OFAC compliance for payment startups

What a payment startup should put in place on day one to stay clear of OFAC sanctions exposure.

TL;DR

TL;DR: A payment startup should screen every counterparty against the SDN List before money moves, from the first transaction. OFAC is strict liability, so intent is not a defense, and penalties start at $356,000 per violation.

Start before the first dollar flows

For a payment startup, the moment funds flow is the moment OFAC exposure begins. The Office of Foreign Assets Control administers the SDN List (Specially Designated Nationals and Blocked Persons List), and a startup that routes a payment to a blocked party is liable even with no knowledge or intent. Building the check in early is far cheaper than retrofitting it after volume grows.

The minimum viable control

The core control is a screening call at payment time: compare the counterparty and its address against a current list, and stop the payment if it matches. The 50 Percent Rule means entities 50 percent or more owned by a blocked person are also blocked, so ownership reach-through belongs in the check for business counterparties.

Starting free, scaling when volume does

agentmail, the screening API at sanctionsai.dev, is designed for this: one HTTP call under 100 ms returns clean (ALLOW) or flagged (BLOCK), checking 947 OFAC-listed crypto wallets and 19,218 SDN names across 16 jurisdictions, synced hourly. A free tier of 5 checks per day requires no signup or key, and paid tiers reach 100,000 checks per month, so a startup can begin immediately and scale the plan with volume.