Sanctions are a foreign policy and national security tool used to restrict trade, finance, and access to resources to influence a state, an entity, or an individual. For companies and financial institutions, compliance is not simply about ticking boxes; it is a core element of good governance and risk management. Breaches can result in massive fines, serious reputational harm, and, in some cases, a complete loss of market access. With enforcement agencies increasingly working in a co-operative way, compliance professionals have to be very much aware of both the local regulators and the international bodies (U.S. Department of the Treasury, 2019) such as the U.S. Office of Foreign Assets Control (OFAC), the UK's Office of Financial Sanctions Implementation (OFSI), the EU, Canada's Special Economic Measures Act (SEMA) and Australia's Department of Foreign Affairs and Trade (DFAT).
U.S. Authorities: OFAC, FinCEN, and BIS
The US has one of the most comprehensive sanction regimes in the world. The Office of Foreign Assets Control (OFAC) within the U.S. Department of the Treasury is responsible for the creation and administration of the various sanction programmes. OFAC operates on a strict liability basis, so it can impose penalties even without any intent to breach the rules. This is why compliance matters for any institution that deals in U.S. dollars or uses the U.S. financial system in any way. OFAC administers the Specially Designated Nationals (SDN) List, the world's most widely used watchlist, and imposes major financial penalties for breaches.
FinCEN also plays a role, primarily in anti-money laundering and reporting financial crime. It's more of a reporting body than a sanctions body per se, but its rules around the filing of Suspicious Activity Reports (SARs) will often be relevant to sanctions issues. The Bureau of Industry and Security (BIS) rounds out the U.S. sanctions regime by enforcing export controls on dual-use items and technologies. BIS operates the Entity List, which often overlaps with OFAC restrictions, particularly in the defence and high-tech areas (Bureau of Industry and Security, n.d.).
The United Nations Sanctions Committees
The UN Security Council uses sanctions to help maintain international peace and security. Most UN sanctions consist of arms embargoes, asset freezes and travel bans. The UN sets the parameters of the sanctions, but individual member states implement and interpret them under their own domestic laws. As a result, UN sanctions may vary considerably from country to country. Compliance professionals should be aware of UN sanctions, as many jurisdictions will use them as a foundation and then add their own on top.
European Union Framework
The EU imposes sanctions via its Common Foreign and Security Policy (CFSP). The sanctions are designed to balance political and economic objectives, in accordance with the principle of proportionality. Enforcement is devolved, so each member state must apply and enforce the sanctions. The EU maintains a common list of sanctioned individuals and entities, which is updated regularly. To comply, organisations in Europe must be aware of both EU decisions and how each member state enforces the sanctions (European Commission, n.d.).
United Kingdom: OFSI
The UK imposes its sanctions regime through the Office of Financial Sanctions Implementation (OFSI), a unit of HM Treasury. Post-Brexit, the UK has been building up its own sanctions regime under the Sanctions and Anti-Money Laundering Act 2018. OFSI updates the UK Sanctions List, issues licences, and levies fines. In recent years, OFSI has been very active, which clearly signals the UK's intent to maintain a strong and independent sanctions regime (HM Treasury, n.d.). Sanctions in Canada require institutions to freeze the funds and report on any holdings of the target individuals or entities. For the compliance officer, the SEMA regime adds another layer of complexity, as Canadian law does not always align with other jurisdictions, making cross-border operations particularly fraught (Government of Canada, n.d.).
Australia's DFAT Sanctions
In Australia, the Department of Foreign Affairs and Trade (DFAT) oversees sanctions. The primary legislation is the Autonomous Sanctions Act 2011, along with UN Security Council sanctions. Sanctions generally focus on counter-terrorism, arms trade, and human rights abuses. DFAT maintains a Unified List of individuals and groups who are sanctioned, and Australian persons and organisations will need to check that list and obtain a licence where appropriate. Like any regulator, DFAT focuses heavily on compliance and reporting, so organisations should be proactive (Government of Australia, n.d.).
Sanctions authorities have enforcement and regulatory powers under special legislation. OFAC operates under the Trading with the Enemy Act and the International Emergency Economic Powers Act (IEEPA); OFSI under the UK Sanctions and Anti-Money Laundering Act 2018. The EU uses Council Regulations; Canada and Australia use SEMA and the Autonomous Sanctions Act, respectively. Licensing is of course a different proposition in each jurisdiction. OFAC has general licences for certain activities and specific licences which require approval. OFSI has licences for legal and humanitarian services, and the EU allows the individual member states to issue the licences. Canada and Australia use ministerial permits. Enforcement differs greatly: OFAC has very broad reach and can levy very large fines; OFSI has become considerably more effective since Brexit; and the EU leaves enforcement to individual member states. Canada and Australia are more selective. All systems are moving toward greater coordination and information sharing.
Operational Consequences for Compliance
For compliance teams, sanctions can be a regulatory burden and an operational headache.
Effective compliance programmes rely on strong risk assessment, reliable screening, and good reporting. You have to keep up with both local and international sanctions lists (OFAC, OFSI, the EU, etc.). Training and record-keeping are fundamental, particularly in high-risk areas such as banking, shipping, and technology. Best practice is to make compliance part of the organisation's culture, with management backing, periodic audits, and ongoing training (U.S. Department of the Treasury, 2019).
Cross-Border Enforcement Cases
Several well-known cases show how sanctioning authorities operate internationally. In 2014, BNP Paribas agreed to pay nearly $9 bn in fines to U.S. regulators for processing U.S. dollar transactions for Sudan, Iran, and Cuba. That case demonstrated OFAC's reach worldwide and the risks for non-U.S. banks in the U.S. dollar. In 2019, Standard Chartered settled with both U.S. and U.K. authorities for over $1 bn, a clear example of the trend toward joint enforcement. In 2022, Clearstream Banking was fined for holding Iranian securities, which also applies to post-trade service providers.
Sanctions compliance remains in flux as the geopolitical situation changes and new regulations are introduced. AML and sanctions are increasingly being treated as the same, with regulators driving towards a single compliance regime. New tech is being deployed to support sanctions screening (AI in particular is helping reduce false positives and improve accuracy). Human rights sanctions (Magnitsky-type sanctions against corruption and abuse) are now being applied in more and more jurisdictions. International regulator cooperation has also increased significantly, leading to a much more coordinated enforcement regime. The upshot is that sanctions authorities are taking on more responsibility and enforcing more than ever. Compliance is now a real issue for businesses and financial institutions.
The authorities (OFAC, OFSI, EU, UN, SEMA, DFAT, etc.) all have robust sanctions and licensing regimes in place. Compliance professionals must manage overlapping regimes, build a strong compliance culture, and use technology-enabled solutions. Because enforcement is global, active compliance is necessary, as non-compliance is a global risk.