Guide · sent by email
What an OFAC sanctions compliance program requires.
For any business exposed to US sanctions, wherever it operates from.
What is in it
The five components, in OFAC’s own words.
OFAC does not mandate a particular program design, but it has published what it expects one to contain. Each program "should be predicated on and incorporate at least five essential components of compliance: (1) management commitment; (2) risk assessment; (3) internal controls; (4) testing and auditing; and (5) training" [OFAC Framework for Compliance Commitments].
- The five components OFAC itself says a program should be built on
- What senior management commitment means in practice, beyond a signature
- Why the risk assessment drives everything else, and what it has to weigh
- Where programs are usually thin, and what that costs when something goes wrong
- The reporting duties that apply whether or not anything went wrong
Roughly 728 words. Every regulatory statement carries the section it rests on, so you can read the provision rather than take our word for it:
Get the guide
Where should we send it?
It arrives as one email. Asking for the guide on its own does not add you to any list. What we do with this.
Not legal advice. Northward is a compliance practice, not a law firm. The guide sets out what the published rules say and how they are applied in practice at different risk appetites. What that means for your business is a conversation. Disclaimer.
Rather just ask?
If the question is specific to your business, a conversation gets further than a guide.