It is perfectly permissible to tell someone that it appears they are on the OFAC list and for that reason you must reject their transaction (if it's subject to rejecting), or accept it and block the funds (if it's subject to the blocking sanctions).
In view of the fact that false positives are common, OFAC recommends that you check with them before you take any action in order to rule out the possibility it could be a false positive. Even then, remember to mention to your customer that if he believes this is a case of mistaken identity -- or believes that the specific transaction should be allowed under a license from OFAC -- he should contact OFAC directly.