Nothing says you HAVE to check ofac on anything. It's a risk management decision. What are the chances that one of the payees of your bill paying customers will be an OFAC entity? Our process is automated, our vendor checks them all and that is spelled out in our contract with them. If you don't, you'll have to defend your decision to examiners and document the reasons in a risk assessment.