OFAC and Vendor Management: What You Need to Know

Are you aware of the risks involved in doing business with parties sanctioned by the Office of Financial Assets Control (OFAC)? How does this impact your vendor management?

OFAC stands for Office of Foreign Assets Control within the Treasury Department. As part of the U.S. government measure to enforce anti-money laundering/counter terrorism financing regulations, OFAC oversees economic and trade sanctions. These sanctions are against countries, individuals, or outfits engaged in disreputable actions. In other words, they keep a list of individuals and entities with whom you should not do business.

OFAC resonates among security and risk management professionals because it enforces economic and trade sanctions against individuals and groups outside the United States that use cyber attacks to threaten U.S. foreign policy, national security, or economic stability.

OFAC is relevant to you for two reasons:

1. It’s another weapon that law enforcement has to deter cyber crime
2. Your company may need to develop a new compliance initiative to ensure they do not violate the terms of these sanctions (more on that below)

The penalties for breaching OFAC sanctions include monetary fines ranging from a few thousand dollars to several million, and prison time up to 30 years. This is because OFAC treats violations as a serious threat to national security and foreign relations.

What can you do to minimize OFAC sanctions risk from a vendor risk management standpoint?

The accelerated digital transformation has increased the need and usage of third-party vendors, to the point where any given organization engages with dozens or hundreds of them. But using products or services of a sanctioned entity or simply using a sanctioned third-party vendor, whether directly or indirectly, could lead to penalties and damage your company’s reputation.

How can you prevent the consequences?

Analyzing, identifying, assessing, and mitigating any risks associated with OFAC sanctions requires a high degree of collaboration among teams in an organization, as well as some additional controls in your usual vendor risk assessments.

An adequate compliance solution will depend on a variety of factors, including the type of business involved, and there is no single compliance program or solution suitable for every circumstance. 

You can get started by following these tips:

• Perform an OFAC check on any new third party you establish a relationship with
• Make sure to always check certain foundational items to ensure you’re doing business with a legitimate third party
• Include this check as part of your initial due diligence process and your continuous reassessments
• Review contracts to ensure that appropriate provisions are in place

Reduce third party risk

Global regulators, customers, and business partners expect robust third-party risk management programs. TPRM must be scalable, agile, and adaptable in order to support business growth while meeting security standards, such as those from OFAC.

If managing an ever growing vendor population while complying with industry and security standards seems like a lot, try Bitsight for Third-Party Risk Management. It’s an end-to-end solution to help organizations manage third-party cyber risk more efficiently and effectively. Whether it’s assessing the cyber risk of new and existing third parties, continuously monitoring vendor security performance, or responding to major security events, Bitsight has the tools and services to help your team execute on your third-party risk management program.