OFAC Applies to Every Business, No Matter How Small

The BSA dealer rule has thresholds. Sanctions law does not. A one-person coin shop that never crosses the $50,000 dealer test is bound by the same OFAC prohibitions as a national refiner, and the penalty does not depend on whether anyone meant to break them.

Who must comply

OFAC's answer is short. "All U.S. persons must comply with OFAC sanctions, including all U.S. citizens and permanent residents regardless of where they are located, all individuals and entities within the United States, and all U.S. incorporated entities and their foreign branches." (OFAC FAQ 11.) There is no carve-out for small businesses, part-time sellers, or companies that only sell online.

Sanctions compliance is also separate from the Bank Secrecy Act. The dealer AML rule, 31 CFR Part 1027, does not mention OFAC at all. The sanctions duties come from the OFAC regulations in 31 CFR chapter V, and they apply whether or not your business is a dealer under the BSA. If you have worked through the dealer test and concluded you are not covered, that conclusion removes the AML program requirement. It does not touch your sanctions obligations.

It helps to sort the obligations the same way we sort BSA rules:

Required of every U.S. business: do not deal with blocked persons or prohibited jurisdictions; block or reject when the rules call for it; report blocked property and rejected transactions; keep the records.
Not required by any regulation, but weighed by OFAC: a written sanctions compliance program. No rule makes a dealer adopt one. OFAC considers whether you had one, and how good it was, when it decides what a violation costs.
Tools written for other institutions: the risk matrix annexed to OFAC's Enforcement Guidelines says it "can be used by financial institutions to evaluate their compliance programs," and it assumes a board, a designated OFAC officer, and bank-style supervision. A dealer can borrow from it. It is not a dealer requirement.

No dollar floor

The prohibitions have no general minimum amount. In an August 11, 2020 enforcement release, OFAC settled with an individual, a civilian employee of the U.S. Army stationed at the U.S. embassy in Bogota, who over about a year bought jewelry, meals, clothing, hotel rooms, and other gifts for a person then designated as a narcotics trafficker. The total value of the transactions was about $3,349, across at least 24 transactions. OFAC treated the case as egregious, set the base penalty at the statutory maximum of $36,264,793, and settled for $5,000 after weighing the General Factors in its Enforcement Guidelines (OFAC release, Aug. 11, 2020).

That person knew who they were dealing with, so the case is not about inadvertence. Its point is narrower: a few thousand dollars of ordinary retail purchases was enough for a violation, and the starting figure was measured in tens of millions.

Liability without intent

OFAC has said that it "may impose civil penalties for sanctions violations generally based on a strict liability legal standard. This means that, in many cases, a U.S. person may be held civilly liable for sanctions violations even without having knowledge or reason to know it was engaging in such a violation." That statement appears in OFAC's Sanctions Compliance Guidance for the Virtual Currency Industry (October 2021). The guide was written for one industry, but the statement is phrased as a description of OFAC's civil enforcement generally.

OFAC's Economic Sanctions Enforcement Guidelines (31 CFR part 501, appendix A) do not use the phrase "strict liability." What they do is list the factors OFAC weighs when it sets a penalty. General Factor E is "the existence, nature and adequacy of a Subject Person's risk-based OFAC compliance program at the time of the apparent violation." In practice, that is where a small business's preparation shows up: not as a defense to the violation, but in what the violation costs.

What the cases show

Cartier: an exact match that went unnoticed

In September 2017, Richemont North America, Inc., doing business as Cartier, agreed to pay $334,800 to settle four apparent violations of the Kingpin Act sanctions. On four occasions, a buyer at a Cartier boutique in California or Nevada gave a Hong Kong company as the ship-to party. That company was on the SDN List, and the name, address, and country Cartier received matched the list entry. Cartier did not identify a sanctions issue before shipping. The base penalty was $620,000. Among the aggravating factors, OFAC said Richemont was "a commercially sophisticated entity with global operations operating in an industry at high risk for money laundering" (OFAC release, Sept. 26, 2017). OFAC closed with a point that fits many jewelers: the case "highlights the risks for companies with retail operations that engage in international transactions," including shipping directly to customers outside the United States.

Chisu International: a small company with no program

In April 2022, Chisu International Corporation, a Florida company, agreed to pay $45,908 over purchases of Cuban-origin explosives for a U.S. company's mining project in Suriname. OFAC described Chisu as "a small company largely overseen by a single individual" that "had no compliance program in place" and did not understand the Cuba prohibitions until its customer raised the issue (OFAC release, Apr. 21, 2022). The mine was a gold project, as OFAC's companion release on the U.S. company shows (OFAC release, Apr. 21, 2022).

Two lessons carry over to metals and gems. First, small size reduced the penalty; OFAC listed it as a mitigating factor. It did not prevent the violation. Second, no name on any list was involved. The problem was the country of origin, which was printed on the bills of lading. A name screen alone would not have caught it.

SkyGeek Logistics: the customer you already approved

In December 2024, SkyGeek Logistics, Inc. agreed to pay $22,172 over attempted refunds and shipments to two companies after OFAC designated them (OFAC release, Dec. 31, 2024). One customer placed and paid for orders on the day of its designation, and SkyGeek's screening software did not yet reflect that day's designation. Weeks later, SkyGeek sent the customer a refund without screening again, because its protocol at the time was "not to re-screen previously approved parties." A bank downstream blocked the payment. OFAC listed as an aggravating factor that SkyGeek "had reason to know" the payments and shipments were going to blocked persons.

For a dealer, the parallel is the customer who was clean at account opening and is designated later, or the supplier you have bought from for years. Screening once is not enough.

What penalties can reach

For most sanctions programs, which rest on the International Emergency Economic Powers Act (IEEPA), the civil maximum is the greater of $377,700 per violation or twice the amount of the underlying transaction. Kingpin Act violations carry up to $1,876,699, and Trading with the Enemy Act violations, which include the Cuba program, up to $111,308. Those amounts took effect January 15, 2025 (90 FR 3687). As of October 2026, they remain current: federal agencies made no inflation increase for 2026 under OMB guidance, and OFAC's September 2026 rule consolidating its penalty provisions restates the $377,700 figure (91 FR 60821). Willful violations of IEEPA are crimes, punishable by fines up to $1,000,000 and, for individuals, up to 20 years in prison.

What industry standards expect

Industry standards point the same way, for the businesses that sign up to them. These codes bind their members or certified companies; they are not law for every dealer.

Responsible Jewellery Council. The 2024 Code of Practices (approved by the RJC Board on November 19, 2024) requires members' supply chain due diligence to use best endeavours to confirm that suppliers "are not otherwise subject to sanctions" (COP 7.1(b)), and requires members' know-your-counterparty procedures to verify that counterparties and, where applicable, their beneficial owners "are not named on relevant government lists" (COP 12.1(b)).
LBMA. The Responsible Gold Guidance, Version 9 (November 2021), which applies to LBMA Good Delivery refiners, requires "verification that sourcing from the Country of Origin is not in breach of any international sanctions," names US, UK, EU, and UN sanctions lists as required sources for location risk (Step 2.1), and makes gold known to be sourced in breach of international sanctions a zero-tolerance issue (Step 2.2). LBMA is consulting on a Version 10.

If you sell to a refiner or a larger wholesaler, expect these standards to show up in their supplier questionnaires, whether or not you are a member yourself.

What a small dealer's program needs

OFAC's Framework for OFAC Compliance Commitments (May 2, 2019) says each program will vary with "the company's size and sophistication, products and services, customers and counterparties, and geographic locations," but should rest on five components: management commitment, risk assessment, internal controls, testing and auditing, and training. For a small dealer, the controls that matter most are these:

Screen customers and suppliers. Screen everyone you sell to and everyone you buy from, including ship-to names and addresses. Chisu is a reminder to look at country of origin on trade documents too, not just names.
Re-screen when the lists change. OFAC's Framework says a program "should be capable of adjusting rapidly" to updates to the SDN List and other lists. Re-screen your existing customers and suppliers against updates, and screen again before you send a payment or a refund.
Check ownership, not just names. Under OFAC's 50 Percent Rule, an entity owned 50 percent or more in the aggregate, directly or indirectly, by one or more blocked persons is itself blocked, even if it appears on no list (OFAC FAQ 401). The rule turns on ownership, not control, but OFAC urges caution with entities that blocked persons control or partly own (OFAC FAQ 398).
Block or reject, then report within 10 business days. Blocked property gets an initial report within 10 business days and an annual report of property held as of June 30, due September 30 (31 CFR 501.603). A rejected transaction gets a report within 10 business days (31 CFR 501.604). Our post on clearing OFAC alerts covers how to decide whether a hit is a match.
Keep records for 10 years. Since March 2025, 31 CFR 501.601 requires records of transactions subject to OFAC rules to be available for at least 10 years, and records of blocked property for as long as it is blocked and 10 years after it is unblocked.
Know where to ask. OFAC's compliance hotline is now a web form. OFAC retired the hotline's email address in August 2024 and its telephone lines on December 31, 2024 (OFAC announcement, Aug. 2, 2024).

Add a written statement of who is responsible (often the owner, in a small shop), a short annual training session for anyone who takes orders or ships metal, and a periodic check that screening actually ran. That covers the five components at a scale a small business can sustain.

Sized to the business, not skipped

Consider a jeweler with two employees that buys scrap from the public, sells some pieces online, and ships a few orders abroad each year. It may fall well under the BSA dealer test. It still cannot sell to a blocked person, ship to one, or refund one, and if it does, OFAC will ask what the jeweler had in place. A one-page procedure, a screening log, and a records folder are a better answer than none.

For how we structure screening and alert disposition for dealers, see OFAC programs for dealers. Short answers to common sanctions questions are on our FAQ.