OFAC Risk Assessment Checklist [2026]

This checklist walks through the four risk dimensions OFAC expects in a sanctions risk assessment. Complete each section and assign a risk rating (Low, Medium, High) for your organization.

Section 1: Customer Risk

• Do customers include entities in high-risk jurisdictions?
• Are any customers politically exposed persons (PEPs)?
• Do customers operate in sanctioned sectors (defense, energy, financial services)?
• Do you verify ultimate beneficial ownership for corporate customers?

Section 2: Geographic Risk

• Do you serve customers in comprehensively sanctioned countries?
• Do you process transactions involving high-risk jurisdictions?
• Do your payment rails route through US correspondent banks?
• Do your agents or services operate in countries with active sanctions programs?

Section 3: Product Risk

• Do your products enable cross-border payments or transfers?
• Do your products involve cryptocurrency or digital assets?
• Can users transact pseudonymously or anonymously?
• Do your products enable P2P or marketplace transactions?

Section 4: Channel Risk

• Can transactions be initiated programmatically or by AI agents?
• Are API-based payments screened at the same rate as manual payments?
• Do third-party integrations or partners introduce additional counterparties?