OFAC IRAQ2 sanctions program

IRAQ2 is one of the program codes OFAC attaches to entries on the Specially Designated Nationals list. As of 2026-07-24 it appears on 190 SDN entries. Designations under this program are made under Executive Order 13315 (Iraq).

What the IRAQ2 code means on an SDN entry

OFAC does not maintain one list per sanctions program. It maintains one SDN list, and tags each entry with the program or programs it was designated under. An entry can carry several: of the 190 entries tagged IRAQ2, 0 also carry at least one other program code.

The legal authorities OFAC records against these designations are:

• Executive Order 13315 (Iraq)

That matters for screening: if you filter an SDN extract to a single program code you will silently drop entries that were designated under a different code but are blocked all the same. Screen the whole list, then use the program code to explain a hit — not to decide which entries to load.

IRAQ2 designations by type

When IRAQ2 designations were made

The earliest entry still carrying this code was published 1991-04-03; the most recent was 2007-12-06. Designations per year, most recent first:

Countries recorded against IRAQ2 entries

Counted from the address, nationality and citizenship fields on each entry. An entry can record more than one country, and many record none, so these do not sum to the entry count:

Most recent IRAQ2 designations

Names are reproduced exactly as OFAC publishes them. OFAC also publishes alternate identities (a.k.a. spellings and transliterations) for many entries, and a screening system that matches only the primary name will miss them.

Screen this programmatically

The same data behind this page is available as a single unauthenticated GET. It checks a counterparty name against all SDN primary names and alternate identities, and returns a match list rather than a yes/no so you can log what matched and why:

curl "https://sanctionsai.dev/sanctions?name=AL-DURI,%20Thabet"

The free tier allows 5 checks per day with no signup, which is enough to wire the call up and see the response shape. Production limits and the audit log are on the paid tiers; the API reference covers batch screening and the degraded flag you should alert on.