OFAC Compliance for Small Business: What Online Sellers Must Screen

On this page 8 sections

1. Size Doesn't Exempt You, and the Penalty Math Shows Why
2. Which Places to Block in 2026, and the Syria Mistake
3. Who to Screen for OFAC Compliance at a Small Business
4. What Your Processor's Screening Leaves to You
5. When a Name Comes Back as a Possible Match
6. Keep Screening Records for 10 Years
7. Export Controls Are a Separate Check on What You Ship
8. Audit Your Checkout Settings This Week

Key takeaways

• Syria came off the comprehensive embargo list on July 1, 2025. Assad-linked parties are still sanctioned, so review any blocklist you set up before mid-2025 instead of copying it forward.
• The civil penalty cap applies to each violation, so exposure grows with the number of orders. A low-priced digital product sold worldwide can carry the largest exposure in your catalog.
• A country dropdown can't block Crimea, Donetsk or Luhansk without also blocking all of Ukraine. You need region or postal-code rules.
• OFAC now requires records to be kept for 10 years. Check how long your e-commerce platform keeps order data before you rely on it.

OFAC compliance for small business sellers comes down to one rule. A U.S. company can't sell to, ship to or pay anyone on the Treasury Department's sanctions lists, or anyone in a place under a comprehensive U.S. embargo, unless OFAC has authorized it. In practice, you block a short list of locations at checkout, screen customer and payee names before you deliver or pay out, and keep a record of every check for 10 years. Your payment processor screens to protect itself. That screening doesn't cover your obligations.

This is general information, not legal advice. Sanctions programs change often and the details depend on your business. Confirm your obligations on OFAC's website and with an attorney who handles sanctions and export compliance.

Size Doesn't Exempt You, and the Penalty Math Shows Why

The Office of Foreign Assets Control (OFAC) administers U.S. economic sanctions. Its prohibitions apply to U.S. persons, and a U.S.-formed LLC selling candles on Shopify is a U.S. person just as a bank is. Under the comprehensive programs, U.S. persons cannot export goods, provide services, process payments or invest involving the sanctioned country unless OFAC has issued a license.

Two numbers set the stakes. The first is the penalty cap. Most sanctions programs rest on the International Emergency Economic Powers Act (IEEPA). OFAC's January 15, 2025 inflation adjustment set the maximum civil penalty under that law at the greater of $377,700 or twice the value of the transaction, per violation. The figure is adjusted for inflation each year, so check the current number. The second is the look-back window. The 21st Century Peace through Strength Act, signed April 24, 2024, extended the statute of limitations for IEEPA and Trading with the Enemy Act violations from five years to 10. Not knowing who bought from you won't make an old sale go away, so screen before you deliver.

Illustrative Example: 25 Small Orders, a Seven-Figure Ceiling

These numbers are illustrative. A store sells a $40 digital course. Over one year, 25 buyers whose IP address and card issuing country point to Iran buy it and receive it. Assume each sale counts as one violation (how violations are counted in a real case is a question for counsel), and use the January 2025 IEEPA maximum.

Twice the $40 sale is $80, well under $377,700, so the cap for each violation is $377,700. Across 25 sales the statutory maximum is $9,442,500, on $1,000 of revenue.

The headline number is not a forecast. OFAC sets actual penalties case by case under its Economic Sanctions Enforcement Guidelines. What matters is how the risk scales. The cap grows with the number of transactions, not their size, so a cheap product sold to anyone with a browser carries exposure far beyond its revenue. The first cost is often commercial. Banks and processors carry their own sanctions obligations, and sanctioned activity is one of the reasons processors shut down merchant accounts without warning.

Which Places to Block in 2026, and the Syria Mistake

OFAC's comprehensive programs restrict nearly all dealings with a place. Targeted programs name specific people, companies and sectors. Today the comprehensive tier covers Cuba, Iran, North Korea and the occupied Crimea, Donetsk and Luhansk regions of Ukraine. Those locations belong on your checkout block list.

Syria no longer belongs there, and many sellers haven't caught up. Executive Order 14312, signed June 30, 2025, removed U.S. sanctions on Syria effective July 1, 2025. OFAC then removed the Syrian Sanctions Regulations from the Code of Federal Regulations. Several "sanctioned countries" pages updated for 2026 still list Syria, and so does any blocklist copied before mid-2025.

The change has limits, though. Bashar al-Assad, his associates, Captagon traffickers and ISIS and al-Qa'ida affiliates remain sanctioned, so you still need to screen the names of Syrian customers. Export controls on goods are a separate Commerce Department matter, and when the order was signed, export controls stayed in place for now. Whether to sell to Syria again is now a business decision, and your processor's own policy is part of it.

The Ukraine regions cause the opposite problem. A country dropdown can't block Crimea without blocking all of Ukraine, so a country-level geoblock either misses these regions or turns away legitimate Ukrainian customers. Use region and postal code rules where your platform supports them, and check the IP's region as well as its country. Send unclear Ukrainian addresses to manual review.

Targeted programs cover a longer list, including Russia, Venezuela and Belarus. Ordinary customers in those countries aren't automatically off-limits. Russia's program is broad and changes often, though, so get counsel's view before selling there. B2B sellers face one more trap. A company that isn't named on any list can still be blocked if sanctioned persons own it, so ask your attorney how OFAC's ownership guidance applies to your larger accounts.

Who to Screen for OFAC Compliance at a Small Business

Screen everyone you receive money from or send money to. That covers buyers by name and address and business customers, including the owners of larger accounts. It also covers everyone you pay, such as marketplace sellers, affiliates and overseas freelancers. Sellers tend to forget payouts, but paying a sanctioned party is as serious as selling to one. Screen at signup or first order, again before you ship, grant access or pay out, and again whenever OFAC updates its lists, which happens frequently.

No single location signal settles it. Compare IP geolocation, billing and shipping postal codes, the card's issuing country (your gateway reads it from the BIN, the card number's first digits) and the phone country code. Mismatches are the warning sign. An order with a U.S. billing address, an Iranian IP and an Iranian-issued card goes on hold before anything ships.

Geoblocking is only the first layer, because VPNs hide a buyer's location and reshippers supply domestic addresses. Train staff never to suggest a workaround to a blocked customer, such as a VPN or a different address. If you help someone get around a sanctions block, an accident becomes a deliberate violation.

Most small sellers use screening software or a gateway plugin that does fuzzy name matching, which also catches misspellings and variant names. OFAC's free search on its website works for occasional manual checks. Ask your vendor to state in writing which lists it checks and how quickly it picks up changes. When you compare payment gateway providers, add blocking by IP region and card country to your requirements.

What Your Processor's Screening Leaves to You

Processors and acquiring banks vet you at underwriting and screen the card transactions they handle. None of that shifts your obligation to them. They don't see what you actually shipped, who uses a license after purchase, or payouts you send by wire or ACH. Fraud tools do a different job. 3-D Secure authentication confirms that the cardholder is who they claim to be, but it says nothing about sanctions. Our explainer on how 3-D Secure 2 cuts fraud chargebacks covers what it does well. Ask your processor four things:

• What sanctions screening do you run on my transactions, and what falls outside it?
• Can my gateway block by country, IP region and card issuing country?
• How will you tell me if you flag or block a payment?
• What documentation do you want for cross-border sales?

When a Name Comes Back as a Possible Match

Many hits on common names are false positives. Handle each one the same way:

1. Pause the order. Don't ship, grant access or pay out.
2. Compare the list entry's spelling, aliases, date of birth, nationality and address with the details you have.
3. Log what triggered the hit, what you compared and who reviewed it.
4. Clear a false positive with a written reason, such as "Different date of birth and country."
5. If the match looks real, call a sanctions attorney first, then your bank or processor.
6. Don't refund on your own. Returning money to a blocked party can be a violation in itself, and true matches carry reporting duties to OFAC, such as blocked property and reject reports. Keep replies to the customer brief until counsel weighs in.

Keep Screening Records for 10 Years

OFAC's final rule of March 21, 2025 extended its recordkeeping requirement from five years to 10, matching the new statute of limitations. The requirement covers all companies and persons engaging in transactions subject to OFAC's rules. The rule also extended to 10 years the period during which penalties for late reports can accrue.

For a small seller, the file is short:

• A one- or two-page policy saying who you screen and when.
• Screening logs showing the date, the data checked, the tool and list version, the result and the reviewer.
• A note explaining every cleared false positive.
• Records of each order you held or escalated.

If your platform deletes order data after a few years, export it first. If you find past sales to a sanctioned party or region, call a sanctions attorney before you do anything else. Counsel can advise you on a voluntary self-disclosure to OFAC while you close the gap that let the sale through.

Export Controls Are a Separate Check on What You Ship

Sanctions ask who and where. Export controls ask what. The Commerce Department's Bureau of Industry and Security (BIS) restricts where certain goods, software and technology can go, even when the buyer is on no sanctions list. If you sell electronics, technical components or software, including downloads, have an export compliance attorney review your catalog before you open international sales. Also ask your screening vendor whether it covers other agencies' restricted-party lists.

Audit Your Checkout Settings This Week

Export your store's blocked-country list and compare it with OFAC's current sanctions programs page. Add region-level rules for Crimea, Donetsk and Luhansk. Make a deliberate decision about Syria instead of inheriting an old plugin default. Confirm that payouts go through the same screening as sales. Then send the processor questions above to your provider in writing.

If you're reviewing your international payment processing setup or payments for an e-commerce business, you can request a free quote from MannyPay. A specialist responds within one business day. For costs, see our guide to receiving international payments without losing 5% to fees.

Sources

1. Federal Register: Inflation Adjustment of Civil Monetary Penalties (Jan. 15, 2025)
2. Federal Register: Reporting, Procedures and Penalties Regulations (Mar. 21, 2025)
3. OFAC: Syria Sanctions (Inactive and Archived)
4. OFAC Recent Actions: Publication of Final Rule to Remove the Syria Sanctions Regulations
5. Federal Register: Providing for the Revocation of Syria Sanctions (Executive Order 14312)
6. Executive Order Terminates U.S. Syria Sanctions, Export Controls Remain in Place for Now
7. Barnes & Thornburg: OFAC Final Rule Extends Recordkeeping Requirements to 10 Years
8. Young & Associates: OFAC Extends Record Retention Requirements
9. FedLaws: OFAC Countries: Comprehensive Sanctions, the 50% Rule, and Licenses
10. Sanction Scanner: Sectoral Sanctions vs. Comprehensive Sanctions

AR

About the author

Adrian Reyes

Adrian Reyes is Senior Payments & Fintech Editor for Beyond the Swipe, covering credit card processing, merchant accounts, payment technology and processing fees.

This article is for general educational purposes and is not legal, tax or financial advice. Card network rules and state laws change; confirm current requirements for your business.