OFAC Compliance Risk Assessment

A structured evaluation of sanctions risk across customers, geographies, products, and channels.

TL;DR

TL;DR: A compliance risk assessment scores exposure across customers, geographies, products, and channels, so resources go where the risk is.

The four dimensions

A standard assessment evaluates risk across four dimensions. Customers: who the organization transacts with. Geographies: where those parties and payments are located. Products: what goods or services move, since some carry higher sanctions sensitivity. Channels: how money moves, including which payment rails and intermediaries are used. Scoring each dimension builds a map of where exposure concentrates. The output is a risk register that ranks exposures, so remediation can be prioritized by severity rather than by what is easiest.

Why structure matters

An assessment turns intuition into an auditable record. It documents which risks were considered, how they were weighted, and what controls address them. Regulators and counterparties alike look for evidence of this process, and its absence is itself a finding when a violation occurs. A periodic refresh keeps the assessment current as products and channels change.

Assessment for agent payments

For agent flows, the channel dimension dominates: payments through rails that do not screen are a structural risk. sanctionsai.dev supports the assessment with tools that produce evidence. sanctions_check records each counterparty screen, and risk_score adds a per-party grade, so an agent's compliance posture is measurable rather than assumed. The 4-Gate protocol, SCREEN, SCORE, STOP, and STAMP, makes that assessment operational in every payment. The register then becomes the roadmap for where screening effort is most needed.