Key Takeaways:

  • Key Takeaway #1: The U.S. Department of Treasury’s Office of Foreign Assets Control (“OFAC”) published a final rule (the “Rule”), effective September 25, 2026, creating the “Sanctions Penalties Regulations” under 31 CFR Part 505: the agency’s first-ever single, unified codification of civil and criminal penalty rules applicable across multiple sanctions programs.
  • Key Takeaway #2: While OFAC describes the rule as reproducing existing requirements without substantive change, a close reading reveals a few new developments that matter in practice. Among the changes that compliance professionals should be alert to:
    • A binding disclosure requirement for enforcement resolutions;
    • An explicit statement of the mens rea for criminal violations of IEEPA, required by Executive Order 14294;
    • A change in submission routing for enforcement responses, and an important carve-out for narcotics-related proceedings.

What Happened?

Until now, rules and guidance relating to civil and criminal penalties for violations of the International Emergency Economic Powers Act (“IEEPA”) and the United Nations Participation Act (“UNPA”) have been spread across more than 40 different sanctions program regulations, OFAC’s Enforcement Guidelines at Appendix A to 31 C.F.R. Part 501, and the text of the statutes themselves. In its new Sanctions Penalties Regulations, OFAC is now consolidating penalty provisions and authorities that were previously scattered across individual program-specific rules, and codifying certain existing OFAC practices in the Rule.

Following publication of Part 505, OFAC will update individual parts within 31 CFR Chapter V to replace existing penalty provisions with cross-references to the new Sanctions Penalties Regulations. The stated goal is to standardize penalty provisions across programs and to simplify annual inflation adjustments required under the Federal Civil Penalties Inflation Adjustment Act of 1990 (“FCPIA”), as amended by the FCPIA Improvements Act of 2015 (Pub. L. 114-74).

What Does Part 505 Cover Now—and What Does It Not?

Part 505 addresses civil and criminal penalties for violations of sanctions issued pursuant to IEEPA (50 U.S.C. 1701 et seq.) and the UNPA (22 U.S.C. 287c(b)). Penalties for violations of the Trading with the Enemy Act (31 CFR §§ 501.700–501.747) (“TWEA”), the Antiterrorism and Effective Death Penalty Act (31 CFR §§ 597.701–597.705), the Foreign Narcotics Kingpin Designation Act (31 CFR §§ 598.701–598.706), and the Clean Diamond Trade Act (Appendix A to 31 CFR Part 501) remain in their respective program-specific parts and are not consolidated into Part 505. Compliance teams dealing with narcotics trafficking, terrorism-related, or TWEA-covered transactions must still consult those individual regulations.

What are the Key Provisions?

Civil Monetary Penalties (CMPs) Under IEEPA

The maximum civil monetary penalty remains the greater of $377,700 or twice the amount of the transaction that is the basis of the violation.  This amount is subject to periodic adjustment under the FCPIA.

Criminal Penalties Under IEEPA

The rules reprise the IEEPA statutory provision that a person who willfully commits, willfully attempts to commit, willfully conspires to commit, or aids or abets a violation may, upon conviction, be fined up to $1,000,000, or, if a natural person, imprisoned for up to 20 years, or both. Criminal penalty amounts are also subject to adjustment under 18 U.S.C. § 3571.

UNPA Criminal Penalties

Section 505.501 provides that any person who willfully violates or evades any order or regulation issued under the UNPA shall, upon conviction, be fined up to $1,000,000 or, if a natural person, imprisoned up to 20 years, or both.

VSD Penalty Reduction

Base civil penalties are halved in cases where OFAC learns of the violation through a voluntary self-disclosure. This codifies OFAC’s existing guidance in its Enforcement Guidelines at Appendix A to 31 CFR Part 501.

What Is Genuinely New That Merits Attention?

1. A Binding, Codified Disclosure Framework (31 CFR § 505.102)

Section 505.102 requires OFAC to make certain information publicly available—on a routine basis and not less frequently than monthly—about any civil penalty proceeding that results in a CMP or settlement agreement.  This converts a longstanding website-posting practice into a binding regulatory commitment with defined content requirements.

It provides for different information to be published regarding CMPs or settlements with entities versus those with individuals. For entities, this includes:

  • The name and location of the entity involved;
  • The sanctions program(s) involved;
  • A brief description of the violation or apparent violation;
  • A clear indication whether the proceeding resulted in a settlement agreement or the imposition of penalties;
  • An indication whether the entity voluntarily disclosed the violation or apparent violation to OFAC; and
  • The amount of the penalty imposed or the amount of the agreed settlement.

The requirement for proceedings against individuals is similar, but OFAC will publish only aggregate statistics—the number of penalties and settlements for that month, the programs involved, a description of the violations, whether they resulted in settlements or penalties, and the dollar amounts—without identifying any individual by name. Section 505.102(c)(1) provides that OFAC generally will not release the name of any individual violator or alleged violator.  However, the rule also allows OFAC to decide, on a case-by-case basis, to release additional information about any CMP or settlement, which appears to apply for both entity and individual resolutions.

Section 505.102(c)(2) carves out all records and information obtained or created in the implementation of 31 CFR Part 598 (Foreign Narcotics Kingpin Designation Act) from the public disclosure framework. 

The reputational stakes of this framework are high. For entities—particularly financial institutions and multinational corporations—a settlement or CMP will now trigger mandatory publication of name, program, violation description, and dollar amount on OFAC’s website on a monthly disclosure schedule. This includes whether the alleged violations were disclosed voluntarily to OFAC.

2. What about Findings of Violation?

The new rule does not address whether OFAC must publish Findings of Violation, which OFAC historically has published.  It is unclear whether this is meant to signal that OFAC may choose to publish some Findings of Violation but not others. The new rule also provides that, in cases where OFAC ultimately determines that a Finding of Violation is not warranted (e.g., after an appeal by the alleged violator), this fact does not preclude OFAC from taking other enforcement action consistent with its Enforcement Guidelines.

3. Explicit Mens Rea Statement Required by E.O. 14294

Section 5 of Executive Order 14294 of May 9, 2025 (“Fighting Overcriminalization in Federal Regulations”), directed all final rules with criminal consequences to explicitly state a mens rea requirement for each element of a criminal regulatory offense, with citations to the relevant statutory authority, in consultation with the Department of Justice. This requirement applies to all rules published after May 9, 2025—including Part 505.

Accordingly, Part 505 provides, in accordance with IEEPA at 50 U.S.C. § 1705, for criminal liability for willful violations of IEEPA.

This is significant for two reasons. First, it is the first time OFAC has been required to affirmatively state and cite the criminal intent standard in the text of a final rule—a departure from prior program-specific regulations that referenced criminal liability without an explicit mens rea statement. Second, it reinforces the distinction between civil IEEPA liability—which remains strict liability (no knowledge required)—and criminal liability, which requires proof of willfulness.

4. 30 Days to Respond to Pre-Penalty Notices

The Rule also codifies the procedures for Pre-Penalty notices for CMPs previously laid out in OFAC’s Enforcement Guidelines, but now requires any response to a Pre-Penalty Notice within 30 days; failure to submit a response within 30 days is deemed a waiver of the right to respond.  Any oral communication with OFAC prior to a written submission regarding the specific allegations in a Pre-Penalty Notice must be preceded by a written letter of representation, unless the Pre-Penalty Notice was served upon the alleged violator in care of the representative.  Any response to a Pre-Penalty notice must be in writing and signed by the alleged violator or its representative; the Rule specifically allows for electronic signatures.

Crowell & Moring will continue to monitor regulatory and enforcement developments at OFAC.