Prompt #1:

Why do some OFAC listings include “secondary sanctions risk” wording and others do not? Are there listings where the risk does exist but the wording doesn’t appear? If so, why not? What are the implications – from a regulatory or practical sense – of that wording appearing? Check your response against your sources and flag anything that is not well-supported by the sources

First response:

Why some listings carry the wording and others don’t

The “Secondary sanctions risk:” line is a remark field OFAC appends to an SDN (or SSI) entry to point the reader to the specific legal authority under which dealings with that person could expose a non-US person to secondary consequences. In the entries you’ll see, it takes forms like “Secondary sanctions risk: See Section 11 of Executive Order 14024” for Russia-EO14024 designations, “Ukraine-/Russia-Related Sanctions Regulations, 31 CFR 589.201” for legacy Ukraine/Russia entries, and program-specific citations like “section 1(b) of Executive Order 13224, as amended by Executive Order 13886” on a terrorism-linked entry.

The presence or absence tracks the program, not the individual designee. Secondary sanctions authority is program-specific: it exists for Iran, Russia (EO 14024/14114 §11 and CAATSA §231), North Korea, and certain counterterrorism/narcotics authorities, but not for every OFAC program. An SDGT/SDNTK designation carries the tag where the underlying EO 13224/13886 authority provides for it; a designation under a program with no secondary-sanctions statute behind it won’t have the line because there’s no secondary authority to cite.

A second driver is timing. OFAC added the remark to many pre-existing entries retroactively. In mid-2024, following EO 14114’s revision of Section 11 of EO 14024, OFAC amended existing SDN and SSI list entries to include an explicit reference to “secondary sanctions risk” pursuant to revised Section 11 of Executive Order 14024. So an entry designated before that authority existed (or before OFAC did the bulk update) might not carry wording that a functionally identical entry added later would.

Are there listings where the risk exists but the wording doesn’t appear?

Yes — and this is the practically important part. The remark is informational, not a determination of your exposure.Two mechanisms produce risk without the tag:

The 50% Rule. Entities owned 50%-or-more by blocked persons are themselves blocked without being separately listed at all. Under OFAC guidance, any entity owned 50% or more, individually or collectively, by sanctioned persons is itself treated as blocked, and entities may be subject to sanctions even if they are not expressly listed. An unlisted subsidiary of a secondary-sanctionable parent carries the parent’s risk profile but has no SDN entry, hence no remark.

Retroactive-tagging gaps and program coverage. Because the tagging was applied program-by-program and in batches, and because OFAC “overwrites rather than versions” its public data, an entry can lag the current legal reality. The tag reflects OFAC’s citation choice at a point in time, not a guarantee that no secondary authority reaches the party.

⚠️ Flag — not well-supported by my sources: I could not, in these searches, locate an OFAC FAQ or a data-specification document in which OFAC itself explicitly states that the “secondary sanctions risk” field is non-determinative and that its absence does not mean no risk exists. That characterization is the well-established practitioner reading (and it follows logically from how the 50% Rule and program-specific authorities operate), but I’m presenting it as sound inference rather than a sourced OFAC statement. If you want to publish it as OFAC’s own position, that specific claim should be verified against the SDN List data specification or the relevant FAQ before it goes out.

Implications of the wording appearing

The remark does not change what is prohibited for US persons — they are already barred from dealings with any blocked party regardless of whether the line appears. Its function is a signal to non-US persons, particularly foreign financial institutions.

For an FFI, the tag flags that dealing with this party could expose the institution itself to consequences that amount to exclusion from the US financial system — OFAC can require US banks to close the foreign bank’s correspondent or payable-through accounts, or designate the foreign bank itself on the SDN List.

Critically, the exposure typically turns on a “significant transaction” standard with no bright line. OFAC weighs the size, number, and frequency of the transactions; their nature; the level of management awareness and whether they form a pattern of conduct; and the nexus to sanctioned persons. There is no bright-line dollar threshold for significance.

Two practical points worth making for your audience:

The tag has become a de facto compliance trigger ahead of formal enforcement. Financial institutions in jurisdictions such as China, the UAE, and Turkey began restricting or delaying Russia-related transactions due to perceived secondary sanctions risk — banks act as gatekeepers before regulators formally move. So the wording’s real-world effect is often screening-driven de-risking rather than a government action.

And the wording is a pointer to an authority, not the scope of that authority. The cited EO or CFR section is where the actual conditions, thresholds, and exemptions live; the remark just tells you which door to open.

Follow-up prompt:

Are companies treating the secondary sanctions wording as a risk rating? Is there a pattern to this – e.g. by industry, by asset class, by geography or otherwise?

And the response:

This is the sharper version of the “Burning Questions” angle from before — whether the field is being read as a rating rather than a citation, and whether that misreading clusters anywhere. Let me search for evidence rather than reason from priors, because the honest answer may be that this specific behavior is under-documented.That gave me adjacent material (screening mechanics, one vendor that tags secondary sanctions as a labeling feature) but not direct evidence of firms misreading the field as a rating. Let me look specifically at the de-risking / over-compliance pattern, which is where any geographic or asset-class clustering would show up.I now have solid material on the de-risking pattern and where it clusters, but I want to be honest about a distinction: the question asks specifically whether firms treat the wording as a rating, and most of what I’ve found is about firms reacting to the underlying risk. Those aren’t the same thing, and I don’t want to conflate them. Let me do one more targeted search on the data-field-as-signal angle.I have enough to give an honest, well-bounded answer. The key finding I need to be upfront about: the sources document a strong de-risking pattern around the underlying secondary-sanctions risk, but almost nothing directly documents firms reading the remark field itself as a rating. Those are different claims, and the interesting piece for a practitioner audience is precisely that gap.

The short answer

There’s a real, well-documented behavioral pattern here — but it’s not quite the one the question names, and the distinction matters.

What the sources robustly support: firms, especially foreign financial institutions, are over-reacting to secondary-sanctions exposure, cutting off parties well beyond what the law strictly prohibits. What the sources do not directly support: that firms are specifically reading the SDN entry’s “Secondary sanctions risk:” remark text as a risk score or rating. I found essentially no direct documentation of that narrower claim. So I’ll give you the pattern that is evidenced, then be explicit about where your framing outruns the record — which is itself the interesting part.

The pattern that is well-supported: de-risking as over-compliance

The dominant behavior is precautionary avoidance driven by the threat of secondary sanctions rather than by any single data field. Banks in Asia, Africa, and the Middle East have disengaged from Russian-linked transactions even where the dealing is technically legal, and many have cut off clients only remotely linked to Russian entities where no direct violation exists. This is firms treating the possibility of secondary exposure as a reason to exit, which is functionally “risk-rating” behavior — just triggered by the designation and its program, not by parsing the remark.

OFAC appears to have designed for exactly this. Davis Polk’s read is that the US has historically been highly selective in imposing secondary sanctions, and that the expanded FFI measures seem calibrated to have a broad deterrent effect and to encourage de-risking. In other words, the deterrent-by-ambiguity is intentional; the over-compliance is a feature, not an accident.

Where the pattern clusters

The evidence does show clustering, and it’s worth laying out by the axes you asked about.

By asset class / sector. Energy is the clearest. After the Rosneft and Lukoil designations, purchasers in India and major companies in China tended to avoid buying from sanctioned sellers or intermediaries, and third-country operators and banks were deterred from ongoing business with those firms. Correspondent banking is the other concentration: documentary credits and guarantees involving Russian exporters became high-risk instruments, and trade finance is where much of the avoidance shows up.

By geography. The avoidance concentrates in the transshipment and energy-buyer jurisdictions — China, India, Turkey, the UAE — precisely the third countries OFAC’s FFI authority targets. OFAC’s own updated FFI advisory flags that small- and medium-size institutions in jurisdictions that continue significant Russia trade present particularly high risk, which pushes correspondent banks to de-risk entire categories of respondent institutions in those markets.

By institution type. Smaller FFIs without deep compliance benches de-risk more bluntly, because nuanced analysis of “significant transaction” thresholds is expensive and the downside — loss of US correspondent access — is existential. Larger banks can afford the granular analysis; smaller ones exit the whole exposure.

The common thread: the clustering tracks the programs that actually carry secondary-sanctions authority (Russia, Iran, North Korea) and the choke points (correspondent banking, energy trade finance) — not the presence or absence of the remark text on any given entry.

Where your framing outruns the sources — and why that’s the actual story

⚠️ Flag — not supported by my sources: I could not find direct evidence that compliance teams or screening systems ingest the “Secondary sanctions risk:” remark field and treat it as a rating that ranks one designee above another. That specific claim should not be published as established.

Two things from the record actually cut against it, and they’re useful to you:

The remark lives in the remarks field — the same catch-all field OFAC historically used for information that didn’t fit existing structured categories, and where weak AKAs and identifiers also sit. It’s descriptive text pointing to a legal authority, not a structured, scored data element. Screening vendors that do differentiate secondary-sanctions exposure describe it as a labeling / tagging feature they add — referencing the specific regulation or executive order under which a sanction applies — which implies the raw list doesn’t hand them a rating; they construct one.

And modern screening guidance pushes the opposite of field-reading: a name match is only the beginning, and analysts are expected to work from ownership, nexus, transaction context and the 50% Rule rather than from a line of remark text. The sophisticated read of secondary risk is contextual (who owns whom, is the transaction “significant,” is there a US nexus), and none of that is legible from the remark.

So the honest synthesis, and the sharper “Burning Question,” is this: firms are absolutely treating secondary-sanctions exposure as a risk gradient — but they’re inferring that gradient from the program, the sector, and the geography, not from the remark field. The remark is a citation; the market has built its own rating on top of it. The failure mode worth writing about isn’t “firms misread the field as a rating” (I can’t evidence that) but the inverse risk: because the field is a citation, not a rating, its presence tells you which authority applies, not how much risk you carry, and its absence tells you nothing — yet the de-risking reflex behaves as though listed-with-tag equals hot and untagged equals cool. Given the 50% Rule and the retroactive-tagging gaps we discussed last time, that reflex is exactly backwards for the unlisted-subsidiary and pre-tagging-batch cases.

If you want to make the piece defensible, the claim to lead with is the evidenced one (over-compliance clusters in Russia/Iran energy and correspondent banking, in China/India/Turkey/UAE, among smaller FFIs) and to frame the “reading the field as a rating” idea explicitly as a hypothesis you’re raising, not a documented practice — then invite practitioners to tell you whether their screening logic actually weights the field. That’s both the intellectually honest move and, for your readership, probably the thing that generates the most useful responses.

One caveat on my own evidence base: most of what I found on the behavioral pattern comes from law-firm client alerts and vendor blogs, which are reliable on the direction of travel but have an obvious interest in emphasizing risk. I’d treat the existence and rough clustering of the de-risking pattern as well-established, and any specific magnitude claims as softer.