Receiving an OFAC administrative subpoena from the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) is an unsettling event, especially if you are an individual or company that rarely deals with sanctions issues. It is natural to worry about potential penalties, reputational harm from any publicity, or even criminal exposure, and to feel pressure to respond immediately.

An OFAC administrative subpoena, however, is first and foremost a tool for gathering information: it signals that the agency is investigating transactions that may implicate U.S. sanctions, but it is not itself a finding of liability or a decision by the government to bring an enforcement action against the recipient. How a recipient handles the early stages of an OFAC subpoena response can materially impact the scope, duration, and ultimate outcome of the matter.

This article explains what an OFAC administrative subpoena is and is not, outlines practical steps for responding, and highlights common pitfalls that can make an already difficult situation worse.

What is an OFAC Subpoena?

OFAC’s broad administrative subpoena authority stems from the International Emergency Economic Powers Act (“IEEPA”)—the statutory basis for nearly all OFAC administered sanctions programs—and the Trading With the Enemy Act (“TWEA”), the primary statutory basis for its Cuba sanctions program. These statutes enable OFAC to require any person to keep “…a full record of, and to furnish under oath…complete information…” about transactions subject to the agency’s sanctions programs, including through an OFAC administrative subpoena issued in connection with an investigation.

OFAC’s implementing regulations for these statutory grants of authority are codified in 31 C.F.R. §501.601 and § 501.602. In § 501.601, OFAC sets out its recordkeeping requirements, obligating persons engaging in any transaction subject to the agency’s regulations to keep a full and accurate record for at least 10 years, aligned with the 10-year statute of limitations for IEEPA and TWEA violations effective April 24, 2024. § 501.602, in turn, authorized OFAC to require any person to furnish such records under oath, including by issuing an administrative subpoena compelling  “…the attendance and testimony of witnesses and the production of any…hard copy or electronic documents relating to a matter under investigation…”

For purposes of § 501.602, the term document is very broadly defined to include any medium that preserves information or communication, whether written, electronic, audio-visual, or data-based. These provisions apply across OFAC’s sanctions programs, even if program-specific regulations are not separately promulgated.

In practical terms, an OFAC administrative subpoena is the mechanism the agency uses to exercise these powers in a specific case. It requires an individual or entity to provide specified records and/or testimony so that OFAC can assemble a complete factual picture of the transactions under review.

What an OFAC Subpoena Does Not Mean

An OFAC administrative subpoena is:

• NOT a finding of liability or an admission of wrongdoing.
• NOT the same as a civil penalty, finding of violation, or settlement.
• NOT an automatic indication that the matter is being criminally investigated.

While OFAC uses its subpoena powers to investigate transactions it believes may have implicated sanctions prohibitions, the recipient of a subpoena is not necessarily the intended target of that investigation. Financial institutions and other intermediaries frequently receive subpoenas about their customers’ activity, so the mere receipt of a subpoena does not, by itself, mean OFAC believes the recipient has violated sanctions.​ In practice, however, how one responds to the subpoena can affect whether—and to what extent—OFAC ultimately focuses on that party as a subject of the matter, including as a potential target (if they were not already).

In most cases, the subpoena marks the beginning of OFAC’s fact-gathering in a matter, and the scope and outcome of the inquiry in relation to a recipient will often turn on the completeness and accuracy of the information provided in response. Although an OFAC subpoena is not itself a penalty or finding of wrongdoing, it should still be treated as a serious enforcement-related matter that warrants prompt, careful attention, and a deliberate response strategy.

It is also important to recognize that the same underlying conduct may attract interest from other U.S. agencies with overlapping jurisdiction, including the Department of Justice in a criminal context. Under OFAC’s Enforcement Guidelines, the agency may refer a matter to law‑enforcement authorities for criminal investigation and/or prosecution, and apparent sanctions violations that are referred for criminal investigation can still be subject to OFAC civil penalties or other administrative action.

So, while an OFAC subpoena does not, by itself, mean the recipient has violated sanctions or will face criminal charges, it is a critical inflection point in how the matter may develop. The first step is to be deliberate about a response strategy—starting with not responding informally or immediately.

Step 1—Deliberate: Do Not Respond Informally or Immediately

Although OFAC subpoenas typically provide a 30‑calendar‑day response window—which is not a generous amount of time—it is critical that the recipient not respond informally or in haste. The assigned OFAC Enforcement Officer may, depending on the circumstances, be willing to extend the response deadline (sometimes with conditions such as rolling productions). However, even initial discussions about procedural issues such as timing should be handled deliberately and with appropriate care.

U.S. economic sanctions are a complex and rapidly evolving area of law, and federal courts have historically afforded substantial deference to OFAC’s interpretation of its own regulations, which are sometimes broadly written or ambiguous. Because liability for OFAC-administered sanctions is based on strict liability, even sophisticated parties can create unnecessary risk by offering off-the-cuff or informal responses before fully understanding the applicable rules and the underlying facts.

A rushed reply can lock in incomplete or inaccurate statements, waive important protections (such as privilege, relevance objections, or confidentiality protections), or inadvertently broaden the scope of OFAC’s inquiry. OFAC’s subpoenas typically cite the federal False Statements Statute (18 U.S.C. § 1001), and require a signed Certificate of Compliance attesting that the response isaccurate, complete, and fully compliant with the subpoena’s requests—raising the stakes for anything said or produced without careful preparation.

Instead of reacting on the fly, the recipient should use this initial period to pause, assemble the right internal and external stakeholders, and plan a coordinated response, while keeping firmly in view the response deadline and any agreed extensions.

CASE EXAMPLE: In a November 24, 2025 enforcement action against an individual, OFAC underscored that the respondent “failed to cooperate” by certifying an inaccurate and incomplete response to an OFAC administrative subpoena by his related real estate investment company. OFAC treated this deficient and misleading subpoena response as an aggravating factor in its enforcement response, signaling that parties risk additional exposure if they respond hastily or without fully vetting what they are telling the agency.

Step 2—Preserve Documents and Data Immediately

Once a subpoena is received, it is essential to immediately implement a litigation‑style hold to preserve all potentially responsive documents and data, ensuring that no responsive materials are deleted or altered—whether inadvertently through routine processes (such as automatic deletion of emails or messaging‑platform content) or willfully through ‘cleanup’ efforts. In practice, this requires promptly identifying where potentially relevant information resides and directing custodians to suspend any routine deletion or reorganization of those materials.

• For entities: coordinate with IT and relevant business units to suspend normal retention or auto‑deletion settings across email, shared drives, collaboration tools, and key systems. Keep in mind that OFAC’s submission guidelines ask for all custodians of records within an entity to be identified in a submission.

• For individuals: preserve information on personal laptops, phones, and cloud‑based accounts that may contain responsive communications or files, including messaging apps and personal email, not just “work” systems.

As noted above, § 501.602 of OFAC’s regulations already provides a broad definition of the term document. By contrast, OFAC subpoenas themselves usually provide an even broader definition, explicitly calling out the term “data” and listing other specific categories such as payment-system messages (e.g. SWIFT, CHIPS, etc.), account system records, and system reports and logs. In practice, this means that any preservation step should be drafted with a subpoena’s expansive ‘document’ and ‘data’ language in mind and should extend beyond traditional documents to encompass underlying databases, logs, backups, devices, and other electronic data sources likely to contain responsive information.

Step 3—Engage Sanctions Counsel Early

Given the complexity and strict‑liability nature of U.S. sanctions laws, recipients of an OFAC subpoena should engage experienced sanctions counsel as early as possible in the process. Early involvement allows counsel to interpret the scope of the subpoena, help shape the document‑preservation effort, assess potential civil and/or criminal liability exposure, and frame initial communications with OFAC in a way that is accurate, appropriately limited, and consistent with a broader plan for managing the OFAC inquiry and any related exposure.

Early involvement of counsel also helps ensure that sensitive internal fact‑gathering and analysis are conducted in a way that supports applicable privilege protections, especially when evaluating potential violations, remedial steps, and how to describe prior conduct to OFAC. For individuals and smaller entities, early engagement can be particularly important to ensure that any informal outreach to OFAC, banks, or counterparties does not inadvertently create additional risk or foreclose important strategic options later.

Because sanctions counsel will often be advising not only on the subpoena response but also on OFAC’s potential enforcement posture, they should also be attuned to the agency’s Economic Sanctions Enforcement Guidelines and the “General Factors” that inform whether OFAC pursues no action or cautionary letter, issues a finding‑of‑violation, seeks a civil monetary penalty, makes a criminal referral, and/or seeks other administrative actions (e.g., license revocation).

Step 4—Considering OFAC’s Enforcement Guidelines

Within OFAC’s Enforcement Guidelines in the Appendix to 31 C.F.R. Part 501, the agency describes the General Factors Affecting Administrative Action it considers when deciding whether—and how—to take administrative action in response to any transactions that it believes may be in violation of U.S. sanctions (“apparent violations”), including how to calculate any civil monetary penalty if warranted.

Among other things, the General Factors focus on issues such as willfulness or recklessness, the subject person’s awareness of the conduct at issue, harm to sanctions‑program objectives, the existence and quality of a sanctions compliance program, remedial efforts, and the nature and extent of cooperation with OFAC. With these factors in mind, choices made at the subpoena‑response stage—the manner of responding (including timeliness and completeness of responses), whether to go beyond the four corners of the subpoena or contest its scope, how to present the relevant facts, which remedial steps to highlight or undertake, and whether (and on what terms) to enter into any requested tolling agreement—can materially influence how OFAC ultimately evaluates the matter.

Common OFAC Subpoena Mistakes

Even with these guiding steps in mind, parties frequently make avoidable mistakes in the immediate aftermath of an OFAC subpoena that can increase enforcement risk or complicate the agency’s view of the matter. The following are some of the more common missteps:

• Responding informally or too quickly, potentially leading to inconsistent or incomplete statements. For example, emailing the OFAC Enforcement Officer haphazardly or providing partial information before the relevant facts and legal issues are fully understood.

• Failing to respond, leading to civil penalties for failure to comply with the subpoena in violation of § 501.602 (separate from any substantive sanctions violations), and/or civil monetary penalties for substantive violations based solely on OFAC’s view of the underlying transactions in the absence of the recipient’s input.

CASE EXAMPLE: In a June 12, 2025 enforcement action against GVA Capital Ltd., for example, OFAC found that the firm certified its subpoena response as complete in 2021 but then took more than two years to finish producing roughly 1,300 additional responsive records. OFAC treated this prolonged failure to fully comply as 28 separate violations of §501.602, on top of egregious, willful Russia sanctions violations—contributing to a nine‑figure penalty capped at the applicable statutory maximum.

• Failing to implement a sufficiently broad document and data hold, leading to inadvertent loss of emails, messaging-platform content, system logs, or other electronic records.

• Viewing the subpoena purely as a routine or benign document request from OFAC, and therefore failing to appreciate that the agency will evaluate the response under its Enforcement Guidelines’ General Factors, including for the potential actions (e.g., civil monetary penalty) that its investigation may lead to.

• Not being fully forthcoming with retained sanctions counsel about relevant facts, prior communications, or potential violations, which can lead to incomplete or inaccurate submissions to OFAC and undermine both the response strategy and counsel’s ability to mitigate risk.

• Not being cooperative with OFAC—such as ignoring follow‑up inquiries or unreasonably resisting reasonable accommodations, which may serve as an aggravating factor under OFAC’s Enforcement Guidelines’ General Factors.

• Failing to make any remedial changes in response to any compliance gaps or potential violations identified in the course of internal investigations for responding to OFAC’s subpoena(s), and/or failing to document and appropriately highlight them to the agency, thereby missing an opportunity to obtain mitigation credit under OFAC’s Enforcement Guidelines’ General Factors.

• Failing to follow OFAC’s Production Submission Standards, such as by omitting required certifications, using inconsistent file formats or naming conventions, or not clearly identifying custodians and record sources, which can frustrate OFAC’s review and reflect poorly on the recipient’s compliance posture.

Taken together, these steps and pitfalls underscore that an OFAC subpoena, while not itself a finding of wrongdoing, should be approached as a serious enforcement matter that warrants deliberate strategy and disciplined execution.

---

The author of this blog post is Kian Meshkat, an attorney specializing in U.S. economic sanctions and export controls matters. If you have any questions, please contact him at meshkat@meshkatlaw.com.