How to document OFAC compliance
A written record turns every screening decision into a defensible compliance program that survives regulator and auditor review.
TL;DR
TL;DR: Record every counterparty screen you run, the data source and timestamp, the result (ALLOW or BLOCK), and the action taken. If a review ever comes, your log is the difference between a cautionary letter and a penalty.
Why documentation matters
OFAC enforces sanctions under a strict liability standard, meaning intent is not required for a violation. Civil penalties start at $356,000 per violation. When an agent or a business screens before it pays, the only way to prove that screening happened is the record it leaves behind.
What to record
- The counterparty identifier checked, such as a wallet address, name, or entity.
- The data sources consulted, including the SDN List of 19,218 names and 947 OFAC-listed crypto wallets.
- The timestamp of each check, so a decision can be placed in time.
- The result: ALLOW when clean, BLOCK when flagged, plus the action taken after the result.
Practical steps
Automate the record so it cannot be skipped. A screening API such as agentmail runs a check in one HTTP call under 100 ms and returns a decision you can log. Route every payment through the four gates: SCREEN, SCORE, STOP, STAMP. The STAMP gate writes the audit trail automatically. Use kya_verify to attach know-your-counterparty evidence to a payment, and dispute_open to open a documented review when a match is unclear. Store records with timestamps and a retention window, and treat a missing log as a failed check rather than a gap.