Regarding an OFAC Risk Assessment:
What is the actual RISK being assessed?
A) what is the Riskprobability that a person on the OFAC list listed entity would attempt to conduct a transaction and/or establish an account with the Bank?
To answer this question you have to be very clear about OFAC. That is to say, you have to understand some key factors.
1. Additions to the lists must be considered random. You do not control, cannot predict, and have no insight into the process by which something is listed. There is no schedule or calendar for additions to the list.
2. There are US entities on the list now, covering, if memory serves, 7 - 10 states.
3. Something of a repeat of point 1, but there is nothing to prevent OFAC from listing additional US entities.
So, if you accept customers or transactions from countries or states currently listed, then your OFAC risk might be said to be moderate or even high.
If you do not accept customers or transactions from outside the US, but do accept them from states currently listed, you might say that your OFAC risk is moderate to low.
If you do not accept customers or transactions from any currently listed country or state, then you might say that your OFAC risk is low. But you cannot say it is zero.
An additional thought: You need to really know what is on the OFAC lists before assessing your probabilities.