Regarding an OFAC Risk Assessment:

What is the actual RISK being assessed?

A) Based on factors such as customer, geography, product/services offered, and prior OFAC actions, what is the Risk that a person on the OFAC list would attempt to conduct a transaction and/or establish an account with the Bank?

OR

B) What is the Risk that you won’t detect that a person on the OFAC list is attempting to conduct a transaction and/or establish an account?

I have always felt that selection A was the answer – now I’m not sure.

If you were to go with selection B, you are indicating that your controls are being factored into your Risk rating. But if such is the case, then any Bank with a Risk of Moderate or High is basically disclosing that the controls are not adequate to sufficiently mitigate the Risk – if they were then the Risk would be LOW.

This would also mean that a Bank operating in an area compromised largely of non-US citizens and has established many account for Non-Resident aliens, could assert a LOW OFAC Risk Rating because the detection controls are so robust.

That just doesn’t feel right (as it relates to OFAC)

Instead I think the OFAC Risk should be based on the likelihood of contact with an SDN (selection A). Then, commensurate with the Risk Rating, the Bank establishes needed controls to detect such a relationship.

For example: If your Risk (chance of having a relationship with an SDSN) is HIGH, you should scan your name database every time the OFAC list is updated because of an elevated chance of a possible match; if LOW you scan your names every 3 months because of the low likelihood of having a match.

I’d love to hear what you consider to be the RISK as it relates to an OFAC Risk Assessment.

I have always viewed it as A (the inherent risk)and you create appropriate controls to manage that risk. The risk that you won't identify the person with your current controls is your residual risk.

To answer this question you have to be very clear about OFAC. That is to say, you have to understand some key factors.
1. Additions to the lists must be considered random. You do not control, cannot predict, and have no insight into the process by which something is listed. There is no schedule or calendar for additions to the list.
2. There are US entities on the list now, covering, if memory serves, 7 - 10 states.
3. Something of a repeat of point 1, but there is nothing to prevent OFAC from listing additional US entities.

So, if you accept customers or transactions from countries or states currently listed, then your OFAC risk might be said to be moderate or even high.

If you do not accept customers or transactions from outside the US, but do accept them from states currently listed, you might say that your OFAC risk is moderate to low.

If you do not accept customers or transactions from any currently listed country or state, then you might say that your OFAC risk is low. But you cannot say it is zero.


An additional thought: You need to really know what is on the OFAC lists before assessing your probabilities.