OFAC designations-including designating non-US persons-are authorized through Executive Orders (EOs) issued by the President under statutory authority such as IEEPA or the Trading With the Enemy Act. Executive Orders define which categories of persons or entities may be designated and direct OFAC to act.
Sectoral Sanctions Identifications relate to sectoral sanctions, not full SDN designation. FATF recommendations are global AML standards, not OFAC authorities. UN resolutions may influence US sanctions but are not the legal authority directing SDN listings.
Reference:
Executive Orders as legal authority for OFAC SDN designations.
Relationship between US statutory authority and OFAC implementation.

Internal controls are a core pillar of OFAC's Compliance Framework. They ensure that the organization implements compliance activities on time, maintains documented procedures and processes, and reduces the risks identified in its OFAC risk assessment. The framework specifies that controls must be documented, tested, and capable of identifying, escalating, and addressing sanctions-related issues.
Reference:
OFAC Compliance Framework internal control requirements.
Internal controls as mechanisms to operationalize timely compliance and risk mitigation.

Sanctions and Compliance Domains outline several misunderstandings commonly held by businesses. One misconception is that any USD transaction automatically triggers US sanctions applicability; while USD transactions may be routed through the US financial system, sanctions analysis depends on transaction content, parties involved, and jurisdictional reach, not solely the currency.
Another misconception is assuming no sanctions risk exists if a party is not listed by name. Sanctions regimes include indirect application through ownership and control rules, sectoral sanctions, activity-based sanctions, and geographic sanctions. Entities may be sanctioned due to association, ownership, or activity even if not individually named.
Statements regarding import/export exposure and MandA due diligence are correct program requirements. US sanctions can still apply to US citizens regardless of where they reside or work.
Reference from Sanctions and Compliance Domains:
Misconceptions regarding currency and sanctions applicability.
Misunderstandings about named-party sanctions versus ownership/activity-based risks.
Clarification on US person obligations regardless of residence.

A key sanctions-evasion red flag in trade documents is reluctance or refusal to disclose end-use or end-user information. This may indicate diversion to a sanctioned jurisdiction, entity, or prohibited program (e.g., proliferation).
Expiration dates (D) are irrelevant to sanctions. Payment timing and product suitability (A, B) are normal commercial behaviors and not sanctions red flags.
Reference:
Trade-based sanctions-evasion indicators (concealed end-user/end-use).
Red flags involving incomplete or intentionally vague documentation.

Sanctions and Compliance Domains state that when a potential sanctions match occurs, the first step is to conduct a proper investigation to determine whether the alert is a true match or false positive. This includes obtaining additional identifiers such as addresses, IMO numbers, registration numbers, or corporate details.
Immediate rejection or reporting is only appropriate after confirming a true match. Premature rejection without verification violates due diligence expectations. Closing the customer account is not justified without confirmed sanctions involvement.
Reference:
Investigation procedures for potential sanctions matches.
Requirements to gather additional identifiers before determining match status.