Extreme Networks, Inc. (Extreme), a North Carolina-based artificial intelligence and cloud networking solutions provider, agreed to pay $1,529,685 to settle nine apparent violations of the Ukraine-/Russia-Related Sanctions Regulations. Between September 2018 and March 2022, Extreme exported networking equipment and related services from the United States to a company that is majority owned by a designated Russian state-owned company. That state-owned parent makes air defense systems, missiles, and other war materiel.
OFAC says the action emphasizes three points: do sanctions diligence before acquiring a company or its assets, stay vigilant about sanctions risks afterward, and make sure foreign activities and operations are adequately overseen. OFAC coordinated the action with the Department of Justice (DOJ), which announced the resolution of its own parallel investigation the same day.
Description of the Apparent Violations
The customer Extreme acquired
Extreme and its affiliates employ more than 2,800 people in 29 countries. Around 2009, Extreme set up a Russian subsidiary, Extreme Networks Rus LLC (Extreme Russia), which sold Extreme-branded networking products and services in Russia and supported customers after the sale. Extreme Russia ceased operations in March 2022.
In March 2018, Extreme Russia bought customer accounts and contracts from a Russian business that specialized in networking for business communications. One of the end users named in those contracts was Joint Stock Company (JSC) Moskovskiy Mashinostroitelny Zavod Avangard (MMZA), a Russian defense manufacturer.
Since 2002, MMZA has been majority owned by JSC Concern Almaz Antey (Almaz Antey), a Russian state-owned defense company. OFAC designated Almaz Antey on July 16, 2014 under Executive Order (E.O.) 13661. Under OFAC’s 50 Percent Rule, a company owned 50 percent or more in the aggregate by blocked persons is itself blocked, even if OFAC has not named it on the SDN List. MMZA was therefore a blocked person at all relevant times, and U.S. persons were prohibited from dealing with it, directly or indirectly. The State Department separately designated MMZA on June 28, 2022 under E.O. 14024, specifically for producing missiles for Russia’s S-300 and S-400 anti-aircraft systems.
Extreme’s U.S.-led compliance team reviewed the March 2018 purchase agreement, including the contract that named MMZA as end user. It did not do enough diligence to recognize that MMZA was blocked. It also did not question earlier purchases under that contract that at times named a different Russian company, Dmitrovskiy Experimental Mechanical Plant (DEMZ), as the end user.
How the sales continued
From September 2018 to September 2021, Extreme Russia kept the MMZA relationship going, including nine further purchase orders (POs) for hardware such as routing switches, ports, and power supplies, along with cloud and software subscriptions and software. Extreme Russia dealt directly with MMZA staff to develop these orders. It met them in person, including at MMZA’s offices in Russia, and corresponded with them through MMZA email addresses. At least three of those emails carried Almaz Antey in the signature block. Extreme Russia also trained MMZA staff and supported them after the sale.
Even so, none of the nine POs or their business records named MMZA as the end user. Each one named DEMZ. Extreme Russia kept up that cover story in two ways. It entered DEMZ instead of MMZA in Extreme’s internal customer database. It also told MMZA staff to list DEMZ as their company name when they registered for Extreme’s online customer portal, which lets customers track contracts, open support cases, and use technical tools. The MMZA staff still registered with their MMZA email addresses.
The warning signs Extreme missed
Extreme’s U.S.-led central compliance function screened each of the nine POs for sanctions and export controls under a company-wide policy of reviewing every dealing that involved Russia. It still did not detect that Extreme was dealing indirectly with a blocked company. It either ignored or failed to act on numerous signs that DEMZ was not the real end user and that Extreme was supplying MMZA.
Seven of the nine POs listed MMZA email addresses, or MMZA’s Moscow office address, as the final destination for the goods, even though DEMZ was named as the end user.
In May 2018 and February 2019, Extreme’s Regional Director for Northern and Eastern Europe, who supervised Extreme Russia’s staff, received routine activity reports describing Extreme Russia’s dealings with MMZA, including meetings between the two in Moscow.
On October 20 and November 10, 2020, while reviewing two of the POs, Extreme asked its third-party distributor for the end user’s website. Both times the distributor sent MMZA’s website. When Extreme raised concerns about MMZA’s apparent military ties, the distributor said the earlier answers were a mistake and supplied a DEMZ-affiliated website. The distributor had asked Extreme Russia for advice before replying, and it also suggested simply filing an end-user statement to settle Extreme’s concerns. Extreme accepted that and approved the POs without further investigation.
Extreme’s company-wide Russia policy initially held up the MMZA portal registrations, but Extreme approved them anyway. In one case it approved the registration even though the MMZA employee never answered a diligence request for the company’s name, address, and corporate email.
In all, between September 2018 and March 2022, Extreme dealt in property in which a blocked person held an interest on nine occasions when it exported hardware and software from the United States to MMZA. These are the apparent violations of § 589.201 of the Ukraine-/Russia-Related Sanctions Regulations, 31 C.F.R. part 589.
The Penalty
OFAC treated this as an egregious case that Extreme voluntarily self-disclosed. Under OFAC’s Economic Sanctions Enforcement Guidelines (Enforcement Guidelines), 31 C.F.R. part 501, app. A, that combination sets the base penalty at one-half of the statutory maximum, which here is $1,699,650. The settlement agreement puts the statutory maximum for the nine violations at $3,399,300.
The settlement amount of $1,529,685 reflects OFAC’s weighing of the General Factors in the Enforcement Guidelines. It is $169,965, or 10 percent, below the base penalty. That percentage is simple arithmetic on the two figures. OFAC does not say how much each factor moved the number.
Extreme does not pay the full amount to OFAC. It owes Treasury $1,041,824. The other $487,861 is treated as paid through the fine Extreme is paying DOJ under its Non-Prosecution Agreement for the same conduct.
Aggravating factors
Reckless disregard of sanctions. Extreme did not do enough diligence to recognize that MMZA was a blocked person, and it did not heed the many signs that MMZA was the real recipient of the goods in the nine POs that it said it was filling for DEMZ.
General Factor A (Willful or Reckless Violation of Law): OFAC treated the failure to follow up on obvious warning signs as a failure to exercise even a minimal degree of caution.
Knowledge. Extreme knew it was filling the nine POs and had reason to know that MMZA was the actual end user.
General Factor B (Awareness of Conduct at Issue): Extreme knew about the transactions themselves, and the red flags in the POs and its own reviews gave it reason to know who the real customer was.
Harm to U.S. foreign policy goals. By giving an economic benefit to MMZA, a blocked Russian defense firm that calls itself the sole supplier of Russia’s S-300 and S-400 mobile surface-to-air missile systems, Extreme substantially harmed U.S. efforts to deny Russia the ability to supply its military sector and to reduce its capacity to wage war against Ukraine.
General Factor C (Harm to Sanctions Program Objectives): The customer was a defense manufacturer at the center of the Russia sanctions program’s goals, so the conduct worked directly against them.
Mitigating factors
Clean enforcement history. Extreme was not the subject of any OFAC enforcement action in the five years before the earliest of the transactions at issue.
General Factor D (Individual Characteristics): A company with no recent sanctions penalty or finding of violation gets credit for its sanctions history.
Substantial remedial action. Extreme took steps to address the root cause of the violations. It improved its screening to better catch entities that are majority owned by a sanctioned party or have military or government ties. It expanded its end-user diligence, hired more sanctions compliance staff, increased training for compliance and customer-facing employees, and updated its merger and acquisition diligence to include full screening of the target and its customers. The settlement agreement adds detail on several of these steps. Extreme hired a Senior Product Counsel, or similar role, to lead its sanctions and export controls compliance. It gave its trade compliance and order management teams refresher training on OFAC sanctions, and it provides annual training to customer-facing staff such as sales, supply chain, and order management. It also bought new screening software and began collecting end-user certificates backed by additional independent research. Its screening now covers customer accounts and account contacts, and it is looking at adding web and email domains.
General Factor F (Remedial Response): Extreme acted on the root cause rather than only stopping the conduct, which is the kind of response the Enforcement Guidelines credit.
What Extreme agreed to do
In the settlement agreement, Extreme represents that it has ended the conduct and will maintain for at least five years a sanctions compliance program designed to prevent a repeat. The commitments follow the five components of OFAC’s Framework for OFAC Compliance Commitments: management commitment, risk assessment, internal controls, testing and audit, and training. Several stand out.
In future mergers and acquisitions, Extreme will conduct reasonable sanctions diligence, including requesting and screening a complete list of the acquired company’s customers, end users, and other relevant relationships.
Its testing and audit function must be independent of the activities it audits and accountable to senior management.
Relevant employees will receive sanctions training at least once a year.
A senior-level executive will certify to OFAC every year for five years, starting 180 days after the agreement is signed, that Extreme has kept these measures in place, with a written explanation of how it is meeting each commitment.
If OFAC concludes that Extreme breached the agreement, it can reopen the investigation and seek a penalty of up to the statutory maximum of $3,399,300.
What are the Takeaways?
Sanctions diligence has to run through the whole life of a business relationship, not just the start. OFAC has repeatedly stressed diligence when a company is considering a merger or acquisition or starting a new business relationship. Even when a deal involves only certain assets, the diligence should fit the full range of risks. Here, a single risk, an acquisition target’s existing customer relationship with a blocked person, produced multiple apparent violations once the relationship continued after the acquisition.
Red flags call for more diligence, not less. When the evidence suggests that a known counterparty is not the real or only interested party, a company should work to identify the sanctions risk, including the risk of dealing indirectly with a sanctioned person. Inconsistent explanations and questionable end-user representations deserve particular concern. OFAC and its interagency partners have warned that sanctioned Russian parties often use third-party intermediaries to hide their identities and evade U.S. sanctions and export controls.
Weak oversight of foreign affiliates can create major risk for a U.S. parent company. Risks that start abroad often come home. Even a company with a centralized or global sanctions compliance program can be caught out by foreign affiliates that are either complicit in or inattentive to potential violations. Companies should build a strong culture of compliance across all operations worldwide and pay particular attention to affiliates that operate in or near high-risk jurisdictions such as Russia.
Having compliance procedures is not enough if a company does not follow them or does not adequately investigate and resolve the sanctions risks they surface.
Voluntary self-disclosure pays. OFAC weighs the totality of the circumstances, but self-disclosure generally lowers the chance that OFAC will seek a penalty at all, and, where a penalty is warranted, the size of that penalty, even when OFAC finds the conduct egregious.
Other resources
OFAC enforcement and compliance resources
On May 2, 2019, OFAC published A Framework for OFAC Compliance Commitments. It describes OFAC’s view of the essential parts of a sanctions compliance program, for organizations subject to U.S. jurisdiction and for foreign companies that deal with the United States, U.S. persons, or U.S.-origin goods and services. The Framework also explains how OFAC may factor those parts into its evaluation of apparent violations and settlements, and an appendix covers common root causes of violations that OFAC has seen in its investigations.
Information on the civil penalty process appears in the regulations for each sanctions program, the Reporting, Procedures, and Penalties Regulations (31 C.F.R. part 501), and the Enforcement Guidelines. These and recent enforcement information are on OFAC’s civil penalties and enforcement page.
Whistleblower program
The Financial Crimes Enforcement Network (FinCEN) runs a whistleblower incentive program covering violations of OFAC-administered sanctions, as well as violations of the International Emergency Economic Powers Act, the Foreign Narcotics Kingpin Designation Act, the Trading With the Enemy Act, and the Bank Secrecy Act. People in the United States or abroad who provide information leading to a successful enforcement action with penalties above $1,000,000 may be eligible for an award. The program covers potential violations in any commercial sector.
Bank of America, N.A., headquartered in Charlotte, North Carolina, agreed to pay $11,662,930 to settle 475 apparent violations of OFAC sanctions programs covering Russia, Belarus, Iran, Burma, Somalia, narcotics, and global terrorism. Between September 18, 2021 and April 24, 2025, the bank handled transactions worth about $14,834,082 that it should have stopped. Four separate problems caused the violations.
Payments involving blocked banks
In May 2021, the bank automated how it routes cross-border payments through correspondent banks. Its systems used a “routing directory” of banks supplied by a third-party vendor to pick the intermediary banks for each payment. Sometimes an employee entered the routing manually, and customers could also name intermediary banks themselves. Each payment was screened for sanctions once its details were generated.
In March 2022, after sanctions were imposed over Russia’s invasion of Ukraine, the bank learned that the routing directory included banks OFAC had blocked under the Russian Harmful Foreign Activities Sanctions Regulations (RuHSR). The bank was screening these payments, yet it still processed some of them to or through blocked banks, for three main reasons.
Some payments went through shortly after a bank was blocked, before the bank had updated its screening filter.
Analysts in the sanctions screening or payments teams mistakenly treated some alerts as false positives and approved the payments.
Some alerts were released automatically by an “alert suppression rule,” which hides a new alert when it matches the exact criteria of an alert an analyst previously cleared as a false positive.
The bank tried several fixes over the following months. In January 2023, it put in place an automated, longer-term solution that removed the blocked banks from the routing directory its payment engine used. By then it had processed 403 transactions totaling $14,340,100 between February 2022 and March 2025 through 35 blocked banks. Thirty-two of those banks were blocked under the RuHSR, two under the Belarus Sanctions Regulations, and one under Executive Order 13902, which targets additional sectors of Iran’s economy.
The bank knew from March 2022 that blocked banks were in its directory and that it had processed payments involving them. It also told OFAC more than once that it was investigating. Even so, it ran only one narrow lookback, and it did not find the full scope of the problem until OFAC demanded information about its recent lookbacks in a January 2025 administrative subpoena.
Exact matches to blocked persons were not treated as high priority
A design flaw in the bank’s customer screening system ranked alerts as low or medium priority even when an individual customer’s name and date of birth both matched a blocked person exactly. The flaw lasted a long time, and review of those alerts was delayed. As a result, three individuals designated under the Burma, Russia, and Foreign Narcotics Kingpin sanctions programs made 31 transactions totaling $56,258 through their bank or credit card accounts between September 2021 and February 2024. The bank corrected the filter in February 2024, six months after the issue was first identified, and reclassified these matches as high priority.
Watchlist updates that did not happen
Between May 24 and June 28, 2023, a human error at a third-party vendor meant the watchlist file the bank screened against did not reflect changes to OFAC’s SDN List. The bank processed six transactions totaling $100,828 for entities designated under the Burma, Somalia, and Illicit Drug Trade sanctions programs. It did not catch the vendor’s error until July 2023, about a month after another U.S. bank blocked one of those payments downstream.
On February 7, 2025, the watchlist file again failed to load the previous day’s designations, this time because of technical problems inside the bank’s own systems. The bank processed 26 transactions that day totaling $146,543 for a ship management company designated under the Global Terrorism Sanctions Regulations. The update was fully activated on February 12, almost a week later. The bank then ran a lookback and self-disclosed these transactions to OFAC.
Two business accounts mishandled
In May 2023, a sanctions analyst mistakenly dismissed an alert about an individual recently designated under the RuHSR. The alert showed that the individual owned a business, so the business was blocked too, but its account stayed open. The bank rescreened the account in September 2023 while moving to a new screening platform. It still did not review the alert or recognize the blocked interest until about July 2024, 14 months after the designation, because the rescreening of all customer records produced more alerts than the bank was prepared to handle. In that time it processed six transactions totaling $340 for the business. Internal communications after the discovery noted the need for more formal processes, resources, and governance around self-disclosures.
Separately, in April 2025, the bank restricted two business accounts after an authorized signer was designated under the Illicit Drug Trade and Global Terrorism sanctions programs. About a week later, the business owner, who was the designated person’s adult child and had recently been served with a blocking notification by OFAC, asked to close the accounts and move the money into an unrestricted account. Anti-money laundering operations staff approved the request because they misunderstood how to treat accounts with a blocked authorized signer, and branch staff moved $189,869 into a new account. Sanctions compliance staff caught the error before the owner could use the funds and blocked the new accounts. The bank reported the blocked funds and self-disclosed the transfer to OFAC.
Incomplete cooperation with OFAC
For many of these violations, the bank gave OFAC piecemeal or incomplete disclosures and responses, sometimes over a long period, and it did not respond promptly to every request for information. This slowed OFAC’s investigation and delayed resolution of the case.
The conduct resulted in apparent violations of RuHSR § 587.201, BelSR § 548.101, E.O. 13902 § 1(a), BSR § 525.201(a), FNKSR § 598.202(a), SoSR § 551.201(a), IDTSR § 599.201, GTSR § 594.201(a), and E.O. 14065 § 4(a).
The Penalty
OFAC treated this as a non-egregious case, and the bank did not voluntarily self-disclose most of the violations. The settlement amount equals the base penalty with no reduction at all, so the bank received no credit for remedial measures or cooperation.
Of the 475 apparent violations, OFAC found that 413 were not voluntarily self-disclosed and 62 were. Under OFAC’s Economic Sanctions Enforcement Guidelines (31 C.F.R. part 501, app. A), the base penalty for a non-egregious case is built from two pieces. For each violation that was not self-disclosed, OFAC uses the penalty amount set in the Guidelines’ schedule. For each violation that was self-disclosed, it uses one-half of the transaction value. Added together, these produce the base penalty of $11,662,930. The release does not break that figure down by type of violation.
OFAC then weighed the General Factors in the Guidelines and decided not to move the penalty up or down from the base amount.
Aggravating factors
Reckless conduct. The bank failed to quickly fix its screening for payments involving blocked banks, left its watchlist out of date for more than a month, left exact name and date of birth matches at low priority for a long time, and did not make sure staff were trained and following procedures.
General Factor A (Willful or Reckless Violation of Law): OFAC treated the repeated delays in fixing known screening gaps as a failure to take even minimal care to avoid violations.
General Factor E (Compliance Program): The same gaps in screening and training show that the bank’s compliance program was not working as designed.
Harm to sanctions program goals. The bank processed more than $14 million in payments to or through blocked banks, which ran directly against the aims of the Russia sanctions program after the February 2022 invasion. Other banks stopped some of these payments, but most went through, which benefited the blocked banks.
General Factor C (Harm to Sanctions Program Objectives): The blocked banks received an actual benefit, and the conduct undercut U.S. foreign policy goals in several programs.
Size and sophistication. Bank of America is a very large, commercially sophisticated financial institution.
General Factor D (Individual Characteristics): OFAC holds an institution of this size and sophistication to a higher standard of care.
Prior warnings. OFAC had already sent the bank several cautionary letters about substantially similar conduct.
General Factor D (Individual Characteristics): The bank’s sanctions history showed it had been put on notice about the same kind of problem.
Mitigating factor
Tolling agreement. The bank agreed to extend the time OFAC had to act on the violations tied to the individual designated under the Foreign Narcotics Kingpin Sanctions Regulations. Given everything else in the case, OFAC found this did not justify any reduction in the penalty.
General Factor G (Cooperation with OFAC): Agreeing to a tolling agreement is a form of cooperation, but it was outweighed by the bank’s piecemeal responses to OFAC’s requests.
What are the Takeaways?
A strong sanctions compliance program needs managers who pay close attention to detail, look for risks across the whole organization, connect separate problems to find systemic causes, and put lasting fixes in place quickly.
Violations that keep recurring in similar ways cast doubt on whether a compliance program is effective overall. Programs need enough design and resources to spot violations fast, understand what they mean more broadly, and prevent a repeat.
Decisions about screening alert settings and rules, such as suppression rules, should be based on risk, properly supervised, and regularly tested and audited so that small errors do not compound.
Screening software must work and stay current. A company is responsible for its own compliance even when a third-party vendor supplies the tools.
Moving to a new screening tool, or updating an existing one, should be done in a controlled way that does not create delays, gaps, or alert backlogs the company cannot manage.
Everyone who touches sanctions risk, including customer-facing staff in a large organization, needs training on sanctions obligations, procedures, and evasion techniques. Front-line staff are often best placed to stop a violation before it happens. Testing and audits should confirm that procedures are followed, and staff should have easy access to guidance and clear escalation paths.
Institutions that find a possible compliance failure should investigate promptly, find every root cause, fix it thoroughly, and self-disclose. Cooperating fully with OFAC is what earns voluntary self-disclosure credit and mitigation for remedial response and cooperation under the Guidelines.
Other resources
OFAC enforcement and compliance resources
On May 2, 2019, OFAC published A Framework for OFAC Compliance Commitments. It describes OFAC’s view of the essential parts of a sanctions compliance program, for organizations subject to U.S. jurisdiction and for foreign companies that deal with the United States, U.S. persons, or U.S.-origin goods and services. The Framework also explains how OFAC may factor those parts into its evaluation of apparent violations and settlements, and an appendix covers common root causes of violations that OFAC has seen in its investigations.
Information on the civil penalty process appears in the regulations for each sanctions program, the Reporting, Procedures, and Penalties Regulations (31 C.F.R. part 501), and the Enforcement Guidelines (31 C.F.R. part 501, app. A). These and recent enforcement information are on OFAC’s civil penalties and enforcement page.
Whistleblower program
The Financial Crimes Enforcement Network (FinCEN) runs a whistleblower incentive program covering violations of OFAC-administered sanctions, as well as violations of the International Emergency Economic Powers Act and the Bank Secrecy Act. People in the United States or abroad who provide information leading to a successful enforcement action with penalties above $1,000,000 may be eligible for an award. The program covers potential violations in any commercial sector.
Pegasus Worldwide Logistics (“Pegasus”) is a small California freight forwarder with about a dozen employees. It helps customers move goods across borders, with services that include ocean freight, container consolidation, customs clearance, warehousing, trucking, rail transport and drayage. On October 9, 2026, OFAC announced that Pegasus agreed to pay $175,015 to settle its potential civil liability for apparent violations of OFAC’s counter narcotics sanctions and of OFAC’s reporting requirements.
In short, Pegasus arranged the shipment of a machine from a sanctioned supplier in China without recognizing who the supplier was, because its sanctions review and overall compliance program had serious gaps. Pegasus also did not fully answer OFAC’s administrative subpoena at first.
Starting in early 2023, Pegasus told its employees to do basic sanctions screening. They were supposed to compare the name, address, email, phone number and other details of the parties to each transaction against OFAC’s Specially Designated Nationals and Blocked Persons (SDN) List.
On May 30, 2023, OFAC designated Youli Technology Development Co., Ltd. (“Youli”), a China-based supplier of pill press and packaging equipment, under Executive Order (E.O.) 14059, which targets the global illicit drug trade. OFAC said Youli shipped machinery to people in the United States who made counterfeit pills using methods meant to evade law enforcement. The designation blocked all of Youli’s property and interests in property, and generally prohibited U.S. persons from any transaction involving them. OFAC added Youli to the SDN List along with several identifiers, including a phone number and email address. Youli later changed its name to Huizhou Youli Fushi Co., Ltd., but its other identifiers stayed the same.
In August 2023, a U.S. nutritional supplement company (the “U.S. Purchaser”) hired Pegasus to coordinate the purchase and shipment of a customized sugar packet-filling machine from Youli, valued at $5,950. The U.S. Purchaser had bought a breath mint tableting machine from Youli before, and Pegasus had helped with that import too. OFAC’s investigation found the machine was meant for legitimate commercial use, and the Drug Enforcement Administration indicated it has little value for packaging narcotics.
Youli told the U.S. Purchaser on September 7, 2023 that the machine was ready to ship. On September 12, 2023, Pegasus instructed Youli to arrange the shipment with a Chinese shipping agent. Pegasus sent that instruction to an email address that the SDN List identifies as Youli’s. The shipping agent prepared the shipping documents and sent them to Pegasus. The documents named the shipper using Youli’s new name, but they still showed the phone number that OFAC had listed for Youli. Pegasus used this information to file an Importer Security Filing with U.S. Customs and Border Protection (CBP) through a U.S. customs broker. On or after September 28, 2023, Pegasus paid the Chinese shipping agent $146.33 to move the machine to the United States.
Pegasus’s written sanctions procedure did not say when to check the SDN List. Instead of doing any due diligence at the start of the deal, Pegasus waited until just before the machine left China. By then it had already engaged in prohibited conduct. When it finally screened, it checked only the new name, “Huizhou Youli Fushi Co., Ltd,” against the SDN List and got no match. A Pegasus employee did not screen the phone number or email address, even though company policy required screening the parties’ name, address, email, phone and other information. Checking those identifiers, even with a basic internet search, would have turned up a match for Youli.
The machine arrived at the port of Long Beach, California on October 11, 2023. On November 3, 2023, CBP identified it as coming from a blocked person, detained it, and gave Pegasus a Detention Notice naming OFAC as the responsible agency. Neither the notice nor the mention of OFAC led Pegasus to investigate further. About a week later, the customs broker billed the U.S. Purchaser, through Pegasus, $1,463.55 in import duties and fees, and Pegasus promptly paid it. Pegasus then received $2,358.62 from the U.S. Purchaser to cover those fees and its own freight forwarding fees. On December 6, 2023, CBP seized the machine as blocked property.
Shortly before the seizure, OFAC sent Pegasus an administrative subpoena asking about the machine. The subpoena listed three variations of Youli’s name and several other identifiers, including the email address and phone number from the SDN List. On February 1, 2024, Pegasus submitted a certified response saying it had no responsive information. OFAC then showed Pegasus the arrival notice for the shipment. It contained nothing new about Youli, but it showed Pegasus’s role in the shipment. Only then did Pegasus find records that answered the subpoena. Pegasus explained that it had not given its attorney all the necessary information when the response was being prepared. On August 8, 2024, six months after the first response, Pegasus sent OFAC a revised response describing its involvement in the shipment.
As a result, Pegasus appears to have violated section 599.201 of the Illicit Drug Trade Sanctions Regulations (31 C.F.R. part 599) by dealing with a blocked person, or with property in which a blocked person had an interest. Pegasus also appears to have violated section 501.602(a) of the Reporting, Procedures and Penalties Regulations (31 C.F.R. part 501) six times between February 1, 2024 and August 8, 2024, by failing to provide complete information in response to OFAC’s subpoena over those six months.
OFAC added that the case shows the sanctions risks that logistics and freight forwarding companies can face, including when they deal in blocked property, and that it underscores the importance of effective, risk-based controls.
The Penalty
OFAC treated Pegasus’s apparent violations as non-egregious and not voluntarily self-disclosed. The $175,015 settlement also reflects the extensive remedial measures Pegasus took and its commitment to enhanced reporting to OFAC.
Under OFAC’s Economic Sanctions Enforcement Guidelines (31 C.F.R. part 501, app. A), a non-egregious case that was not voluntarily self-disclosed starts from a base penalty equal to the schedule amount. Here that base penalty was $205,900. All of the apparent violations were treated the same way, so this is not a mixed case with both egregious and non-egregious violations. The release does not break the base penalty down by violation type.
OFAC then weighed the General Factors in the Enforcement Guidelines, which brought the settlement down to $175,015, roughly 85 percent of the base penalty.
Aggravating factors
Reckless disregard for sanctions requirements. Pegasus did not properly screen the information it had about Youli, and it did not investigate after learning CBP had detained the machine under OFAC authorities. These failures led to multiple dealings in blocked property.
General Factor A (Willful or Reckless Violation of Law) – skipping the phone number and email address in screening, and ignoring a detention notice that named OFAC, showed a failure to take even minimal care to avoid a violation.
Awareness of the conduct. Pegasus knew throughout that it was arranging an export from Youli, and it had reason to know Youli was the party OFAC had sanctioned.
General Factor B (Awareness of Conduct at Issue) – Pegasus was fully aware of what it was doing, and the information needed to identify the supplier as an SDN was in its possession.
Helping a sanctioned supplier and slowing OFAC’s investigation. Pegasus’s dealings helped an SDN keep exporting to the United States and profiting from it, which undermined the goals of OFAC’s counter narcotics sanctions. Pegasus’s late and incomplete response to the subpoena also delayed OFAC’s investigation.
General Factor C (Harm to Sanctions Program Objectives) – the transaction supported a designated drug trade enabler’s continued business.
General Factor G (Cooperation with OFAC) – the incomplete first response, followed by a revised response six months later, delayed the investigation.
Sector risk. Although Pegasus is not a large company, its role as an international logistics company and freight forwarder called for extra attention to U.S. sanctions given the risks in that industry.
General Factor D (Individual Characteristics) – OFAC looked at the kind of business Pegasus is, and its position in international trade meant it should have had a higher level of sanctions awareness than its size alone suggests.
Mitigating factors
Clean history, small size and low-value transactions. Pegasus had no OFAC enforcement action in the five years before the earliest transaction at issue. It is a small company, and the transactions were relatively low in value.
General Factor D (Individual Characteristics) – sanctions history, company size and transaction value all count in Pegasus’s favor.
Remedial measures. Pegasus agreed to extensive steps to strengthen its sanctions compliance controls, including hiring an outside consultant who knows U.S. sanctions requirements. It will also send OFAC regular, detailed reports for an extended period on what it is doing to comply.
General Factor F (Remedial Response) – Pegasus committed to new and stronger controls and to ongoing reporting to OFAC.
What are the Takeaways?
Freight forwarders and similar intermediaries face many kinds of sanctions risk. They sit at the center of trade deals and work with buyers, sellers, shippers, carriers and others, so they often act as the first line of defense against dealings with sanctioned parties.
OFAC strongly encourages these companies to use robust, risk-based sanctions compliance controls. Employees should understand OFAC requirements thoroughly and get regular training to keep up with new issues.
Ordinary business activity involving blocked property can violate U.S. sanctions. Once someone is designated, any property in which that person has an interest, direct or indirect, is effectively off limits. Any dealing, however small, is generally prohibited without OFAC authorization.
Screening names against the SDN List is important, but it is only a baseline. Companies should take a comprehensive approach to compliance and should account for sanctioned parties trying to hide their involvement, which is more important as sanctioned actors use increasingly sophisticated schemes and technologies. Youli changing its name while keeping the same phone number and email address is a simple example.
Respond to OFAC information requests on time and accurately. Anyone who receives one should do a thorough inquiry and make sure every responsive record is provided.
Cooperation matters when OFAC decides how to resolve a case and how large a penalty to seek. Prompt, searching inquiries and complete responses show that a company takes its compliance obligations seriously. Falling short on cooperation risks losing mitigation credit, and it can also lead to separate penalties under the Reporting, Procedures and Penalties Regulations.
Other resources
On May 2, 2019, OFAC published A Framework for OFAC Compliance Commitments. It gives organizations subject to U.S. jurisdiction, and foreign entities that do business in or with the United States or U.S. persons or use U.S.-origin goods or services, OFAC’s view of the essential parts of a sanctions compliance program. It also explains how OFAC may factor those parts into its evaluation of apparent violations and the resolution of investigations that end in settlements. An appendix to the Framework briefly analyzes some of the root causes of apparent violations that OFAC has identified in its investigations.
Information on the civil penalties process is in the OFAC regulations for each sanctions program, the Reporting, Procedures and Penalties Regulations (31 C.F.R. part 501), and the Economic Sanctions Enforcement Guidelines (31 C.F.R. part 501, app. A). These references, along with recent civil penalties and enforcement information, are available on OFAC’s civil penalties and enforcement information page.
The Treasury Department’s Financial Crimes Enforcement Network (FinCEN) runs a whistleblower incentive program for violations of OFAC-administered sanctions, as well as other violations of the International Emergency Economic Powers Act and the Bank Secrecy Act. People in the United States or abroad who provide information about sanctions violations may be eligible for an award if their information leads to a successful enforcement action with monetary penalties above $1,000,000. The program covers information about potential violations in any commercial sector.
Claude explains the new Sanctions Penalties Regulations, and compares them to what existed beforehand:
OFAC published a new regulation this week: 31 CFR Part 505, the Sanctions Penalties Regulations. It’s the kind of rule that sounds like a bigger deal in the announcement than it turns out to be once you’re actually inside it, which is exactly the sort of question this series exists to chase down. This post has two parts. The first walks through what the new rule actually says, since a straight read of a Federal Register final rule isn’t most people’s idea of a good time. The second, and more interesting, part is how Part 505 sits next to everything else OFAC already had on the books: what it consolidates, what it leaves completely alone, and one citation in the rule’s own text that doesn’t hold up.
What OFAC Just Did, in Plain Terms
Start with what actually changed. OFAC created a new, freestanding regulation gathering the enforcement procedures and penalty amounts for the two legal authorities behind the overwhelming majority of active US sanctions programs, the International Emergency Economic Powers Act (IEEPA) and the UN Participation Act (UNPA). It took effect the moment it published, September 25, 2026, with no notice-and-comment period, because Treasury treats this as a housekeeping rule about procedure rather than a change to what conduct actually gets penalized.
Five pieces make up the new part:
General provisions, including a codified promise that OFAC will keep publishing civil penalty and settlement outcomes at least monthly (entity name, program, violation description, self-disclosure status, and amount; individuals appear only in aggregate, never by name).
Definitions, just IEEPA and OFAC itself. Everything else still comes from each program’s own regulation.
A reserved subpart, presumably held for future use.
The actual IEEPA penalty process: a Pre-Penalty Notice, a 30-day window to respond, a Penalty Notice if OFAC still finds a violation, referral to Justice if the person doesn’t pay, and the alternative “Finding of Violation” track OFAC uses when it wants a formal record without a fine attached.
UNPA penalties, which turn out to be much thinner than IEEPA’s. This part is criminal only: willful violations draw up to $1 million and 20 years, with no separate civil penalty structure of its own.
The dollar figures that matter: IEEPA’s civil cap sits at $377,700 per violation, or twice the transaction value if that’s larger, and willful criminal violations top out at $1 million and 20 years. Voluntary self-disclosure earns a real discount, though how much depends on whether OFAC classifies the case as egregious or not. That distinction is worth getting right rather than compressing into a rule of thumb, so it’s covered properly in the next section.
None of this is new law. OFAC says explicitly that no penalty amounts or enforcement standards changed, only where the rules describing them live. The practical effect on a compliance program today is close to nothing. Where it will eventually show up is in the individual program regulations, Russia’s, Iran’s, Syria’s, and so on, each of which currently carries its own near-identical penalty subpart. OFAC’s announcement says publication of Part 505 sets up the deletion of over 100 of those subparts as the individual programs get replaced with a one-line pointer to this new part instead.
Where It Sits Next to Everything Else
The useful way to think about Part 505 is as one layer of a stack that already had several other pieces, and it only touches one of them.
The substance stays exactly where it was. Part 505 governs timing and paperwork. The actual judgment calls, the general factors OFAC weighs, and the base-penalty math still live in the Economic Sanctions Enforcement Guidelines at Appendix A to Part 501, which Part 505 cross-references rather than replacing (see 505.402(d)). This is also where the self-disclosure discount from the previous section actually gets worked out, and it’s more specific than a flat “cut in half.”
For egregious cases, self-disclosure does cut the base penalty cleanly in half, from the full statutory maximum down to 50 percent of it. Non-egregious cases, which cover the majority of matters OFAC actually pursues, work differently. Without a self-disclosure, the base amount comes from a stepped schedule tied to transaction-value bands (under $1,000 gets a $1,000 base, $1,000 to $10,000 gets $10,000, and so on up through $200,000 and beyond, where it caps at the statutory maximum). With a self-disclosure, the base switches entirely to one-half of the actual transaction value, capped at $188,850. Those are two different quantities, not one number and its half. A $5,000 transaction with no self-disclosure lands a $10,000 schedule-based base; the same transaction disclosed voluntarily gets $2,500, a 75 percent reduction, not 50. In most of the schedule’s bands the gap is even wider, because the schedule rounds up to the next tier rather than tracking the real transaction value. Cuba is the one exception: it still runs on its own 2003 Cuba Penalty Schedule, where OFAC’s guidelines do describe the self-disclosure discount as a literal 50 percent reduction.
TWEA-based programs run on an entirely separate, older track. Cuba, and whatever residual North Korea matters still reach back to the Trading with the Enemy Act rather than IEEPA, and that track is untouched by this rule. It lives in Part 501, Subpart D, and it differs from the new part in two ways worth knowing. The civil cap is lower, at $111,308 against IEEPA’s $377,700. And TWEA is the only one of OFAC’s penalty tracks that gives a respondent an in-house hearing before an administrative law judge, running roughly from Section 501.710 through Section 501.761, before a case becomes final agency action. Part 505 skips that step entirely: a Penalty Notice is final agency action, full stop, and the only recourse is federal district court.
A few statutes never ran through IEEPA at all, and Part 505 leaves them alone too. The Foreign Narcotics Kingpin Designation Act (Part 598) carries the highest civil cap of any OFAC authority, $1,876,699 per violation. The material-support statute behind the Foreign Terrorist Organizations program (Part 597) caps at the greater of $99,703 or twice the blocked funds a financial institution failed to retain, and it runs on its own statute, 8 U.S.C. 1189, not IEEPA at all. Both keep their own dedicated procedures.
Authority
CFR home
Civil cap per violation
Distinctive feature
IEEPA / UNPA (new)
Part 505
$377,700, or twice the transaction value if greater
No in-house hearing; a Penalty Notice is final agency action
TWEA (Cuba today)
Part 501, Subpart D
$111,308
The only track with an in-house hearing before an administrative law judge
Kingpin Act
Part 598, Subpart G
$1,876,699
Highest cap of any OFAC authority
FTO / AEDPA (18 U.S.C. 2339B)
Part 597, Subpart G
Greater of $99,703 or twice blocked funds not retained
Runs on its own statute, not IEEPA
Clean Diamond Trade Act
Part 592, Subpart F
$17,062
Lowest cap of the five; see the note below
One citation in Part 505’s own background section doesn’t hold up. It lists the Clean Diamond Trade Act’s penalties as sitting in “appendix A to 31 CFR part 501.” That’s not quite right. Appendix A does reference the CDTA’s $17,062 maximum, alongside the other four statutes, because all five share the same general factors and vocabulary that Appendix A defines. But the CDTA’s actual penalty regulations, the pre-penalty notice, response, and penalty imposition procedures, are codified separately at 31 CFR Part 592, Subpart F, the Rough Diamonds Control Regulations. It reads as though whoever drafted that background paragraph conflated “Appendix A mentions this number” with “Appendix A is where this regulation lives.”
One more thing worth knowing, for what it’s worth: this isn’t the first tenant at address 505. The number previously housed the Transaction Control Regulations, covering certain offshore trade in strategic goods with the former Soviet Bloc, until OFAC removed it in 2011 after the underlying Trading with the Enemy Act authority over North Korea lapsed. It sat vacant for fifteen years before this rule moved back in.
A Note on Sources
Every dollar figure above comes from the current text of Appendix A to Part 501, cross-checked against OFAC’s January 2025 inflation-adjustment rule, the last one that actually changed anything. There was no 2026 adjustment: the October 2025 CPI-U data needed to calculate it was never produced because of the government shutdown, and OMB formally canceled the 2026 adjustment in Memorandum M-26-11. Every number in this post, including the ones written into Part 505 itself, is the same figure that has been in effect since January 2025.
So, did OFAC change how sanctions penalties work, or just where they live? Mostly the latter. The dollar amounts, the general factors, and the self-disclosure math didn’t move. What moved is the address, and the promise that OFAC will eventually clean up a rulebook that currently says the same thing in more than a hundred places. Whether that promise gets kept on any particular timeline is, itself, a pretty good burning question for a future post.
The Department of the Treasury’s Office of Foreign Assets Control (OFAC) is consolidating previously existing information regarding enforcement procedures and penalties, including the rights of U.S. persons being investigated for violations, that are currently located in individual parts of 31 CFR chapter V into a new part, the Sanctions Penalties Regulations. Following publication of this part, OFAC will update parts within 31 CFR chapter V to replace existing penalties information with cross-references to the Regulations, resulting in the deletion of over 100 subparts from existing regulations.
Here they are (I’ll spin up Claude to summarize and compare to what used to be later):
An individual U.S. lawful permanent resident, whom OFAC identifies only as “U.S. Person-1,” has agreed to pay $1,427,230 to settle 39 apparent violations of U.S. sanctions on Iran. Between June 2019 and July 2021, U.S. Person-1 advised the management of one of Iran’s leading software companies, had Iranian dividends paid into their U.S. bank accounts, and bought real estate in Iran. OFAC investigated and resolved the case together with the FBI’s Los Angeles Field Office, through its Orange County Resident Agency.
The relationship dates to 1987, when U.S. Person-1, then living in Iran, co-founded an Iranian software company that OFAC calls Iranian Company-1. After that company became publicly listed in Iran in 2011, U.S. Person-1 co-founded a second Iranian company, a holding company OFAC calls Iranian Company-2, to keep their ownership stake in the first.
Iranian Company-1 has since become one of Iran’s leading software providers. Its products cover finance, administration, human resources, logistics, and management for industries central to Iran’s economy, among them petrochemicals, pharmaceuticals, construction, and agriculture. Its customers also include government agencies, universities, research centers, and state-owned enterprises.
U.S. Person-1 kept up their ties to both companies for many years. Between July 2019 and October 2020, they took part in 19 virtual meetings with senior personnel of the two companies. The other participants included directors and officers of Iranian Company-1, among them its Chief Executive Officer (who had co-founded the company with U.S. Person-1), the Chairman of its Board of Directors, and an employee who served as Board Secretary.
The meetings covered a wide range of company business, from corporate transactions and asset management to sales, marketing, accounting, human resources, corporate governance, and overall strategy. U.S. Person-1 drafted the agenda for some of the meetings and contributed substantive advice, analysis, and information throughout. OFAC treated this participation as the provision of management consulting and advisory services to the Iranian companies.
Separately, between June 2019 and August 2020, U.S. Person-1 had their dividends from the Iranian companies wired into U.S. banks on 16 occasions. The transfers passed through banks in third countries such as Türkiye, the United Arab Emirates, and Singapore before reaching accounts in U.S. Person-1’s name. In total, U.S. Person-1 received $713,615 in dividend payments.
In or after 2021, U.S. Person-1 used the proceeds of other dividend payments to buy four properties in Iran for relatives living there. In 2022, they gave up their ownership interest in the Iranian companies.
U.S. Person-1 was aware of U.S. sanctions on Iran the whole time. In 2000, while an executive of Iranian Company-1 in Iran, they co-wrote an article in a leading newspaper about Iran’s digital revolution and the challenges the sanctions program posed for Iran’s information technology sector.
OFAC sent U.S. Person-1 an administrative subpoena in January 2025, and the initial response was incomplete. In July 2025, OFAC issued a second subpoena, citing the gaps in the first response. U.S. Person-1 then provided a complete response.
Altogether, OFAC grouped the conduct into three kinds of apparent violations. U.S. Person-1 provided management consulting and advisory services to Iran 19 times. On 16 occasions, they caused U.S. banks to indirectly export financial services to Iran by processing Iranian-origin dividends. They also bought real property in Iran with Iranian-origin dividends four times.
OFAC cited three provisions of the Iranian Transactions and Sanctions Regulations (ITSR) for this conduct. Section 560.203 prohibits causing a violation of any of the ITSR’s other prohibitions, as well as evasion, attempted violations, and conspiracies. Section 560.204 bars the export of goods, technology, or services to Iran from the United States or by a U.S. person. Section 560.207 prohibits new investment in Iran by U.S. persons.
The release appears to pair the first two types of conduct with the wrong provisions. It lists the consulting, the dividends, and the property purchases in that order, then cites Sections 560.203, 560.204, and 560.207 “respectively,” which would tie the consulting to Section 560.203 and the dividends to Section 560.204. The fit runs the other way. A U.S. person advising Iranian companies is exporting services to Iran, which is what Section 560.204 prohibits, while causing U.S. banks to export financial services falls under Section 560.203’s ban on causing violations. The property purchases line up correctly with Section 560.207.
The Penalty
OFAC found that the violations were egregious and that U.S. Person-1 had not voluntarily disclosed them – a combination that puts a case in the most serious of the four categories OFAC uses to set a starting penalty.
Under OFAC’s Economic Sanctions Enforcement Guidelines (31 C.F.R. Part 501, Appendix A), that category produced a base penalty of $14,730,300 for this case. OFAC treated all 39 violations together as a single egregious case, so the release doesn’t break the base penalty down by type of violation.
The release calls this figure the “applicable schedule amount,” which appears to be a drafting error. Under the Enforcement Guidelines, the schedule amount is the starting point for non-egregious cases that weren’t voluntarily disclosed. For an egregious case like this one, the starting point is the statutory maximum, which under IEEPA is currently $377,700 per violation, or twice the transaction value if that is greater. Multiplying $377,700 by the 39 violations gives exactly $14,730,300. Nor could the figure be a schedule amount, since the schedule reaches $377,700 only for transactions of $200,000 or more, and the 16 dividend payments, which totaled $713,615, can’t all have been that large.
The violations took place between 2019 and 2021, when the IEEPA maximum was lower, but using today’s figure is correct. Since the Federal Civil Penalties Inflation Adjustment Act was amended in 2015, each inflation adjustment applies to penalties assessed after it takes effect, even when the underlying violation happened earlier, as long as the violation occurred after November 2, 2015.
The final settlement of $1,427,230, roughly a tenth of the base penalty, reflects OFAC’s weighing of the General Factors in its Enforcement Guidelines.
Aggravating factors
U.S. Person-1 violated U.S. sanctions willfully and over a period of years. They knew Iran was under sanctions and that their activities there were prohibited. Even so, after becoming a U.S. lawful permanent resident, they kept a significant ownership stake in both Iranian companies, advised the companies on their Iranian operations, and carried out financial and commercial activity in Iran from the United States.
General Factor A, Willful or Reckless Violation of Law: This factor asks whether a person acted knowing the conduct was against U.S. law, and whether the violations formed a pattern or were isolated. Both counted against U.S. Person-1, whose conduct was deliberate and continued over several years across several types of activity.
U.S. Person-1 had actual knowledge of each part of the conduct. By taking part in the meetings, they knew they were advising companies organized and located in Iran, and as a co-founder of Iranian Company-1, they knew the work related to services performed inside Iran. They also knew the dividends were Iranian in origin, including the money paid into their U.S. accounts and the money used to buy property in Iran.
General Factor B, Awareness of Conduct at Issue: The more a person actually knew about the conduct behind a violation, the stronger OFAC’s response. Here the knowledge was firsthand, not a matter of warning signs someone should have caught.
U.S. Person-1’s services undermined the goals of the Iran sanctions by giving an economic benefit to Iran’s largest software company and, indirectly, to the many private and public sector organizations it serves. Iranian Company-1’s software supports enterprise resource planning for national and regional government bodies, universities, research centers, and state-owned enterprises.
General Factor C, Harm to Sanctions Program Objectives: This factor measures the economic benefit that conduct gives a sanctioned country. Here the benefit reached beyond a single company into Iranian government agencies and state-owned enterprises.
U.S. Person-1 is a sophisticated businessperson who spent decades working in Iran’s information technology sector, and they were aware of how U.S. sanctions affected that sector.
General Factor D, Individual Characteristics: OFAC weighs a person’s commercial sophistication and experience. A long career in the same industry whose sanctions problems U.S. Person-1 had written about counted against them.
U.S. Person-1’s cooperation with OFAC was unsatisfactory at first. They cooperated adequately and answered OFAC’s questions only after OFAC issued a second subpoena.
General Factor G, Cooperation with OFAC: This factor looks at whether a person provides all relevant information and responds promptly to requests. An incomplete response that took a second subpoena to correct fell short on both counts.
Mitigating factors
U.S. Person-1 had not been the subject of any OFAC enforcement action in the five years before the earliest transaction at issue.
General Factor D, Individual Characteristics: A person’s sanctions history over that five-year window is part of this factor. A clean record generally qualifies as a “first violation,” which can reduce the base penalty by up to 25 percent.
U.S. Person-1 stopped the conduct before receiving OFAC’s subpoena, and had given up their shares in the Iranian companies years before learning of OFAC’s investigation.
General Factor F, Remedial Response: This factor considers whether a person stopped the conduct at issue. U.S. Person-1 had already ended the conduct years before OFAC made contact.
OFAC considered U.S. Person-1’s inability to pay a larger settlement, which they proved to OFAC’s satisfaction with extensive and detailed supporting documentation.
General Factor D, Individual Characteristics: This factor includes a person’s overall financial condition. Here that condition limited how large a settlement U.S. Person-1 could pay.
What are the Takeaways?
OFAC’s prohibitions apply to all U.S. persons, and that includes lawful permanent residents (green card holders). Like most OFAC programs, the Iran sanctions program defines a U.S. person to include any U.S. citizen or permanent resident, wherever they are located (31 C.F.R. § 560.314). When U.S. Person-1 moved to the United States, they took on the same compliance obligations as any other U.S. person.
Keeping up business relationships with people in Iran is risky. The Iran prohibitions are broad and generally bar any direct or indirect dealings, including providing or receiving personal services. Unless OFAC has issued a license, a U.S. person who helps manage the affairs of a business in Iran, or in any other sanctioned jurisdiction, is almost certain to violate sanctions.
Cooperating promptly and fully with an OFAC investigation matters. OFAC considers how well a subject cooperates when it decides how to resolve a case and how large a penalty or settlement should be. Timely, thorough cooperation shows that the subject takes their sanctions compliance obligations seriously. It also saves OFAC time and resources by letting it finish the investigation efficiently.
Cooperation that falls short carries two risks. The subject can lose the mitigation credit that good cooperation would have earned, and can also face separate penalties under OFAC’s Reporting, Procedures and Penalties Regulations (31 C.F.R. Part 501).
Other resources
OFAC’s May 2019 publication, A Framework for OFAC Compliance Commitments, gives the agency’s view of the essential components of a sanctions compliance program. It is aimed at organizations subject to U.S. jurisdiction, and at foreign companies that do business in or with the United States or U.S. persons, or that use goods or services exported from the United States. The Framework also explains how OFAC may factor those components into its evaluation of apparent violations and its settlements, and an appendix analyzes some of the root causes of apparent violations that OFAC has identified in its investigations.
OFAC’s website offers other resources for sanctions implementation and compliance, including guidance for specific industries, instructional videos, answers to frequently asked questions, and tools for searching OFAC’s sanctions lists.
The rules for the civil penalties process are in the regulations for each sanctions program, the Reporting, Procedures and Penalties Regulations (31 C.F.R. Part 501), and the Enforcement Guidelines (31 C.F.R. Part 501, Appendix A). OFAC keeps these references, along with recent civil penalties and enforcement information, on its civil penalties and enforcement page.
Separately, Treasury’s Financial Crimes Enforcement Network (FinCEN) runs a whistleblower incentive program covering violations of OFAC-administered sanctions, other violations of the International Emergency Economic Powers Act, and violations of the Bank Secrecy Act. Whistleblowers in the United States or abroad may be eligible for an award if their information leads to a successful enforcement action with monetary penalties over $1,000,000. The program covers information about potential violations in any commercial sector.
Subject: Citibank, N.A., London Branch (“CBNA London”)
Sector: UK branch of Citibank, N.A., operating as a core wholesale and correspondent bank and providing cross-border payments, cash management, multicurrency accounts, and market and securities settlement services
Authority: OFSI (HM Treasury), under section 146 of the Policing and Crime Act 2017
Date of Penalty: 11 August 2026
Penalty Amount: £4,732,830.58 (reduced from a baseline of £7,888,050.97)
Sanctions Regime: Russia (Sanctions) (EU Exit) Regulations 2019 and the Global Anti-Corruption Sanctions Regulations 2021
Provisions Breached:
Russia Regulations, regulation 11 — dealing with frozen funds
Russia Regulations, regulation 12 — making funds available
GAC Regulations, regulation 13 — making funds available for the benefit of a designated person
Designated Persons / Nexus: A designated Russian individual and companies that individual owned or controlled; PJSC Sovcomflot and entities it owned or controlled; the designated Russian financial institutions Alfa-Bank JSC, PJSC Gazprombank, Credit Bank of Moscow, Bank GPB International SA, Russian Agricultural Bank JSC, Amsterdam Trade Bank, Ural Bank for Reconstruction and Development, PJSC VTB Bank, Bank Otkritie Financial Corporation PJSC, Rosbank, Evraz PLC, and AFK Sistema (owner of East-West United Bank SA); a person who became designated after CBNA London’s appointment as Principal Paying Agent for loan participation notes issued by that person’s SPV; and an individual designated under the GAC Regulations. The notice does not give designation dates or unique IDs for these parties.
Guidance Applied: 9 February 2026 version of the Financial Sanctions Enforcement and Monetary Penalties Guidance
Resolution: Settlement
What Happened
CBNA London operates as the UK branch of Citibank, N.A., serving as a core wholesale and correspondent bank and as a key node in Citi’s global payments network. That footprint gave it particularly high exposure to Russia sanctions risk once the invasion of Ukraine began on 24 February 2022: a Russian client base, correspondent relationships with Russian financial institutions, and payments tied to its former Russian affiliate, AO Citibank.
The breaches surfaced across eight matters spanning payment processing, correspondent banking, and account administration. In total, CBNA London processed 970 payments worth approximately £19.72 million that OFSI considers were breaches of the Russia Regulations or the GAC Regulations.
The largest matter involved corporate clients majority owned by designated persons. CBNA London failed to promptly restrict 24 accounts held by 11 companies owned by a designated Russian individual, processing 242 payments worth roughly £5.9 million in breach of regulation 11. A backlog at the third-level alert review stage left some alerts unadjudicated for weeks. Staff missed internal warnings that the accounts remained unrestricted, and one entity’s ownership was incorrectly assessed as falling below the sanctions threshold. Roughly £4.3 million of the £5.9 million moved within 24 hours of designation. OFSI treated that timing as strongly mitigating, though the payments still counted toward the breach total because further breaches at the same entities followed weeks later. A separate £600,000 moved from an unrelated company to one the individual owned, in breach of regulation 12.
A related failure ran through 32 accounts held by 29 entities owned or controlled by PJSC Sovcomflot (“SCF”): 328 transactions worth about £5.4 million, also breaching regulation 11. Here the cause was more mechanical than procedural. CBNA London’s screening system treated OFSI’s consolidated-list entry, “Sovcomflot,” as a poor match against the bank’s own KYC record, “PAO Sovcomflot,” so the Russian corporate prefix suppressed the alert entirely.
CBNA London also deducted its own fees, taxes, and payment corrections from accounts already restricted pending a true-match determination on designated persons and SCF-linked entities: 177 transactions worth about £135,000, breaching regulation 11 on the debit side and regulation 12 on the credit side. The type of restriction applied to those accounts blocked customer and third-party debits but not the bank’s own internal charges – in substance, the bank kept helping itself to frozen funds while the accounts sat under review. A bulk interest-correction process compounded the problem, running without flagging that a sanctions hold was in place.
Correspondent banking produced four further matters. Between February and June 2022, CBNA London processed 19 payments worth about £26,000 to designated Russian banks acting as correspondents, because an automated payment processor drew correspondent banks from an internal routing list that had never been screened against the sanctions list. Between March and May 2022, a further 165 payments worth about £729,000 breached regulation 12: correspondent banks were identified only by Bank Identification Code rather than name in the payment message, and those BICs had not been added to CBNA London’s screening lists in time. Between September and October 2022, 14 payments worth about £4 million breached regulation 12 after CBNA London itself was added to the correspondent chain post-screening, and staff missed the resulting UK nexus to a designated person. And between August and October 2022, CBNA London processed six return payments worth about £1.2 million to Rosbank and Gazprombank as ultimate beneficiary banks: the return instructions identified only the next bank in the chain, not the designated beneficiaries further along it.
A scattered set of alert-handling errors between March 2022 and February 2025 – nine payments worth about £500,000 – involved staff misreading sectoral guidance, issuing conflicting instructions to colleagues, or failing to follow a licence’s terms. In the highest-value case, an alert handler dispositioned a payment months after the fact and mistook the designated remitter bank for the beneficiary, releasing funds back to the designated person in error.
In November 2022, acting as Principal Paying Agent for loan participation notes issued by an SPV whose beneficial owner later became a designated person, CBNA London received an interest payment through a correspondent bank. It rejected and returned those funds in February 2023. OFSI determined this made funds available indirectly to a designated person – a breach of regulation 12 worth approximately £1.5 million – because staff had identified the relevant alert but failed to recognize the SPV’s ownership and escalate it.
Finally, between January and July 2025, CBNA London processed ten correspondent-banking payments worth about £300,000 connected to an individual designated under the GAC Regulations: nine for that individual’s benefit and one between two companies the individual owned, in breach of regulation 13. CBNA London first flagged the exposure through an unrelated money-laundering alert, but its initial sanctions escalation went to the wrong team, and the case was closed without further action.
CBNA London voluntarily disclosed the majority of these matters; OFSI identified the rest, principally the SCF breaches and the interest payment, through its own inquiries. OFSI issued a Notice of Intention to impose a monetary penalty on 15 June 2026. The parties agreed to enter settlement discussions on 29 June 2026, commencing 1 July 2026, and reached settlement on 11 August 2026, the same day OFSI imposed the penalty. As a condition of settlement, CBNA London agreed to pay the penalty as imposed and waived its rights to a ministerial review and to an appeal to the Upper Tribunal.
The Breaches
Russia Regulations, regulation 11 (dealing with frozen funds): Breached by failing to promptly restrict accounts held by companies owned or controlled by a designated Russian individual (242 payments, about £5.9 million) and by entities owned or controlled by PJSC Sovcomflot (328 transactions, about £5.4 million), and by debiting internal fees, taxes, and payment corrections from accounts that were restricted but not yet confirmed as a true sanctions match (part of the roughly £135,000 internal-charges matter).
Russia Regulations, regulation 12 (making funds available): Breached by a payment of over £600,000 from an unrelated company to one owned by the designated individual; by internal charges credited to restricted accounts (the remainder of the roughly £135,000 internal-charges matter); by 19 payments (about £26,000) and 165 payments (about £729,000) processed through designated Russian correspondent banks; by 14 payments (about £4 million) where CBNA London itself was added to a correspondent chain after screening; by 6 return payments (about £1.2 million) to Rosbank and Gazprombank as ultimate beneficiaries; and by an interest payment of about £1.5 million returned to a correspondent bank on behalf of a designated person’s SPV.
GAC Regulations, regulation 13 (making funds available for the benefit of a designated person): Breached by 10 correspondent-banking payments (about £300,000) connected to an individual designated under the Global Anti-Corruption Sanctions Regulations 2021.
The notice does not specify which regulation the nine alert-mishandling payments (about £500,000) breached, so they are addressed in the narrative and case assessment rather than in this list.
Valuation of the Breach
Total Assessed Value: £19,720,127.43 (970 payments)
Corporate clients – designated Russian individual: approximately £6.5 million (£5.9 million under regulation 11, plus a further £600,000+ under regulation 12)
Corporate clients – PJSC Sovcomflot-linked entities: approximately £5.4 million (regulation 11)
Internal charges on restricted accounts: approximately £135,000 (regulation 11 on debits, regulation 12 on credits)
Russia-related correspondent banking: approximately £26,000 (February–June 2022), £729,000 (March–May 2022), £4 million (September–October 2022), and £1.2 million (August–October 2022), all under regulation 12
Alert mishandles: approximately £500,000 (regulation not specified in the notice)
Interest payment / Principal Paying Agent role: approximately £1.5 million (regulation 12)
GAC correspondent banking payments: approximately £300,000 (regulation 13)
OFSI’s Case Assessment
Aggravating Factors:
The aggregate breach value was very high, at approximately £19.7 million, and the case involved a very high volume of payments, including repeated lower-value transactions reaching significant totals (Case Factor B).
The Russia sanctions regime is a strategic priority for UK foreign policy, particularly following the invasion of Ukraine (Case Factor C).
The breaches caused sustained, material harm to the sanctions regimes’ objectives, letting designated persons or their entities access funds, settle obligations, or continue operating, even though OFSI found no intent to undermine the regime (Case Factor D).
For breaches occurring after 15 June 2022, CBNA London’s own systems in some cases held information sufficient to catch the breach that was not properly disseminated or acted on; OFSI considered that the bank should have known or suspected its actions would result in a breach (Case Factor E).
The systems and controls issues behind many of the breaches, including the Sovcomflot screening gap and the unscreened correspondent-banking lists, were reasonably foreseeable given CBNA London’s known elevated exposure to Russia sanctions risk; OFSI expected more detailed UK-specific preparation than the bank could show (Case Factor F).
The incorrect ownership-and-control determination for one entity was not a reasonable conclusion from the information available to CBNA London (Case Factor G).
Most matters involved a repeated, persistent, or extended pattern of breaches sharing a common root cause, with the interest payment and alert mishandles as exceptions (Case Factor H).
CBNA London failed to report frozen assets to OFSI as soon as practicable on 53 occasions tied to the internal-charges matter, with delays exceeding six weeks in every instance, reaching 518 days in 11 cases, and averaging 274 days.
Mitigating Factors:
The internal-charges breaches were generally low in value (Case Factor B).
The internal-charges breaches caused comparatively little harm to the sanctions regimes’ aims: they did not make funds available to designated persons directly, involved a type of activity OFSI commonly licenses, and gave CBNA London no meaningful benefit (Case Factor D).
The interest payment and the alert-mishandling breaches were not repeated, persistent, or extended (Case Factor H).
Proximity to designation was strongly mitigating for the majority of the breaches involving corporate clients owned by the designated individual, where roughly £4.3 million of the £5.9 million total moved within 24 hours of designation.
CBNA London undertook a remediation programme addressing the root causes identified and was open in sharing its corrective action plans and progress updates with OFSI.
Citi’s decision to withdraw from Russia reduces the risk of future breaches and aligns with the sanctions regime’s aims, though OFSI noted it was not directly related to its investigation.
Neutral Factors:
OFSI does not consider that CBNA London sought to circumvent sanctions in any matter; consistent with its published guidance, OFSI does not treat the absence of circumvention as mitigating, so this factor was treated as not relevant (Case Factor A).
OFSI considered other case factors either not relevant to the case or, on balance, neither aggravating nor mitigating, without specifying which.
Overall Assessment: OFSI rated the severity of the case as High and CBNA London’s conduct as Aggravating, concluding the case met the criteria for Level 4, the highest rating in its four-tier seriousness framework. OFSI found no intent by CBNA London to breach sanctions, but characterized the errors and failings as material and significant across a wide range of business areas and systems, with the corporate-clients matter especially concerning given how long some accounts remained unrestricted after designation. OFSI also weighed the operational strain created by the unprecedented scale and complexity of the sanctions measures introduced after Russia’s 2022 invasion, without treating that context as an excuse for the breaches.
How the Penalty Was Calculated
Total Breach Value: £19,720,127.43
Statutory Maximum: £9,860,063.72 (the greater of £1 million or 50% of the estimated breach value)
Baseline Penalty: £7,888,050.97 (80% of the statutory maximum; OFSI’s guidance sets a Level 4 baseline at or above 75%)
Discount(s) Applied:
Voluntary disclosure and co-operation discount: 20%, within a maximum available discount of 30%
Settlement discount: 20%, for reaching agreement within the 30-business-day settlement period
Combined discount: 40%
Final Penalty: £4,732,830.58
The statutory maximum here still uses the pre-existing formula, the greater of £1 million or 50% of the breach value. The Guidance’s proposed increase to the greater of £2 million or 100% of the breach value requires legislation that was not yet in force in this case.
Compliance Lessons
Study these failure patterns even outside financial services: firms using similar automated systems or manual escalation processes, not just banks, should examine whether their own controls could produce the same alert-handling delays, screening gaps, or internal-charge oversights identified in this case.
Map sanctions-risk exposure to a level of detail that survives real stress: firms with elevated exposure to a specific sanctions risk should carry out detailed prior analysis of where controls might fail once designations spike in volume, rather than relying on general preparedness.
General licences authorize exactly what they say, no more: a wind-down licence permits unwinding a relationship with a designated person; it does not cover every payment tied to that person indefinitely. Firms should confirm in advance that a licence applies to a given transaction, document that assessment, and take particular care where they operate accounts on a designated person’s behalf.
Voluntary disclosure pays, but only if it is timely and complete: firms can secure up to a 30% discount by self-reporting promptly, providing a full account of the breach, and cooperating throughout the investigation, including providing information beyond what OFSI explicitly requests. Where full disclosure is not immediately possible, an early partial disclosure followed by a fuller report is preferable to delay; in sufficiently complex cases, firms may also want to consider the Early Account Scheme, though CBNA London did not use it here.
Supplemental Information: At £4,732,830.58, this is one of OFSI’s larger civil monetary penalties, though it remains well below the £20.47 million OFSI imposed on Standard Chartered in 2020, still the largest penalty in OFSI’s history. It is larger than the roughly £1 million penalty OFSI imposed on Sabre Global Technologies Limited in June 2026, which press coverage at the time described as the largest OFSI penalty tied to Russia sanctions since the 2022 invasion of Ukraine. The case was decided under OFSI’s four-tier seriousness matrix introduced in its 9 February 2026 Enforcement Guidance, and a Level 4 rating, the framework’s top tier, carries significance beyond the size of the resulting penalty: practitioner commentary on the new framework notes that OFSI may refer Level 4 cases for criminal investigation in the first instance, turning to civil enforcement only if a prosecution does not follow. CBNA London’s case did not take that route; OFSI proceeded directly to a civil monetary penalty resolved by settlement.
All facts trace to the penalty notice itself; no press release or additional guidance PDF was attached to this run, and no unsupported claims were retained.
Extraction was done by meaning, not by paragraph position.
The penalty-calculation chain reconciles exactly: baseline (80% of the statutory maximum) less a combined 40% discount produces the final penalty to the penny. The component-level breach values across the eight matters, however, sum to roughly £20.3 million rather than the notice’s stated £19,720,127.43, and the notice’s own case-assessment paragraph cites still-different subtotals (approximately £5.3 million and £6 million) for the corporate-clients and correspondent-banking groups that don’t match the per-matter figures given elsewhere. All figures are reproduced as stated; this most likely reflects rounding across several “approximately” figures rather than an error to correct.
A minor count discrepancy exists in the notice itself: the corporate-clients/individual matter is described as 242 payments in one paragraph and “the majority of the 244 breaches” in another. Both figures are reproduced as stated.
The governing guidance is correctly identified as the 9 February 2026 four-tier framework, and the Level 4 label, discount caps, and calculation method match what the notice describes. The statutory maximum, however, still used the pre-existing formula rather than the higher cap floated for this framework, since that increase awaits legislation.
Regulation numbers and descriptors are reproduced exactly as stated. The nine alert-mishandling payments (about £500,000) are not tied to a specific regulation number in the notice and were therefore left out of the per-regulation breach list.
No conflation identified between CBNA London and the designated persons or entities named in the notice.
Supplemental content is confined to the block above and sourced in the Sources list.
Rice Lake Weighing Systems, a Wisconsin company that makes and sells scales and other weighing equipment, has agreed to pay $60,764 to resolve eight apparent violations of U.S. sanctions on Iran. The violations trace back to Rice Lake’s Italian subsidiary, Dini Argeo, which sold weighing equipment to a distributor in the United Arab Emirates while knowing the equipment was ultimately headed to Iran.
In November 2016, Rice Lake bought Dini Argeo S.r.l., an Italian manufacturer of weighing equipment. Before the acquisition, Dini had an existing business relationship with Pand Weighing Control (“Pandtec”), an Iranian weighing systems company, and it kept selling to Pandtec afterward. That was permitted at the time under General License H, which let foreign companies owned by U.S. persons do business with Iran subject to certain conditions.
That changed in 2018. After the United States withdrew from the Iran nuclear deal in May, OFAC revoked General License H that June, though it allowed a short wind-down period running through early November. Once that period ended, Dini – as a company owned by a U.S. parent – was barred from selling to Iran, whether directly or indirectly.
Rice Lake did notify Dini of the change, in an email sent that August by its Import Export Coordinator. The message, written only in English, warned that dealings with Iran or Iranian citizens were now off-limits and quoted directly from the sanctions regulations. But Rice Lake stopped there: it offered no further explanation or translation, and OFAC found no evidence that the company checked whether Dini’s staff actually understood the new rules or took steps to monitor compliance with them.
Dini did stop selling directly to Iranian customers. Its staff, however, don’t appear to have understood that selling to Iran indirectly, through a middleman, was just as prohibited. Between June 2019 and November 2021, Dini filled eight orders – worth roughly $121,527 combined – for a UAE-based distributor of weighing equipment, knowing the distributor would resell the goods into Iran.
The sales paperwork never named Pandtec as the ultimate buyer, but the signs were hard to miss. On at least five occasions in 2019 and 2020, a Pandtec employee emailed Dini staff with product and technical questions, and every one of those emails carried a signature block that referenced Iran. The UAE distributor itself eventually confirmed that the goods were bound for Pandtec. Given Dini’s prior direct relationship with the company, OFAC concluded that Dini knew, or had reason to know, exactly where its products were ending up.
The scheme surfaced in late 2021, when Rice Lake received a tip that its products were showing up in Iran. The company launched an investigation, quickly traced the diversion to Dini’s sales through the UAE distributor, and ordered Dini to cut off that distributor entirely. Rice Lake then reported the violations to OFAC on its own initiative and began strengthening its compliance program.
Legally, OFAC pinned the violations on Section 560.215(a) of the Iranian Transactions and Sanctions Regulations (ITSR), which extends Iran-related trade prohibitions to foreign entities owned or controlled by a U.S. person. Because Dini knowingly conducted trade with a person tied to Iran – conduct that would be barred under the ITSR’s export and trade-related-transaction provisions (Sections 560.204(a) and 560.206(a)(2)) if done by a U.S. person directly – each of the eight shipments counted as a separate apparent violation.
The Penalty
OFAC treated this as a single non-egregious case and credited Rice Lake for voluntarily disclosing the violations – both determinations shaped how the penalty was calculated.
Under OFAC’s Economic Sanctions Enforcement Guidelines (31 C.F.R. Part 501, Appendix A), a non-egregious, voluntarily self-disclosed case starts with a base penalty equal to half the total transaction value involved. Applied to the $121,527 in combined value across the eight orders, that formula produced a base penalty – and the final settlement amount – of $60,764. All eight violations were treated together as a single non-egregious case rather than split by type, so there’s no further breakdown to report beyond that aggregate figure.
From there, OFAC weighed the case against its General Factors for aggravating and mitigating circumstances.
Aggravating factors
Dini kept selling indirectly to Iran even though it should have recognized that was just as prohibited as selling directly, and Rice Lake never explained to its subsidiary why indirect sales carried the same risk.
General Factor A, Willful or Reckless Violation of Law: OFAC found this reflected reckless disregard for U.S. sanctions requirements – a failure to exercise even a minimal degree of caution once the direct-sales ban was already known.
Dini knew, or had reason to know, that its products were ending up in Iran, even if it mistakenly believed the sales were permitted.
General Factor B, Awareness of Conduct at Issue: this is the “reason to know” standard – Dini had enough information in front of it, including the Pandtec emails and the signature blocks that referenced Iran, to know where its goods were headed.
The equipment sold is the kind ordinary commercial businesses use, so the sales likely supported everyday economic activity in Iran, and they continued for more than two years.
General Factor C, Harm to Sanctions Program Objectives: this factor looks at both the economic benefit a transaction confers on a sanctioned country and how long the conduct continued, and both were present here.
Mitigating factors
Neither Rice Lake nor Dini had faced an OFAC enforcement action in the five years before the earliest of these transactions.
General Factor D, Individual Characteristics: OFAC treats a clean sanctions history over that five-year window as grounds for a “first violation” reduction.
The transactions at issue were a very small share of either company’s overall sales during the relevant period.
General Factor D, Individual Characteristics: this factor also weighs the volume of apparent violations against a company’s total transaction volume, and here the violations were a small fraction of business.
Rice Lake acted quickly once it learned of the problem. It hired outside sanctions counsel and ran a thorough investigation, including a check for other possible violations. It then strengthened its compliance program on three fronts: training for subsidiary employees, vetting of end distributors, and reexport control warnings added to its commercial invoices.
General Factor F, Remedial Response: this factor rewards how fast and how thoroughly a company responds once a violation surfaces, and Rice Lake’s response touched every area OFAC looks at – stopping the conduct, investigating fully, and fixing the underlying gaps.
Rice Lake cooperated fully with OFAC’s investigation, responding promptly to inquiries and document requests and agreeing to toll the statute of limitations while the case was under review.
General Factor G, Cooperation with OFAC: prompt responsiveness and a willingness to toll the statute of limitations are both cooperation factors OFAC credits favorably.
What are the Takeaways?
This case is a reminder of the sanctions exposure U.S. companies carry for their foreign subsidiaries and affiliates. The Iran program is especially strict on this point: foreign entities owned or controlled by a U.S. person have to comply almost as fully as the U.S. parent itself.
That exposure is separate from the liability foreign companies can face under other rules that apply to non-U.S. persons directly, such as causing a U.S. person to violate sanctions. Here, the risk ran through ownership rather than through any direct U.S. nexus.
U.S. companies need to make sure any foreign subsidiaries they own or control actually understand, and fully comply with, the sanctions rules that apply to them. A subsidiary’s compliance failure becomes the parent’s liability. And as this case shows, that risk includes goods flowing back into Iran through the subsidiary’s own sales channels.
The fix starts with effective, risk-based controls at the subsidiary level. That means training and guidance for everyone who touches the relevant transactions, not just management. Misunderstandings at the staff level can create liability just as easily as decisions made higher up, and enforcement is more likely where a company hasn’t taken reasonable steps to prevent them.
Training should be tailored to the subsidiary’s actual environment, accounting for things like local language and business customs, rather than a one-size-fits-all policy translated, or not translated, from headquarters.
Oversight controls matter too. Centralized monitoring and regular testing and auditing give a company the chance to catch weaknesses before they turn into violations, and those controls should be calibrated to a given entity’s specific risk profile. Companies with counterparties in jurisdictions known for diversion risk, the UAE among them, should pay particular attention to the danger of indirect dealings with sanctioned parties.
Finally, sanctions programs shift, sometimes quickly, and a company needs to keep pace with those changes rather than treat a compliance framework as something it can set once and leave alone.
OFAC ties this discussion to Treasury’s March 2024 Tri-Seal Compliance Note on foreign-based persons’ sanctions obligations, along with OFAC FAQs 11 and 644.
Other resources
OFAC’s 2019 publication, A Framework for OFAC Compliance Commitments, lays out the agency’s view of what belongs in an effective sanctions compliance program, along with an appendix on the common root causes behind apparent violations.
For the mechanics of the civil penalties process itself, the relevant sources are the regulations for each sanctions program, the Reporting, Procedures, and Penalties Regulations at 31 C.F.R. Part 501, and the Enforcement Guidelines discussed above. OFAC keeps these references, along with its recent civil penalties and enforcement actions, on its website.
Separately, Treasury’s Financial Crimes Enforcement Network runs a whistleblower program covering OFAC sanctions violations as well as violations of IEEPA, the Foreign Narcotics Kingpin Designation Act, the Trading with the Enemy Act, and the Bank Secrecy Act. Whistleblowers, whether based in the U.S. or abroad, may be eligible for an award if their information leads to a successful enforcement action with penalties over $1,000,000, across any commercial sector.
Count the EU’s Russia packages by designations added and you learn almost
nothing. Package 21 alone carried 218 listings, the largest single batch in four
years, and not one of them changed how a screening program works. What changes
your program is a new kind of restriction: a category of counterparty you now
have to test for, a contract term you now have to insert, a service you can no
longer provide.
By that measure the twenty-one packages contain roughly two dozen genuinely
distinct restriction types, and they did not arrive evenly.
One note on where this starts. The EU has had Russia sanctions since 2014,
and the post-Crimea framework already limited Russian bank and corporate access
to European capital markets. Package 1 extended that framework rather than
inventing it, and the same is arguably true of parts of the early export
controls. The 2022 measures are different enough in scale and in kind to be
worth treating on their own terms, which is what this article does, but the
baseline was not zero.
Note: this is a long article. A PDF version is available for download at the end, and it adds an appendix listing the amending regulation behind each of the twenty-one packages.
Package 1 restricted Russian access to EU capital and financial markets
(Regulation 2022/262). Package 2 opened the export control front, covering goods
and technology for defence, aviation and space, and oil refining (Regulation
2022/328).
Package 3 is the consequential one. It banned transactions with the Central
Bank of Russia, cut seven banks off the SWIFT financial messaging network, and
closed EU airspace to Russian aircraft (Regulation 2022/334, extended by
2022/345, 2022/350 and 2022/394).
Package 4 added three measures (Regulation 2022/428). The first banned new
investment in Russia’s energy sector. The second barred imports of Russian iron
and steel. The last prohibited exports of luxury goods.
Timing matters here in a way it rarely does later. The Central Bank measure
landed on 28 February, four days into the invasion, alongside parallel US and UK
action. That simultaneity was the point. A reserve freeze telegraphed in advance
is a reserve freeze that gets moved.
Why it mattered
The immediate effect was severe and short-lived. The ruble fell from roughly
80 to 120 per dollar within two weeks. Russia’s central bank raised its key rate
from 9.5 percent to 20 percent on 28 February.
Within about two months the currency had recovered to pre-invasion levels.
Capital controls, a requirement that exporters convert 80 percent of their
foreign currency earnings, and a demand that energy buyers pay in rubles did
most of that work. Analysts have generally read this as the financial shock
being absorbed rather than proving decisive. Roughly €300 billion in Russian
central bank reserves sat frozen across the EU, other G7 states and Australia,
about two-thirds of it in the EU, but Russia’s current account surplus kept
climbing on continued energy sales.
The EU’s approach already differed from Washington’s in one visible way. It
deliberately left Sberbank and Gazprombank off the SWIFT cutoff, because those
were the payment channels for European gas. The United States had no equivalent
reason to carve anyone out.
Switzerland aligned almost immediately, a real departure from its historical
posture. It did so by mirroring EU measures through its own Ukraine Ordinance
rather than adopting them directly, and that mechanism would later produce
timing gaps that still cause trouble. Belarus was pulled in from package 3
onward, establishing the mirroring pattern that has held since.
Packages 5-9: building the sectoral toolkit
April to December 2022
This is where the sectoral measures were built.
Package 5 carried four distinct measures (Regulation 2022/576). It closed EU
ports to Russian vessels and barred Russian road hauliers from EU territory. Coal
imports were banned outright. And this package introduced the first restriction
on crypto assets, capping what Russian persons could hold.
Package 6 delivered the crude oil and refined products import ban, the
measure that took longest to negotiate (Regulation 2022/879). The ban reached oil
arriving by sea but excluded oil delivered to the EU through pipelines, an
exemption Hungary, Slovakia and Czechia still operate under. The same package
brought the first professional services ban, covering accounting, audit,
bookkeeping and consulting.
Package 7 banned gold imports and extended the port access ban to locks
(Regulation 2022/1269).
Package 8, in October 2022, did two things that would define the following
four years (Regulation 2022/1904). It created a listing criterion aimed
specifically at people facilitating circumvention, which meant the EU could now
designate someone for helping others evade sanctions rather than for any
underlying conduct. The same package established the oil price cap. Less
prominently, it also widened the services bans to architectural, engineering, IT
consultancy and legal advisory work (Article 5n).
Package 9 closed the year with a ban on new investment in Russian mining and
a prohibition on advertising and market research services (Regulation
2022/2474).
Why it mattered
The revenue effect was real and measurable. The Council reported Russian
revenues down 26.9 percent in January 2023 against January 2022, and down 41.7
percent in February. The Council’s explanation of these figures is somewhat
vague, but they most likely refer to oil and gas revenues. The February number
is the one most plausibly connected to package 6, since the refined products ban
and the price cap only took effect on 5 February 2023.
The price cap is the more interesting story, because it is the clearest case
of a sanctions measure generating its own countermeasure. The cap was designed
to keep Russian oil flowing to global markets while limiting what Russia earned
from it, and it worked through leverage over Western shipping and insurance.
Russia’s answer was to assemble a fleet of older tankers under opaque ownership
and arrange insurance outside the coalition, so the shipping and insurance
leverage the cap depended on no longer reached the trade. The shadow fleet went
from essentially nothing to carrying most Russian crude within about two
years. Elisabeth Braw has argued publicly that Western governments would not
have imposed the cap had they anticipated that outcome, which is a strong claim
but not an unreasonable one.
The cap is also the most genuinely coalition-built instrument of the entire
effort, agreed across the G7, the EU and Australia. That agreement did not
extend to enforcement. The United States leaned on the threat of secondary
sanctions against foreign financial institutions that handled capped oil. The EU
leaned instead on its jurisdiction over the shipping and insurance companies
themselves. Same cap, different levers, and third-country intermediaries learned
quickly which one bit harder.
Packages 10-13: the circumvention turn
February 2023 to February 2024
Four packages over a full year, and almost everything in them is aimed at closing the routes goods were taking around the restrictions already in place, rather than at adding new targets. These packages also refined measures already on the books in three places.
Package 10 banned transit of dual-use goods and arms through Russian territory (Regulation 2023/427). Package 11 extended that transit ban and formalised cooperation with third countries (Regulation 2023/1214).
Package 12 introduced three measures worth singling out (Regulation 2023/2878). The first is the “no-Russia clause”, which requires EU exporters to write a contractual prohibition on re-export to Russia into their sales agreements (Article 12g). The second is a ban on providing enterprise management and industrial design software. The third is a reporting requirement for outbound transfers above €100,000 by EU companies owned or controlled by Russian persons. Package 12 also banned imports of Russian diamonds, along with LPG and several metals, which is a story in itself and taken up below.
Package 13, at the two-year mark, was mostly additional sanctions designations (Regulation 2024/745). It added 194 individuals and entities and took the total past 2,000. But two things in it pointed forward.
The first was a widening of export controls. Aluminium electrolytic capacitors went onto the list of goods that could strengthen Russia’s military and technological base (Annex VII Part B). Electrical transformers, static converters and inductors went onto the separate list of goods that could build up Russian industry generally (Annex XXIII, Article 3k). That second list had previously covered three specific tariff codes. Package 13 replaced them with the entire tariff heading that sits above those codes, so every transformer, converter and inductor became controlled rather than three named types. For an exporter, that is the difference between checking a code list and re-screening a product line. Existing contracts had until 25 May 2024 to complete.
The second was the addition of 27 entities to the list carrying stricter dual-use and advanced technology export restrictions (Annex IV). Those designations reached into mainland China, India, Sri Lanka, Serbia, Kazakhstan, Thailand and Turkey.
The no-Russia clause, and why it has no US twin
The no-Russia clause deserves attention because it is an EU original. Washington’s route to the same problem runs through the BIS Entity List and the foreign direct product rules. The Entity List is the Bureau of Industry and Security’s roster of foreign parties that US exporters need a licence to ship to, with those licences generally presumed denied. The foreign direct product rules extend US licensing authority to goods manufactured outside the United States when they were made using US technology or equipment, which is how Washington reaches transactions with no American party in them at all.
Brussels went the other way. It pushed the obligation into private contracts, making the exporter responsible for a term in a sales agreement. Neither approach has obviously won. The EU version is cheaper to administer and harder to enforce. The US version is the reverse.
Diamonds, and the limits of provenance
The diamond ban deserves its own treatment, because it shows what happens when a restriction depends on where something came from rather than who paid for it.
Russia is the world’s largest diamond producer by volume, at roughly a third of global supply. Alrosa accounts for over 90 percent of Russian production, and the Russian state holds a majority stake in it, split between the federal government and the Republic of Sakha (Yakutia), the region of eastern Siberia where the mines sit, together with that republic’s districts. Diamond revenue therefore reaches the Russian state rather than private shareholders. In absolute terms the target is small. Alrosa’s 2023 results put the business at around $3.5 billion, a rounding error against hydrocarbons.
The cost to Antwerp was more visible. Belgium imported roughly €1.8 billion of Russian rough diamonds in 2021, about a quarter of its total rough imports. That fell to around €1.4 billion in 2022 and to €288 million in the first half of 2023, most of the decline arriving before the ban did. The Antwerp World Diamond Centre argued throughout that an EU-only ban would be dramatic for Antwerp and produce no impact on Russia, because trade would simply reroute through Dubai and Mumbai.
Belgium’s position is the interesting part. Rather than resisting, it ended up leading the coordination, on the reasoning that serving as the world’s Russian-diamond laundromat was doing more damage to Antwerp’s standing than a ban would do to its trade.
India is where enforcement actually lives. Over 90 percent of the world’s diamonds are cut and polished there, and Alrosa supplied around 40 percent of India’s rough imports. A ban on Russian-origin stones only means something if Indian polishers segregate Russian goods from everything else, which is why G7 delegations went to India in September 2023 to make the case. The EU’s answer was to require that rough diamonds of half a carat or more be certified through Antwerp from September 2024, with the record kept on a blockchain ledger. Smaller stones fell outside the requirement.
Then the coalition came apart. The United States disengaged from the G7 traceability working groups after pushback from African producers, Indian polishers and New York jewellers. A Biden administration official’s position was that the September 2024 commitment bound the EU rather than the United States. The polished-diamond traceability deadline slipped from 1 March 2025 by ten months, and Botswana was added as a second verification hub alongside Antwerp.
That is a sharper illustration of the pattern than anything in the financial measures. Everyone agreed on the target. Only the EU built the verification regime.
Russian countermeasures become a compliance problem
This is also when Russian countermeasures stopped being defensive and became something screening and legal teams had to account for.
Presidential Decree 302 of April 2023 created a mechanism for placing assets of companies from “unfriendly states” under external management. It was used. Carlsberg and Danone are the well-known examples.
In parallel, Russian claimants began using Article 248 of the Arbitrazh Procedure Code to pull disputes into Russian courts in breach of arbitration agreements. The results included the seizure of roughly $155.8 million of JPMorgan funds on VTB’s application, and a freeze of around $1.15 billion of assets held by a UK subsidiary of Linde.
For EU companies still holding Russian assets, this is when exit became materially more expensive than staying.
Switzerland was still keeping close pace, completing its package 10 alignment on 29 March 2023, about a month behind.
Packages 14-17: shadow fleet and the third-country pivot
June 2024 to May 2025
Package 14 is the densest single package in the entire set of measures (Regulation 2024/1745). It banned LNG re-exports and new investment in Russian LNG projects. Use of the Central Bank’s SPFS financial messaging system, Russia’s domestic alternative to SWIFT, was outlawed. The same package created a port access and services ban aimed at vessels supporting the war, which is the first version of what became the shadow fleet regime. Least noticed at the time, it also built a litigation and expropriation shield, letting EU companies claim damages in member state courts from Russian parties that benefited from expropriation (Articles 11a and 11b).
Package 15 completed that last thought by making Russian court judgments obtained under Article 248 unrecognisable and unenforceable in the EU (Regulation 2024/3192).
Packages 16 and 17 were mostly additional sanctions designations, but with a telling shift. Of the 53 entities added to export restrictions in package 16, roughly two-thirds were located in third countries (Regulation 2025/395). Package 17 added chemical precursors and 189 more vessels, taking the listed total to 342 (Regulation 2025/932).
Why it mattered
This is where the EU stopped writing rules about Russia and started writing rules about everyone else who deals with Russia. The third-country listing shift matters operationally more than the vessel counts. A screening hit on a Kyrgyz, Emirati or Hong Kong trading company is now a routine outcome rather than an anomaly.
The shadow fleet data is the most useful evidence available on whether any of this works, and it points somewhere specific. Alignment beats aggression. Robin Brooks’ analysis of tanker departures found activity in vessels sanctioned jointly by the United States, EU and UK down about 90 percent year over year, against 86 percent for US-only designations. The gap is small, but the direction matches what practitioners see. A vessel designated in one jurisdiction shops for ports. A vessel designated in three runs out of them.
The litigation shield is worth flagging as a genuine novelty. Sanctions regimes normally regulate what their own persons may do. Articles 11a and 11b instead create a private right of recovery against Russian beneficiaries of expropriation, which is closer to a tort remedy than a restrictive measure. No other major regime has copied it.
Switzerland’s lag started lengthening here. Package 16 was adopted on 24 February 2025 and implemented on 14 May 2025.
Packages 18-21: the energy endgame and the crypto build-out
July 2025 to July 2026
Energy tightened on every remaining front.
Package 18 lowered the oil price cap and, more significantly, set it to adjust periodically under the terms of the relevant Council Decision rather than sitting at a fixed number (Regulation 2025/1494). It also banned imports of refined products made from Russian crude, regardless of where the refining took place.
Package 19 banned LNG imports outright (Regulation 2025/2033). It also prohibited transactions involving Mir and the Faster Payments System, known as SBP. Mir is Russia’s domestic card scheme, built after 2014 precisely so that being cut off from Visa and Mastercard would not stop domestic payments. SBP is the central bank’s instant payments system. Prohibiting them closes the retail payment channels that survived the SWIFT measures.
Package 20 banned the provision of services to Russian LNG terminals and imposed due diligence obligations on tanker sales (Regulation 2026/506). Package 21 extended the terminal services ban to third-country operators controlled by Russian companies (Regulation 2026/1848).
The second development is crypto becoming a separate target category in its own right, rather than an incidental restriction attached to other measures.
Package 5 capped the value of crypto assets Russian persons could hold. Package 8 banned providing crypto wallets to them outright. Package 20 went considerably further, prohibiting transactions with crypto-asset service providers and platforms established in Russia, and naming RUBx, a ruble-pegged stablecoin, as a specific target (Article 5bb). Package 21 added a prohibition on Russian citizens and residents owning, controlling or holding positions in EU crypto-asset service providers, effective 25 August 2026.
The price cap is the clearest case in the whole set of a restriction that kept being re-tuned after it was imposed. Package 18 set it to adjust on a periodic basis. Package 21 then suspended that adjustment for a full year, to July 2027, loosening a measure the EU had built specifically so that it would keep tightening without further decisions.
That is the kind of regulatory detail that disappears when a package is summarised by its number of sanctioned designations.
October 2025: same targets, three different rules
Three jurisdictions moved on Russia’s two largest oil companies inside nine days, using three different legal instruments.
Date
Jurisdiction
Action
Mechanism
15 Oct 2025
UK
Rosneft and Lukoil designated, with 88 other targets
Asset freeze. OFSI licensed certain German Rosneft subsidiaries through at least October 2027, in coordination with German authorities, so those refineries could keep operating.
22 Oct 2025
US
Rosneft, Lukoil and more than 30 subsidiaries designated
SDN listing under EO 14024, pulling in the 50 percent rule and exposing foreign financial institutions to secondary sanctions risk.
23 Oct 2025
EU
Package 19 adopted
Full transaction ban on Rosneft and Gazprom Neft under Article 5aa, applying the EU’s own ownership and control test.
Same companies, same week, three different legal hooks. A screening team covering all three regimes got three different answers about the same corporate family in the same month.
Does any of it work
The evidence is genuinely contested, and the research organizations disagree with each other.
The evidence that oil is still moving despite the designations is substantial. As of mid-June 2026, the United States, UK, EU, Australia, Canada and New Zealand had collectively designated 653 unique tankers. Analysis from earlier in the year found 111 of the 623 then-designated vessels still loading Russian cargo, and G7-plus sanctioned tankers carrying roughly 68 percent of Russian crude exports. KSE put Russian oil export revenues at $20.8 billion in April 2026, down slightly month over month but $8.2 billion above the prior year.
The evidence pointing the other way is thinner but real. Russian reliance on Western maritime services climbed back to around 42 percent by May 2026, and new shadow fleet entrants slowed to a trickle across 2026. Both suggest vessel designations have made the shadow route expensive enough to push cargo back under the price cap’s reach.
Both can be true. Designating vessels one at a time degrades the alternative faster than it stops the trade. CREA has argued the entity-based approach is too easily defeated by intermediaries and special purpose vehicles, and has pushed for a full maritime services ban instead. Package 20’s groundwork for exactly that suggests the argument landed.
Two other developments
In December 2025 the EU moved to freeze Russian central bank assets in Europe indefinitely rather than on a renewable basis. That is a change in the character of the measure, not just its duration, and it has drawn commentary about longer-term effects on how other states think about holding reserves in European institutions.
Switzerland’s lag became a live compliance problem. Package 19 was adopted on 23 October 2025. Swiss implementation was partly done on 12 December 2025 and only completed on 25 February 2026. Baker McKenzie noted plainly that the delay created legal uncertainty for firms operating across both jurisdictions, and that the pattern is likely to repeat.
All twenty-one, grouped
Twenty-one packages, and the pattern is hard to miss once it is laid out. Everything the EU uses today was invented in the first ten months. The four years since have been spent extending those measures to new counterparties, new routes and new intermediaries.
There is a useful corollary for anyone tracking alignment with other regimes. Gaps between the EU, United States and UK appear when someone invents a mechanism, not when someone extends one. The moment a new tool is created is the moment the other jurisdictions either copy it or decline to, and the diamond traceability regime is the clearest example. Packages that extend existing measures rarely change the alignment picture, because whatever alignment there was got settled when the measure was first built.
The practical implication is that a new package is not by itself news. The question is what kind of change it contains. If all that changed is more names on the list, your existing screening already absorbs it. If there is a new kind of restriction, meaning a contract term you have to insert, a class of counterparty you now have to test for, or a service you can no longer provide, that is the one where somebody has to read the annex.
Sourcing and self-check
Documented, traceable to primary or official sources. Every package’s contents, adoption date and amending regulation number come from the Council of the EU’s package timeline, the Official Journal, and the Council’s own press releases. The Council’s timeline page was last reviewed on 23 April 2026 and therefore stops at package 20. Package 21 content comes from the Council’s 23 July 2026 press release and from law firm and P&I club analyses published since. Central bank reserve figures and the January and February 2023 revenue decline percentages are the Council’s own published numbers. The 28 February 2022 rate move from 9.5 to 20 percent and the ruble’s move from roughly 80 to 120 per dollar are contemporaneous reporting. Swiss implementation dates are from SECO decrees as reported by Lenz & Staehelin and Baker McKenzie. The October 2025 Rosneft and Lukoil actions and their differing legal bases are from Covington, Sullivan & Cromwell, Arnold & Porter and McDermott alerts. Diamond trade figures are from IPIS and Reuters reporting.
Secondary analysis, flagged as such. The shadow fleet effectiveness figures of 90 percent against 86 percent are Robin Brooks’ calculation from his own vessel database. Vessel counts, revenue figures and the share of exports carried by sanctioned tankers come from KSE Institute, CREA and GSSC, which use different methodologies over different reporting periods and do not fully agree with each other. The claim that the price cap caused the shadow fleet is widely held but not formally established, and the Braw remark is an argument rather than a finding. CREA’s call for a full maritime services ban is advocacy, though package 20’s language suggests the EU is moving that way.
Editorial judgment, not anyone’s official framing. The six-category taxonomy and the decision about what counts as a distinct restriction type rather than an extension of an existing one are mine. Reasonable practitioners would draw some of these lines differently.
Known gaps. Belarus is treated here as a mirroring jurisdiction rather than as an actor in its own right, and the Belarus packages are not traced individually. The parallel EU regimes covering hybrid threats, human rights and riot control agents are outside scope except where they intersect, and the boundary between “the Russia package” and “the other measures adopted the same day” has been getting blurrier since package 17.
and now, a PDF which might be easier for you to digest:
