OFAC Third-Party Risk

Sanctions risk introduced by vendors, partners, and service providers who process transactions or data on your behalf.

TL;DR

TL;DR: Third party risk is sanctions exposure introduced by vendors and partners that handle your transactions, and it must be screened and managed like direct counterparty risk.

Where third party risk comes from

Third party risk comes from the vendors, partners, and service providers who process transactions or customer data on your behalf. A payment processor, a wallet provider, or an integration partner can each introduce exposure if they do not screen or if they are themselves sanctioned. Because you are responsible for your own flows, a third party's failure can become your violation. Due diligence on a third party should include its own screening controls, not just its name on a list.

Why it is easy to miss

Organizations often screen their direct customers but overlook the intermediaries in the payment path. That oversight is a compliance gap: under strict liability, intent is not required, and civil penalties start at $356,000 per violation. Facilitation risk extends the same concern, since enabling a sanctioned party through a third party channel is still exposure. A vendor that cannot show it screens is a vendor that can import the risk into your flow.

Managing third party risk for agents

For AI agents, third parties include the money rails and agent frameworks in the stack. x402, AP2, ACP, and Coinbase AgentKit move money but do not screen. sanctionsai.dev fills that gap with a screening call that returns ALLOW or BLOCK, and integrations with LangChain, CrewAI, Eliza, and the OpenAI Agents SDK put the check in the agent's own flow, independent of any third party's diligence.