace back to a risk identified in the assessment — that traceability is what examiners and OFAC itself look for.

This piece turns each of the five components into concrete OFAC compliance checklist items, then covers the fintech-specific failure modes OFAC's enforcement history keeps surfacing.

An OFAC compliance checklist starts with OFAC's framework

In May 2019, OFAC published A Framework for OFAC Compliance Commitments — the closest thing to an official answer key that exists. It describes what OFAC's Office of Compliance and Enforcement looks for when it evaluates a sanctions compliance program (SCP), including after an apparent violation.

"While each risk-based SCP will vary depending on a variety of factors—including the company's size and sophistication, products and services, customers and counterparties, and geographic locations—each program should be predicated on and incorporate at least five essential components of compliance: (1) management commitment; (2) risk assessment; (3) internal controls; (4) testing and auditing; and (5) training."
— A Framework for OFAC Compliance Commitments, OFAC (2019)

Two things make this more than guidance. First, sanctions violations are strict liability — no intent or knowledge required. Second, OFAC applies the framework when it settles enforcement cases: an effective program at the time of an apparent violation can mitigate the penalty and weigh against a case being deemed egregious. The checklist below follows the five components.

The checklist, component by component

1. Management commitment

A named senior sanctions compliance officer with direct reporting lines to senior management, and documented, recurring meetings between the two.
A budget trail showing headcount, expertise, and tooling scaled to your current transaction volumes and market exposure — not to last year's org chart.
Board- or executive-level review and approval of the SCP, refreshed whenever the program changes materially.

"Senior Management's commitment to, and support of, an organization's risk-based SCP is one of the most important factors in determining its success."
— A Framework for OFAC Compliance Commitments, OFAC (2019)

2. Risk assessment

A holistic map of touchpoints: customers and counterparties, products and payment rails, geographies, banking partners, and vendors.
Fintech-specific inputs: IP and device geolocation, BIN sponsor and program-manager exposure, crypto on/off-ramp counterparties, and marketplace sub-merchants.
A defined refresh trigger list — new product, new corridor, new customer segment — in addition to a periodic cycle.

3. Internal controls

Screening at onboarding, plus delta screening of the full customer base on every SDN and consolidated-list update.
Documented match-threshold logic (fuzzy matching, transliteration handling, weak aliases) with a written record of why thresholds sit where they sit.
Runbooks that distinguish blocking from rejecting, with OFAC reporting for both within 10 business days, plus the annual blocked-property report.
Geolocation controls that actually consume the location data you hold — IP, billing address, device signals — for sanctioned-jurisdiction exposure.

4. Testing and auditing

Independent testing of screening coverage: seed known SDN name variants and sanctioned-jurisdiction patterns, and measure what gets through.
Data-integrity audits confirming every in-scope system actually feeds the screening engine — the classic gap after an acquisition or a new rail.
Tracked remediation with owners and deadlines. Findings without closure dates are exam material.

5. Training

Role-specific content: engineers who touch payment flows need different training than support agents who process name changes.
Frequency tied to the risk assessment, with completion tracked and escalation for misses.

Where fintechs actually get caught

OFAC's enforcement actions against payments and digital-asset firms keep citing the same root causes. BitPay's 2021 settlement centered on IP location data the company held on buyers in sanctioned jurisdictions but did not use for sanctions purposes. Payoneer's settlement the same year cited screening logic too weak to catch name variants of sanctioned parties. The pattern in both: the data existed, the control didn't.

The practical reading for a fintech is that OFAC treats data you collect for fraud, marketing, or product analytics as data you could have screened. If your fraud team can see IP geolocation but your sanctions screening stack can't, that's an apparent-violation narrative waiting to be written.

Real-time rails don't lower the bar

OFAC addressed the tension between instant settlement and screening directly in its September 2022 Sanctions Compliance Guidance for Instant Payment Systems:

"OFAC recognizes that a key feature of instant payment systems is the near real-time nature of transaction settlement, but the speed necessitated by this commercial feature should not discourage financial institutions from implementing risk-based sanctions compliance controls."
— Sanctions Compliance Guidance for Instant Payment Systems, OFAC (2022)

The same guidance is notable for endorsing technology rather than warning about it:

"OFAC is aware of artificial intelligence tools and other innovative compliance solutions, such as those that leverage information sharing mechanisms across financial institutions, which may enhance sanctions screening functions and reduce false positives. Where appropriate, based on an institution's assessment of risk, OFAC encourages the use of such tools and other emerging technologies and solutions to manage sanctions risks that could arise in the context of instant payments."
— Sanctions Compliance Guidance for Instant Payment Systems, OFAC (2022)

That's a meaningful signal for teams weighing whether AI-assisted screening will draw examiner skepticism. OFAC's stated concern is unmanaged risk, not modern tooling.

Practitioner note: the highest-leverage checklist item isn't in OFAC's framework at all — put the sanctions risk assessment refresh inside the product launch process, as a gate, not a follow-up. Fintech risk assessments rarely go stale on an annual timescale; they go stale at launch velocity. A new corridor, a new funding rail, or a crypto off-ramp changes your sanctions exposure the day it ships. Teams that make sanctions review a launch checklist item catch this. Teams on an annual assessment cycle find out in the lookback.

Where AI agents fit

The heaviest recurring cost in an OFAC compliance checklist is alert adjudication: every list update and every threshold you loosen produces alerts someone must disposition, with documented rationale, at a quality level that survives independent testing. That's the layer AI agents change. Axle's screening agent Baley adjudicates sanctions and watchlist alerts the way a trained analyst does — checking each hit against customer data, documenting the rationale, and escalating true matches — so coverage decisions stop being constrained by review capacity.

If you're sizing the opportunity, the ROI calculator models the alert-volume economics, and the AI readiness playbook covers the governance questions — validation, sampling, audit trail — an examiner will ask.

FAQ

How often should a fintech update its OFAC risk assessment?

There's no mandated frequency. OFAC's framework calls for a routine and, as appropriate, ongoing assessment. In practice that means a periodic cycle — most programs use annual — plus defined triggers: new products, corridors, customer segments, or rails.

Does OFAC require screening every transaction?

No. OFAC expects a risk-based program, not a prescribed screening scope. Its instant-payments guidance is explicit that domestic-only transactions between U.S. banks generally pose lower sanctions risk than cross-border flows, and that screening decisions should follow your own risk assessment.

What's the difference between blocking and rejecting a transaction?

Blocked property involves an interest of a sanctioned party and must be frozen and reported to OFAC; rejected transactions are ones you must refuse to process but not hold. Both carry reporting obligations to OFAC within 10 business days.

If sanctions alert adjudication is the bottleneck in your program, see how Baley handles screening alerts end to end.

OFAC Compliance Checklist for Fintechs

More from the blog