About OFAC Sanctions

Why Should I Care About OFAC Sanctions?

The OFAC sanctions rules are “strict liability,” which means it does not matter whether you know about them or not. Violating these rules can lead to serious penalties, so it’s important to understand how they might affect your open source work. Many OFAC sanctions restrictions generally do not care if software or technology is public or published (although US export controls generally do) and are usually completely separate and independent of the Export Administration Regulations (EARs), which the LF has published guidance about in the past.

It is important to note that the OFAC SDN List for sanctions programs is very different from the BIS’s Entity List for Export Controls. Entities on the BIS’s Entity List are not affected by the OFAC sanctions unless they are also added by OFAC to the SDN List. When looking at export controls and trade sanctions, they are separate programs and each list needs to be evaluated as the implications of export and trade sanctions are very different.

What Are OFAC Sanctions?

OFAC sanctions are U.S. government regulations that restrict or prohibit transactions with certain countries, entities, and individuals (“sanctions targets”). These rules are normally put in place to achieve economic emergency, foreign policy and national security goals. They apply not just to financial transactions, but often to almost all interactions with a sanctions target, including those in the open source community spaces.

For developers, this means you need to be cautious about who you interact with and where your contributions come from. OFAC sanctions can target specific countries, regions, and individuals or organizations, with many of the individuals and organizations listed on the Specially Designated Nationals and Blocked Persons (“SDN”) List. OFAC updates this list regularly, adding or removing names as global situations change. OFAC sanctions also apply to all entities that are owned 50% or more directly or indirectly by one or more SDN individuals or entities, whether or not the owned entity shows up on the SDN List. Some entities, such as entities owned or controlled by OFAC-sanctioned governments, may also be sanctioned but not included on the SDN List. In addition, the few comprehensively sanctioned governments, regions, and countries also are not included on the SDN List.

Violating these sanctions can result in serious consequences, including large civil fines and criminal penalties. In general, if you’re a U.S. citizen or a U.S.-based organization, or if you deal with U.S.-origin goods, services, or U.S. Dollars for prohibited transactions, you’re likely required to follow these rules, no matter where in the world you are.

Other International Sanctions Programs

U.S. OFAC sanctions only reflect the U.S. sanctions programs. Many other countries also have similar sanctions programs in place, including the European Union, United Kingdom, Japan, Australia, Switzerland, China, and many more. This post specifically addresses U.S. sanctions, but keep in mind if you are located elsewhere in the world, your local country may have similar sanctions in place.