OFAC Just Codified Its Penalty Playbook. What 31 CFR Part 505 Means for Your Sanctions Compliance Program.

TL;DR

• On September 25, 2026, OFAC’s new 31 CFR Part 505 (Sanctions Penalties Regulations) took effect — the first formal codification of OFAC’s civil and criminal penalty procedures
• No substantive changes: max IEEPA civil penalty is still the greater of $377,700 or twice the transaction, criminal exposure still up to $1M and 20 years for willful violations
• Voluntary self-disclosure still cuts base penalties in half — but it’s now codified in regulation, not just agency guidance
• The practical impact is mostly structural: a single consolidated reference for enforcement procedures, replacing scattered penalty provisions across dozens of individual sanctions program regulations

For years, understanding how OFAC would calculate a penalty if your firm violated a sanctions program meant piecing together information from multiple sources — the appendix to Part 501, individual program regulations scattered across 31 CFR chapter V, the 2009 Economic Sanctions Enforcement Guidelines, and various agency policy statements. If you were facing an apparent violation involving Iran, you’d check one place; Russia, another; the SDN list generally, yet another.

That changes as of September 25, 2026.

OFAC published the new Sanctions Penalties Regulations at 31 CFR Part 505 in the Federal Register on September 25, 2026, effective immediately. The rule consolidates civil and criminal penalty procedures into a single formal regulation for the first time in OFAC’s history. If you’re managing sanctions compliance for a financial institution, a payment company, or any entity subject to OFAC’s jurisdiction, this is the new primary regulatory reference for what happens if something goes wrong.

The headline: OFAC says it makes no substantive changes. The reality: consolidation creates clarity — and clarity about enforcement procedures creates compliance obligations that didn’t exist in the same formal way before.

What Part 505 Actually Contains

The new regulation is organized into five subparts:

Subpart A: General Provisions — Defines the scope and covers the basic authorities under which OFAC enforces sanctions, principally the International Emergency Economic Powers Act (IEEPA) and the United Nations Participation Act (UNPA).

Subpart B: Civil Penalties — Sets out the base penalty framework. For IEEPA violations, the maximum civil penalty is the greater of $377,700 or twice the amount of the transaction underlying the violation — the same figure that has been in effect (subject to periodic inflation adjustments) for several years. For UNPA violations, the specific penalty provisions appear in Subpart E.

Subpart C: Criminal Penalties — Formalizes what was previously spread across individual program regulations: a person who willfully commits, attempts, or conspires to commit a sanctions violation, or aids and abets one, may be fined up to $1,000,000 upon conviction and, if a natural person, imprisoned for up to 20 years.

Subpart D: IEEPA Civil Penalty Procedures — This is the operational core of Part 505. It lays out the complete civil penalty process from the issuance of a Pre-Penalty Notice through the respondent’s opportunity to respond, OFAC’s issuance of a Penalty Notice, and available appeal mechanisms. This formalization is significant: the process existed before, but it was outlined in guidance documents rather than formal regulation.

Subpart E: UNPA Penalties — Covers the separate penalty structure for violations of sanctions programs issued pursuant to the UN Participation Act, where the statutory authority and penalty calculations differ from IEEPA.

Voluntary Self-Disclosure: Now Codified

The single most important compliance program implication of Part 505 is the formal codification of voluntary self-disclosure as a penalty mitigating factor.

Under the new regulation, when OFAC learns of an apparent violation through a voluntary self-disclosure, the base penalty amount is reduced by 50 percent. This was OFAC policy before — stated in the 2009 Economic Sanctions Enforcement Guidelines and reiterated in subsequent guidance. But policy guidance and codified regulation are different things.

With Part 505, voluntary self-disclosure isn’t just an informal benefit that OFAC might apply in its discretion — it’s a regulatory factor with a defined outcome. The 50 percent reduction in base penalty is now a regulatory provision. Compliance programs that have treated VSD as discretionary rather than structural need to revisit that framing.

The practical implications for compliance programs:

Your VSD procedures need to be documented and actionable. An OFAC investigation that begins before you self-disclose loses the 50 percent reduction. That means your internal detection-to-disclosure workflow must be fast and reliable — identifying apparent violations, escalating them to the appropriate decision-maker, and making a disclosure decision before OFAC opens its own inquiry. Part 505’s formalization of the VSD benefit adds urgency to having this infrastructure in place.

Document the decision, not just the outcome. For every apparent violation your screening processes flag, document whether a VSD was made and why. If you determined a VSD was not appropriate — because the transaction didn’t constitute a violation, because OFAC already had information, or for another reason — that documented decision-making process demonstrates a functioning compliance program.

Train legal and compliance teams on Part 505 together. The VSD decision is usually a legal judgment. But it requires compliance input on the nature of the apparent violation, the transaction facts, and what your systems detected and when. A compliance function that can give legal counsel a clear, documented account of what happened and when is positioned to make a faster, better-informed VSD decision.

What the Pre-Penalty Notice Process Looks Like Under Part 505

Subpart D formalizes the IEEPA civil penalty procedure that experienced sanctions practitioners already knew from guidance. But for institutions that haven’t been through an OFAC enforcement proceeding — and most haven’t — it’s worth understanding what the process looks like now that it’s codified.

The process runs:

1. OFAC issues a Pre-Penalty Notice — a document informing the respondent of the apparent violation, the proposed penalty amount, and the basis for the penalty. The Pre-Penalty Notice triggers the respondent’s right to respond.

2. The respondent has 30 days to respond to the Pre-Penalty Notice. The response is the primary opportunity to contest the facts, present mitigating factors, or propose an alternative penalty amount.

3. OFAC reviews the response and issues a Penalty Notice — or a Finding of Violation without a penalty if the circumstances warrant, or it may close the matter without further action.

4. The respondent can request reconsideration of the Penalty Notice within 30 days, presenting additional arguments or evidence.

5. Final agency action — the Penalty Notice becomes final if not contested within the applicable period, or after OFAC addresses a reconsideration request.

This is not a new process. But its formalization in regulation rather than guidance means institutions can cite it directly, train to it directly, and build their internal enforcement-readiness procedures to a codified regulatory standard rather than an informal agency policy document.

The Penalty Calculation Factors Your Program Should Map Against

Part 505 incorporates the penalty calculation factors that OFAC has applied for years — now in formal regulatory text. OFAC considers these factors when determining the appropriate civil penalty:

• Whether the conduct was willful or reckless
• The entity’s awareness of the sanctioned conduct or circumstance
• Harm to sanctions program objectives — financial harm, harm to U.S. foreign policy, or facilitation of deceptive practices
• The entity’s individual characteristics — size, industry, sanctions compliance history
• Adequacy of the compliance program — including whether the apparent violation was detected and disclosed through the compliance function
• Remedial steps taken in response to the apparent violation

For compliance officers, this list is a program design checklist in reverse. Each factor OFAC considers in penalty calculation is a factor your compliance program should be built to address. A compliance program that can demonstrate strong performance on each of these dimensions — not willful or reckless conduct, prompt detection through compliance systems, immediate remediation — is a program positioned to receive a favorable outcome if a violation occurs.

The AML/BSA risk assessment is the foundation for documenting many of these factors. If your institution is subject to both BSA/AML obligations and OFAC sanctions requirements — which covers most financial institutions — a risk assessment that documents your controls for each regulatory framework provides the evidence base for demonstrating that your program addresses the factors OFAC weighs.

What Changes When Individual Program Regulations Get Cross-References

OFAC has announced it will update individual parts of 31 CFR chapter V — the Iran sanctions, Russia sanctions, SDN-related provisions, and others — to replace existing penalty language with cross-references to the new Part 505. This is a housekeeping change, not a substantive one. But it creates a practical compliance issue.

For institutions that have built compliance policies and procedures that cite specific penalty provisions in individual program regulations, those citations may become stale once OFAC updates the underlying program regulations. The updated regulations will point to Part 505 for penalty procedures, and institutions whose policies cite the old provisions will be referencing superseded regulatory text.

This is a low-urgency but real maintenance task: when OFAC updates individual program regulations to cross-reference Part 505, update your internal compliance policies to cite the current regulatory text. It’s the kind of change that gets missed in a compliance program without a systematic regulatory maintenance process — and the kind of gap examiners find during sanctions compliance reviews.

What Part 505 Doesn’t Change

To be clear about what this rule is and isn’t:

It is not a new penalty framework. The dollar amounts, the factors, the process — all were in effect before September 25, 2026. The rule consolidates and formalizes; it doesn’t create new exposure.

It does not apply to OFAC enforcement actions already pending. Cases in progress under the prior framework continue under the rules applicable when the apparent violation occurred.

It does not change your substantive sanctions program obligations. The prohibitions, licensing requirements, and blocking obligations under individual sanctions programs are unchanged. Part 505 is about what happens if you violate those obligations — not what the obligations are.

It does not eliminate the role of the individual program regulations. For program-specific rules — what’s prohibited, what licenses are available, what OFAC’s licensing policy is — you still need to consult the specific regulations. Part 505 is the enforcement and penalties layer, not a substitute for the program-by-program analysis.

Practical Steps for Compliance Programs

For a compliance function managing sanctions obligations, Part 505’s effective date is an opportunity to review your program against the codified standard:

Update your regulatory inventory. Add 31 CFR Part 505 to your list of governing regulations. When OFAC updates individual program regulations to cross-reference Part 505, note those updates.

Review your VSD procedures against Part 505’s codified standard. The 50 percent base penalty reduction for voluntary self-disclosure is now in formal regulation — your VSD procedures should be designed to capture that benefit consistently, not as a case-by-case judgment call.

Map your compliance program against the penalty calculation factors. For each factor OFAC weighs, document how your program addresses it. This is the substance of what OFAC’s compliance framework — and what examiners and enforcement staff will evaluate.

Brief your sanctions compliance committee. The formalization of OFAC’s enforcement procedures in regulation rather than guidance is a material regulatory development. Leadership responsible for sanctions compliance should be aware of the change and what it means for your program’s documentation and procedures.

For institutions working through OFAC screening challenges and false positive management, Part 505’s formalization of the penalty calculation factors reinforces what was already operationally true: the quality of your screening system and your response to alerts is directly relevant to your enforcement exposure, not just your compliance standing.

So What?

OFAC didn’t change the rules on September 25. It organized them. That’s still meaningful.

For most financial institutions and compliance programs, Part 505’s primary value is clarity: a single regulatory source for OFAC’s enforcement procedures, penalty standards, and the rights of parties under investigation. That clarity makes training easier, policy documentation more precise, and compliance program audits more systematic.

The voluntary self-disclosure benefit — now codified at a 50 percent base penalty reduction — is the highest-value operational implication. A compliance program that detects apparent violations and has a documented, reliable process for making timely VSD decisions is a compliance program positioned to receive the maximum benefit from the new regulation’s formal structure.

Part 505 is effective now. Update your regulatory inventory, review your VSD procedures, and brief your sanctions leadership. The rule didn’t add new obligations — it made the existing ones harder to miss.

Primary sources

• Federal Register: Sanctions Penalties Regulations, 31 CFR Part 505 (2026-19678)
• KPMG Tax News Flash: U.S. OFAC adds Sanctions Penalties Regulations
• Transnational Matters: OFAC Voluntary Self-Disclosure Under the New Part 505 Rules
• OFAC: Civil Penalties and Enforcement Information
• Global RADAR: New OFAC and FinCEN Frameworks Seek to Modernize U.S. Financial Crime Regulations