Autonomous agent triggers OFAC compliance audit

What happens when an agent's autonomous payment activity draws an OFAC audit, the risk, and the control.

TL;DR

TL;DR: An audit examines whether every payment was screened and documented before funds moved. Without records, the operator faces strict-liability exposure; with STAMP and logged decisions, the audit becomes manageable.

What happens

An autonomous agent runs payment flows without human review, and the volume or the counterparties draw regulatory attention. The audit then reconstructs what the agent did: which counterparties it paid, which lists it checked, and whether any flagged match was honored. Regulators review the trail the agent left, not the agent's intentions, and the operator must answer for what that trail shows.

The risk

OFAC enforces under strict liability, so the operator cannot argue the agent had no intent. Civil penalties start at $356,000 per violation, and the 50 Percent Rule extends exposure to entities 50% or more owned by a blocked person. An agent that paid without screening leaves no defense, only the payments, and the operator answers for all of it. Volume is not a defense; each unscreened payment stands on its own.

The control

Make every decision auditable. agentmail screens each counterparty in one call under 100 ms and logs the result, returning ALLOW for clean and BLOCK for flagged matches. The SCREEN, SCORE, STOP, STAMP protocol writes a record at the STAMP gate, and dispute_open opens a documented review when a match is unclear. That log, not silence, is what a compliance audit actually checks.