How to document OFAC compliance

Documentation is the single most underappreciated element of sanctions compliance. OFAC's Enforcement Guidelines explicitly consider the existence of a documented compliance program as a mitigating factor — and the absence of documentation as an aggravating one.

What to document

• Compliance policy: A written policy statement approved by senior management, reviewed annually.
• Risk assessment: A current document identifying your organization's sanctions risks and controls.
• Screening procedures: Step-by-step operational procedures for how screening is performed.
• Screening logs: Timestamped records of every screening event and its outcome.
• Training records: Dates, attendees, and content of sanctions compliance training.
• Incident records: Documentation of any sanctions matches, false positives, or violations and how they were resolved.