Sanctions screening: what actually happens when your directory pays someone abroad
Why "it's just a referral payout" is the wrong instinct
Your directory pays an affiliate their monthly commission. It refunds a card by sending money to a bank account a departing advertiser gave you in another country. It cashes out an ad-credit balance for a model who is closing her account. None of these look like compliance events. They look like Tuesday: a few line items in a payouts dashboard, cleared by whatever rail you already use to move money out the door.
One of those names can turn an ordinary Tuesday into a federal matter, and the part that catches operators off guard is that it does not require you to have done anything wrong on purpose. The U.S. Treasury's Office of Foreign Assets Control, OFAC, enforces its sanctions rules as a strict-liability regime: a civil penalty can attach to a payment you sent to a blocked person or entity even if you had no idea who they were and no reasonable way to find out. Not knowing lowers the penalty. It does not make the payment legal.
This is a different kind of exposure from the ones a high-risk operator already budgets for. A chargeback or a MATCH listing punishes you for what a customer did to your merchant account. Sanctions exposure is about what you send out: who gets the money when your directory is the one initiating the payment, with no card network or issuing bank standing between you and the decision.
What follows is what that actually means in practice: who OFAC reaches even if your company was never incorporated in the United States, the ownership trap that makes a clean-looking payee insufficient, where wires and digital currency fall outside what your processor already screens, and the one habit worth building this week regardless of how small your payout list is.
What OFAC actually is, and why it reaches you even if you are not American
OFAC administers and enforces U.S. economic sanctions: a Specially Designated Nationals list of blocked individuals and entities, plus country-level programs that prohibit most transactions with specific jurisdictions outright. Dealing with a blocked person or entity, directly or indirectly, is not a paperwork violation. It is the thing the whole program exists to stop, and the penalty structure treats it that way.
The rules formally bind "U.S. persons": citizens and permanent residents wherever they live, companies organized under U.S. law, and their foreign branches. A directory incorporated entirely outside the United States is not a U.S. person in that narrow sense. It still feels OFAC's reach the moment it pays out in U.S. dollars, because that dollar leg almost always clears through a correspondent bank in the United States, and that bank is a U.S. person bound to block or reject the transfer. The practical result for a foreign operator is usually a frozen payment and an uncomfortable call from its bank, not a personal OFAC penalty, which is a separate legal question tied to actually being a U.S. person or causing one to break the rules. Either outcome stops your money from moving.
There is no dollar floor below which this stops applying. OFAC's own 2026 enforcement log, public on its website, includes a $60,764 settlement against a mid-sized manufacturer alongside seven-figure cases against a consulting firm and a brokerage, in the same few months. Enforcement priority leans toward the largest and most deliberate violations, but the legal exposure does not wait for a case to be large before it exists.
No classifieds directory is going to land anywhere near those headline numbers, and that is not really the point. The mechanism that produces them, a blocked payment, a bank asking questions it will not fully explain, a filing obligation you did not know existed, shows up at any transaction size. A twelve-hundred-dollar payout to an affiliate runs through the identical process as a million-dollar one.
The 50 Percent Rule: why a clean-looking name is not enough
The obvious step is checking a payee's name against the Specially Designated Nationals list before you send money, and that step matters. What it misses is OFAC's 50 Percent Rule: any entity owned 50 percent or more, in the aggregate, by one or more blocked persons is itself treated as blocked property automatically, by operation of law, even though it never appears on the list under its own name and even if you had no way of knowing who owned it.
The rule turns on ownership, not on control or a signature on a contract. A company run day to day by someone with no sanctions history can still be blocked if the equity behind it traces back far enough to a listed person, including through a chain of holding entities. Aggregation matters too: two blocked individuals each owning a quarter of the same company add up to the fifty percent that blocks it, even though neither one alone would.
No small operator is going to trace an affiliate's cap table before cutting a commission check, and nobody expects that. What is realistic is treating a name search against OFAC's own free Sanctions List Search tool as a routine step before a payout crosses whatever threshold you set, the same way address verification became routine on the checkout side. The tool uses fuzzy matching and will produce false positives and the occasional false negative, so a clean result is a first screen, not a clearance certificate, but running it costs nothing and takes minutes.
This matters most where the payout itself is already carrying other risk. Referral and affiliate payouts are exactly the recurring, semi-automated transfers that are easiest to wave through without a second look, precisely because they repeat on a schedule and nobody re-examines a relationship that has been running cleanly for a year.
Wires, crypto, and the payouts your processor never screens
Cryptocurrency does not sit outside any of this. OFAC has published sanctions compliance guidance specifically for the virtual currency industry, and it adds individual wallet addresses directly to the Specially Designated Nationals list as blocked property, the same as it would a bank account. A directory that accepts or sends crypto because it assumes sanctions rules are a card-network problem is working from a wrong premise.
A wire sent to a comprehensively sanctioned jurisdiction is prohibited regardless of what the payment is for, absent a specific license, and that list of jurisdictions is not fixed. It has moved meaningfully in the last two years: Syria's country-wide program, which had sat on compliance checklists for over a decade, was formally terminated in the summer of 2025 after the change of government there. Building a hardcoded list of "the sanctioned countries" into a policy document is a way of guaranteeing that document goes stale. Checking OFAC's own current program list before an international wire goes out costs one lookup.
The gap worth naming directly: your payment processor's underwriting screened you, the merchant, and your beneficial owners, when it opened your account, and most processors keep some form of that monitoring running afterward. None of that screening reaches the payouts you initiate yourself, the referral commission wired abroad, the crypto payout to a model who asked for it, the ad-credit balance cashed out to an account your platform has never seen before. Those are yours to check, because nobody upstream of you is checking them.
This is also where the highest-risk payouts tend to cluster for a classifieds operator specifically: international affiliates recruited through word of mouth rather than a formal network, advertisers closing accounts and asking for balances sent somewhere new, and any payout rail you chose because it was fast and light on paperwork. Speed and light paperwork are exactly the features that make a payment easy to send before anyone has looked at who is receiving it.
What to actually build, this week
Pick a dollar threshold today, below which you are comfortable accepting the residual risk and above which every payout gets a name check against OFAC's free Sanctions List Search tool before it goes out. For most directories this threshold will be low: the tool is free and a search takes under a minute, so there is little reason to set it high.
Log the search, not just the result. A timestamp, the name you searched, and what came back is the record that matters if a name slips through anyway, because OFAC's own enforcement guidelines treat a documented compliance effort as a factor that reduces a penalty even when it did not prevent the violation. No log means no evidence that you tried.
Re-screen recurring payees, not just new ones. The Specially Designated Nationals list is updated close to weekly, so an affiliate who cleared a search a year ago is not guaranteed to clear one today, and a relationship running on autopilot is the one least likely to get checked again without a standing rule that forces it.
If you ever do block or reject a payment because of a sanctions match, that triggers its own clock: a report to OFAC within 10 business days of the blocking or rejection, and, if you end up holding blocked funds past mid-year, an annual report due every September 30. Almost no directory this size will hit that point, but knowing it exists means a block does not quietly turn into a second, separate violation on top of the first problem it was solving. None of this calls for a compliance department or a paid screening vendor built for banks processing thousands of transfers a day. It calls for one free search, logged, before the payouts that already carry the most risk, treated as routine as the identity check you already run on the other side of the business.
