Sanctions Compliance for Freight Forwarders: OFAC, OFSI and Red Flags

Sanctions exposure for a forwarder or NVOCC is the risk of dealing, even indirectly, with a sanctioned person, vessel, aircraft or place, and it can arise without any intent to do so. It is wider than checking a consignee's name against a list. In the US, OFAC can penalise a violation without proving the company meant to break the rules; the UK removed the knowledge requirement for civil penalties in 2022; and the EU binds anyone doing business in or from its territory. In September 2025 and October 2026 OFAC settled with two freight forwarders, one with about a dozen staff. This guide covers why forwarders are in scope, what to check beyond the name, the red flags the US government has published, how penalties work, record-keeping and a procedure for a hit. It does not repeat how to screen names against lists; for that, read our guide to restricted party screening. Everything below is as of October 2026.

Why does sanctions law reach a freight forwarder?

A forwarder sits in the middle of a transaction: it books carriers, pays vendors, files documents and takes money from a customer. Each of those touchpoints can involve a blocked party or blocked property. OFAC put it directly in its October 2026 Pegasus release: logistics providers "often serve as the gatekeepers of international trade", the first line of defence against dealings with sanctioned parties.

United States. OFAC administers US sanctions. "US persons" (US citizens and permanent residents, US-incorporated entities and their foreign branches, and anyone physically in the US) must comply. Non-US companies are not outside the net. The December 2023 joint Know Your Cargo compliance note says non-US persons are prohibited from causing or conspiring to cause US persons to violate sanctions, and from conduct that evades them. A US dollar payment that clears through a US bank is the classic way a foreign forwarder creates a US connection (the "US nexus"). OFAC may impose civil penalties without proving intent; the common shorthand is strict liability. Check the Economic Sanctions Enforcement Guidelines (31 CFR Part 501, Appendix A) for the exact framework.

United Kingdom. UK financial sanctions are enforced civilly by OFSI. OFSI's guidance explains that the Economic Crime (Transparency and Enforcement) Act 2022 removed the requirement to show a person knew, or had reasonable cause to suspect, that they were breaching a financial sanction. OFSI still has to show the breach on the balance of probabilities, and it says a UK connection (a UK company, a transaction through UK clearing, or activity directed from the UK) engages its authority. At the time of reading, the guidance stated the maximum civil penalty as the greater of £1,000,000 or 50% of the estimated value of the funds or resources involved. OFSI updated its guidance on 9 February 2026 after a 2025 consultation; it added an Early Account Scheme (up to a 20% reduction) and discounts for voluntary disclosure and co-operation (up to 30%) and settlement (20%). Read the current version before relying on any of those figures.

European Union. EU sanctions bind EU nationals, EU-incorporated companies and business done wholly or partly in the EU. For forwarders the practical effects are through customers and carriers. Article 12g of Council Regulation 833/2014, added with the 12th package, requires EU exporters of certain sensitive goods (aviation items, jet fuel, firearms and the "common high priority items" list) to put a "no re-export to Russia" clause in their contracts with non-EU buyers. The Commission's FAQ says contracts concluded from 19 December 2023 had to carry it from 20 March 2024. That duty sits on the exporter, not the forwarder, but expect your EU shipper customers to ask what you do about diversion. The EU also introduced a "best efforts" duty for EU parent companies over their non-EU subsidiaries (Article 8a, with the 14th package in 2024). I could not confirm its wording from the primary text, so check the consolidated Regulation 833/2014 if you run a group structure.

A common misconception: "We are not a US company, so OFAC is not our problem." The Know Your Cargo note describes OFAC's 2022 settlement with Toll Holdings, an international freight forwarder, for $6,131,855 over 2,958 payments that touched blocked persons and North Korea, Iran and Syria through US financial institutions. OFAC found that Toll had told its affiliates in the UAE and South Korea not to put the names of sanctioned jurisdictions on invoices, to avoid bank scrutiny.

What should you screen beyond the consignee?

Names are the baseline, not the programme. The party list on a booking is only part of who is involved in the movement.

Two enforcement stories show why "other identifiers" belongs in the table. In the Pegasus case, the designated Chinese supplier renamed itself after being listed, but its phone number and email address stayed the same on the shipping documents. Pegasus's own policy called for screening name, address, email and phone, and a staff member only checked the new name. OFAC said a basic internet search would have found the match. The Know Your Cargo note also describes a 2018 Bureau of Industry and Security (BIS) penalty on a logistics company acting as forwarder that used an abbreviated name for a Chinese university, so its screening system never flagged an Entity List party. BIS said the firm had "self-blinded".

Ownership is a further trap. In the Fracht release, OFAC states that property can be blocked through ownership by a blocked person, "whether or not" it is identified on the SDN List. A clean name-search result does not clear a counterparty that a listed person owns. For export-control side questions, see the guides to ECCN and EAR99 and US export filing.

Which red flags have regulators published?

The most useful official list for forwarders is the Know Your Cargo compliance note, issued on 11 December 2023 jointly by the US Departments of Commerce, Treasury, Justice, State and Homeland Security. It names freight forwarders among the parties expected to assess their risk. It builds on the May 14, 2020 Sanctions Advisory for the Maritime Industry, Energy and Metals Sectors, and Related Communities, issued by the Treasury (OFAC), the State Department and the US Coast Guard, with a focus on Iran, North Korea and Syria. The note lists these indicators:

• Manipulating location or identification data: disabling or spoofing AIS (the vessel tracking system), or painting over names and IMO numbers.
• Falsifying cargo and vessel documents: bills of lading, certificates of origin, invoices, packing lists, proof of insurance and lists of last ports of call.
• Ship-to-ship transfers: often legitimate, but transfers at night or in high-risk areas are a concern.
• Voyage irregularities and abnormal routes: indirect routing, unscheduled detours, or transhipment through third countries without an apparent reason.
• Frequent registration changes: "flag hopping".
• Complex ownership or management: shell companies or opaque structures, or frequent changes of ownership.

The note says freight forwarders and agents are responsible for their own conduct, including representations in export filings. To avoid liability, they should decide whether a transaction raises red flags, ask about them, and not ignore suspicious circumstances. It also recommends written risk-based policies, location-history checks on vessels, aircraft and vehicles, and reviewing complete shipping documents, including bills of lading that show origin and destination (see bill of lading types). The note itself says it does not impose new legal requirements; read it as a statement of enforcement expectations.

There is also a joint Commerce, Treasury and Justice compliance note of 2 March 2023, "Cracking Down on Third-Party Intermediaries Used to Evade Russia-Related Sanctions and Export Controls". I confirmed its title, date and issuers from a law firm briefing and did not read the full text, so check it directly for its red-flag list.

What have forwarders actually been penalised for?

Three OFAC settlements involve freight forwarders. All figures are from OFAC's own releases unless stated.

• Toll Holdings, 25 April 2022, $6,131,855. Payments for sea, air and rail shipments involving blocked persons and sanctioned countries, processed through US banks. Described in the Know Your Cargo note; I did not read the original release.
• Fracht FWO Inc., 3 September 2025, $1,610,775. A Houston forwarder had an urgent customer shipment from Mexico to Argentina. It signed a charter with a blocked Venezuelan state-airline subsidiary, using an aircraft OFAC had blocked as Mahan Air property. The contract named the carrier, a Venezuelan address and a Venezuelan tail number; the vice president who signed skipped screening and legal review, contrary to company policy. OFAC found the case egregious and not voluntarily self-disclosed, and noted that Fracht conferred a direct benefit of about $935,000 on the blocked entity. Its lesson: "prioritizing urgent business demands at the expense of compliance".
• Pegasus Worldwide Logistics, 9 October 2026, $175,015. A California freight forwarder of about a dozen employees helped a customer import a $5,950 sugar packet-filling machine from a supplier OFAC had designated in May 2023 under counter-narcotics sanctions. OFAC treated the case as non-egregious and not voluntarily self-disclosed. It cited reckless disregard: Pegasus did not investigate after Customs and Border Protection detained the machine under an OFAC notice, and then took six months to give OFAC a complete response to an administrative subpoena, which drew separate violations of the reporting regulations.

The penalty structure shows through those releases. Under the Enforcement Guidelines, OFAC first decides whether a case is egregious and whether it was voluntarily self-disclosed. For an egregious case that was not self-disclosed, the base penalty was the statutory maximum ($2,147,700 in Fracht); for a non-egregious one, a schedule amount ($205,900 in Pegasus). OFAC then adjusts for general factors: the company's compliance programme, remediation, cooperation, size, and whether managers knew. Fracht paid less than the maximum after cooperating and fixing its controls. Pegasus's size and low transaction value counted in its favour. Statutory maximums are adjusted each year, so check the current figure rather than quoting an old one.

What does a sanctions compliance programme look like for a forwarder?

OFAC published A Framework for OFAC Compliance Commitments on 2 May 2019. It says a risk-based programme should rest on at least five components: management commitment, risk assessment, internal controls, testing and auditing, and training. OFAC also says it may reduce a penalty for an effective programme and may weigh one when deciding whether a case is egregious. Applied to a forwarder, that translates to:

• Management commitment: a named compliance owner, written approval of the policy by senior management, and a rule that screening cannot be skipped when a customer is in a hurry. Fracht's executives broke their own policy under time pressure.
• Risk assessment: list your customers, trade lanes, ports, carriers and payment routes, then rate them. A forwarder with lanes near heavily sanctioned countries has a different profile from one doing domestic consolidation.
• Internal controls: a written procedure that says what is screened, when, and by whom. Pegasus's procedure did not say when to check the SDN List, so the check happened after the shipment was booked. Screen at quote or booking, again before departure, and again when parties change.
• Testing and auditing: sample past files to see whether the procedure was followed.
• Training: role-specific, at least annually in OFAC's framework, and aimed at the people who actually sign contracts and release cargo, which includes sales and operations as well as compliance.

If you use overseas agents or partners, extend the same questions to them; our guide on vetting overseas freight agents covers the commercial side. An NVOCC, which issues its own bills of lading and contracts directly with shippers, carries the shipper-facing risk itself; our NVOCC and forwarder comparison explains the difference. Insurers commonly exclude trades that breach sanctions, so check your liability policy wording.

How long should you keep sanctions records?

For OFAC, 10 years. The 21st Century Peace through Strength Act (signed 24 April 2024) extended the statute of limitations for IEEPA and Trading with the Enemy Act violations from five years to 10. OFAC then amended the recordkeeping rule at 31 CFR 501.601 to match. It published an interim final rule on 13 September 2024 effective 12 March 2025, and a final rule in the Federal Register of 21 March 2025 adopted it without change. Records of a transaction must be kept for at least 10 years after it, whether or not a licence was used; there is a separate rule for blocked property, so read 501.601 directly. Keep the screening results, the decision, who made it and the documents screened. This overlaps with ordinary customs record rules; see customs audit readiness.

What should you do when you get a hit?

Treat it as a stop, not a warning. A hit means a possible match, and a possible match needs an answer before the cargo moves, the invoice is paid or the document is issued.

1. Stop processing. Do not release, return, re-route or re-book the cargo, and do not pay or accept money, until you know what you have.
2. Resolve the match. Compare every identifier (address, date of establishment, phone, email, IMO number, ownership), not just the name. Ask the customer for documents. Record your reasoning either way.
3. If it is a true match, escalate to counsel and your compliance owner. In US terms, a transaction is either blocked (a listed person has an interest in property in your possession) or rejected (prohibited, but with no blocked interest). The two have different consequences. OFAC reports of blocked and rejected transactions are generally due within 10 business days (31 CFR 501.603 and 501.604); confirm the current rule.
4. Do not tip off or improvise. Handing blocked cargo back to the shipper can itself be a dealing. UK and EU regimes have their own reporting duties to OFSI and national competent authorities, and the EU Article 12g wording requires exporters to tell their authority when they learn of a breach of the clause.
5. Consider disclosure. OFAC treats voluntary self-disclosure as a mitigating factor, and as the Fracht case shows, a disclosure that comes after another agency already knows may not count. Take advice on timing.

What to do next

1. Write a one-page sanctions procedure: what you screen (parties, vessels, aircraft, ports, banks), when, and who signs off. Name an owner.
2. Add vessel, route and ownership checks to your booking workflow, not only names, and screen again before departure.
3. Run a 20-file sample audit from the last quarter, and check that each file shows a screening result and a decision.
4. Set a 10-year retention rule for screening records and test that you can retrieve them.

If you are looking for a forwarder with experience on a sanctions-sensitive lane, more than 29,300 logistics companies are searchable by country and service in the CargoLinked directory, and the public requests board lists freight that shippers have posted for forwarders to quote on directly. Directory listings are not reviewed in advance, so run your own diligence on any counterparty.

This guide is general information as of October 2026, not legal advice. Sanctions law is complex and changes often, and the details differ by programme and country. Confirm requirements with the issuing authority (OFAC, OFSI, your national competent authority) or a qualified sanctions lawyer before acting.