International Grant Compliance: OFAC, Anti-Terrorism & Cross-Border Requirements

Why Does International Compliance Matter for Your Nonprofit?

International grant work is essential for nonprofits addressing global challenges—from humanitarian relief to educational development. But it comes with regulatory complexity that trips up even experienced grant professionals.

Here's what happens when compliance fails: The Gates Foundation terminated a $5 million international health grant after discovering improper OFAC screening procedures. A respected education nonprofit lost future federal funding eligibility because partners weren't adequately vetted. A development organization faced civil penalties when funds inadvertently reached sanctioned regions.

These aren't isolated incidents. Auditors report that international compliance failures are among the top 3 grant-related findings in nonprofit audits, alongside indirect cost violations and documentation gaps.

Who Needs to Comply?

• Any nonprofit receiving federal grants (technically required)
• Organizations working with international partners or subgrantees
• Groups receiving funds from foundations with international focus (recommended by funder policy)
• NGOs operating in or sending resources to high-risk countries
• Organizations accepting donations from international sources

What Is OFAC & SDN Screening? (Not as Intimidating as It Sounds)

The Office of Foreign Assets Control (OFAC) is a Treasury Department agency that administers economic and trade sanctions. Their job: prevent U.S. money from reaching terrorists, corrupt regimes, drug traffickers, and other designated threats.

OFAC maintains multiple lists of "bad actors" including individuals, entities, and organizations you cannot legally transact with. The most important list for nonprofits is the Specially Designated Nationals (SDN) List.

Understanding the SDN List

The SDN list contains approximately 9,000+ individuals and 3,000+ entities that are blocked from U.S. transactions. These include:

• Individuals and family members of designated terrorists
• Iranian, North Korean, and Syrian government officials and entities
• Drug trafficking organizations and their operatives
• Corruption networks and their facilitators
• Sanctioned foreign ministries and government agencies

If you send funds to an SDN—even if unintentional—you've violated federal law. The SDN list is updated daily. Penalties include civil fines up to $20,000 per violation, plus potential criminal liability.

When OFAC Screening Is Required

How to Actually Screen Against the SDN List

The good news: OFAC provides free screening tools. No need to pay vendors.

Step 1: Manual Search
Visit sanctionssearch.ofac.treas.gov. Search for the full name of your partner, subgrantee, or recipient. The system searches the SDN list, Consolidated Non-SDN List (CNSL), and other OFAC lists simultaneously.

Step 2: Documentation
Screenshot or download the "No Results" or clear results page. This is your compliance documentation. Store it with the grant file for audit purposes. It's your proof of screening.

Step 3: Interpret Results
If the search returns your partner's exact name, don't panic immediately—verify it's actually them before blocking funds. Many common names yield false positives. Request the entity's address, government ID number, or other details to confirm.

Step 4: Annual Re-screening
Lists update daily. Re-screen partners annually and whenever funds increase significantly. Document all re-screenings in your compliance file.

Anti-Terrorism Financing Guidelines: What's Voluntary vs. Mandatory?

OFAC screening prevents funding designated terrorists and sanctioned entities. But anti-terrorism financing compliance goes broader—it requires nonprofits to develop risk management practices to prevent supporting terrorism financing generally, even if someone isn't on an official list.

This framework comes from international standards (FATF guidance) and has been adopted through various Treasury guidance documents. While not always legally mandatory for smaller nonprofits, major foundations increasingly require it in their grant agreements.

Key Components of AML/CFT Programs

• Know Your Partner (KYP) Procedures: Document who you're working with, verify their legitimacy, understand their mission and funding sources.
• Beneficial Ownership Verification: Confirm that funds reach the intended beneficiaries, not hidden intermediaries.
• Sanctions Screening: OFAC and other sanctions lists (EU, UN, national lists).
• Transaction Monitoring: Flag suspicious patterns—sudden large transfers, unexpected jurisdictional changes, requests to obscure beneficiaries.
• Reporting & Record Keeping: Document all screening, due diligence, and unusual transactions for 5+ years.

Red Flags in International Grantmaking

When you see these patterns, escalate to your finance team or board before disbursing funds:

• Partner requesting funds be wired to a third country instead of their registered address
• Organizational documentation that appears forged or suspiciously recent
• Beneficial ownership structures that don't match stated organizational purpose
• Partner sudden inability to receive funds through normal banking (claims "we only use cash now")
• Multiple name changes or shell entity structures
• Operations in or connections to high-risk jurisdictions without clear programmatic justification
• Requests to circumvent normal contracting or compliance procedures

Building Your AML/CFT Program Step-by-Step

1. Document Your Policies: Write a 2-3 page Know Your Partner policy. Define what information you collect and when.
2. Create a Questionnaire: Use FATF guidance. Ask about mission, funding sources, beneficial owners, and geographic operations.
3. Screen Systematically: OFAC, Google, IRS 990 database (if applicable), and regional sanctions lists.
4. Store Results: Keep documentation in a centralized compliance folder for audit purposes.
5. Train Your Team: Ensure finance, program, and grants staff understand the process.
6. Annual Review: Audit your compliance practices annually, even if informally.

Foreign Agent Registration: When Does It Apply to Your Nonprofit?

The Foreign Agents Registration Act (FARA) requires people and organizations working on behalf of foreign governments to register with the Justice Department and disclose their funding, activities, and contacts.

Many nonprofits worry FARA applies to them. Usually, it doesn't—but understanding when it might is important.

FARA Basics

FARA applies if:

• Your nonprofit is acting at the direction of a foreign government (not just receiving funds from them)
• You're actively promoting a foreign government's political interests in the U.S.
• You're conducting propaganda activities for a foreign state

FARA likely doesn't apply if:

• You're delivering humanitarian services to a country's population (even if funded by that government)
• You're implementing development programs in a foreign country (not promoting their political interests here)
• You're receiving grants without being directed on what political messaging to deliver

State-Level Foreign Agent Laws

Beyond FARA, several states have enacted their own foreign agent registration laws with lower thresholds. States like Florida and Texas have added requirements for nonprofits receiving funding from certain countries. Check your state's laws—they're increasingly common.

Anti-Money Laundering (AML) Basics for Nonprofit Leaders

You don't need to be a compliance officer to understand AML. The concept is straightforward: prevent criminals from hiding illegal proceeds in legitimate organizations.

Why This Matters for International Nonprofits

Nonprofits are attractive to money laundering because:

• Cash donations are common (harder to trace than commercial transactions)
• International wire transfers are routine
• Missions ("we help people") create legitimate explanations for large funds
• Many nonprofits lack robust financial controls

Criminals exploit this. A healthcare nonprofit in Texas unknowingly received $2 million from a drug trafficking organization. The IRS caught it during audit, leading to civil penalties and loss of nonprofit status.

AML Red Flags Specific to Nonprofits

• Large unsolicited donations from unknown sources with no clear motivation
• International wire transfers that don't match your program locations
• Donors insisting on cash or cryptocurrency with no documentation
• Board members or partners with known sanctions violations or criminal records
• Frequent requests to wire funds internationally without clear program justification
• Circular funding patterns (money comes in, goes out internationally, comes back)

Simple AML Safeguards You Can Implement

• Know Your Donors: For donations over a threshold (recommend $10,000), collect basic information—name, address, source of funds. Document it.
• Accept Limited Cash: Restrict cash donations. Require donors above a threshold to use bank transfers.
• Screen Board and Key Personnel: Background check your board and anyone involved in high-value transactions.
• Document Decision-Making: Board minutes explaining why large international grants are approved.
• Audit Trail: Every dollar in and out should be documented and traceable.

Building a Cross-Border Compliance Program on a Limited Budget

You don't need expensive consultants to build credible compliance. You need clear policies, documented processes, and discipline.

The Minimum Viable Compliance Program

1. Written Know Your Partner Policy (Cost: Free)

This is a 2-3 page document defining:

• When you screen (before every international agreement over $X amount)
• What you screen for (OFAC, basic legitimacy, beneficial ownership)
• How you document results (screenshots, signed questionnaires)
• Who approves high-risk partners (board, executive director, compliance committee)

2. Partner Screening Questionnaire (Cost: Free)

A simple form asking partners:

• Legal name and aliases
• Address and jurisdiction of incorporation
• Mission and primary activities
• Funding sources and major donors
• Confirmation they're not sanctioned and don't work with sanctioned parties
• Agreement to OFAC screening

3. OFAC Screening (Cost: Free)

Use the free Treasury tool. Document results. This alone demonstrates good-faith compliance efforts to auditors and funders.

4. Compliance File Organization (Cost: Free)

Create a shared folder for each international grant containing:

• Partner questionnaire (completed and signed)
• OFAC screening documentation
• Legal registration or IRS 990 (if available)
• Board approval memo for high-risk partnerships
• Annual re-screening results

5. Annual Compliance Checklist (Cost: Free)

Once yearly, your executive director, board treasurer, or grants manager reviews:

• Were all international partners screened before first payment?
• Were high-risk partners re-screened this year?
• Are screening files organized and complete?
• Did any red flags arise in transactions?
• Are there any compliance updates needed?

Document this review in board minutes. This demonstrates institutional commitment.

When to Invest in External Support

If your nonprofit:

• Disburses over $5 million internationally annually
• Has received funding from USAID, State Department, or international development institutions
• Operates in high-risk jurisdictions (designated by OFAC or FATF)
• Has faced past audit findings related to international compliance

Then consider engaging a nonprofit compliance consultant for 1-2 days ($2,000-5,000) to review and strengthen your program.

How Do Country Risk Factors & FATF Designations Impact Your Work?

Not all countries present equal compliance risk. OFAC maintains a list of "High-Risk Jurisdictions" and countries with weak anti-money laundering standards. The Financial Action Task Force (FATF) also identifies jurisdictions with deficient AML/CFT regimes.

Key High-Risk Country Lists

OFAC Sanctions Program Countries: Iran, North Korea, Syria, Cuba (restricted), Russia/Belarus (sectoral), and others. Transacting with these requires OFAC license approval—most nonprofits can't get one.

FATF Gray List (Jurisdictions Under Increased Monitoring): Countries with strategic AML/CFT deficiencies. Recent additions have included Spain, Italy, and Panama. Transactions here require enhanced due diligence.

FATF Black List (High-Risk Jurisdictions): Countries with severe deficiencies. Currently includes only a handful. Transacting requires specific approvals.

What "Enhanced Due Diligence" Means for Nonprofits

If you're working in a FATF-flagged country:

• More detailed partner background checks
• Verification of beneficial ownership beyond the organization itself
• Documentation of legitimate business purpose (your grant agreement serves this)
• More frequent transaction monitoring and re-screening
• Clear audit trail showing grant was used for stated program

You don't need to avoid high-risk countries—you just need to document your due diligence more thoroughly.

Comprehensive International Partner Vetting Framework

This is where theory meets practice. Here's a repeatable process your nonprofit can implement today.

The Partner Vetting Checklist

Phase 1: Initial Screening (Before Signing Agreement)

• □ Partner questionnaire completed and signed
• □ OFAC/SDN search conducted; results documented
• □ Internet search for name, mission, leadership (Google, social media, news)
• □ Beneficial ownership structure understood and documented
• □ Registration/incorporation documents reviewed (if accessible)
• □ References from other organizations checked (phone calls, not emails)

Phase 2: Risk Assessment (Categorize Accordingly)

Based on Phase 1 findings, classify partner as:

• Low Risk: Established organization with clear history, transparent leadership, no red flags. Annual re-screening sufficient.
• Moderate Risk: Newer organization, limited history, operates in developing country, or some missing documentation. Quarterly OFAC re-screening; more detailed transaction monitoring.
• High Risk: Limited documentation, operates in FATF-flagged country, beneficial ownership unclear, or prior compliance concerns. Monthly OFAC re-screening, board approval required before disbursement, detailed transaction reports required.

Phase 3: Ongoing Monitoring (During Partnership)

• □ Disbursement made only after partner provides bank account verification
• □ Grant agreement specifies compliance requirements and audit rights
• □ Regular communication with partner about fund use (monthly for high-risk, quarterly for moderate)
• □ Documentation that funds were used for stated program (receipts, reports, photos, testimonials)
• □ OFAC re-screening conducted at least annually
• □ Any changes in partner leadership or structure trigger re-screening

Sample Partner Questionnaire Questions

Common International Compliance Failures (And How to Avoid Them)

Auditors have seen the same mistakes repeatedly. Learning from others' failures is the fastest path to compliance.

Failure #1: Inadequate OFAC Screening

The Mistake: A nonprofit screened a partner's organization against OFAC but failed to screen the individual who would receive wire transfers.

Result: Funds went to a designated individual. The nonprofit faced $45,000 in civil penalties and had to recover and return the grant to the funder.

Lesson: Screen both the organization AND any individual who will receive funds or control accounts.

Failure #2: No Documentation Trail

The Mistake: A nonprofit verbally confirmed with a partner that they'd screened them. When audited, they had no screenshots, forms, or records.

Result: Auditors couldn't verify screening occurred. The nonprofit was required to conduct retroactive due diligence and explain the gap.

Lesson: Always document. Screenshots of OFAC searches, saved emails, signed questionnaires—these prove compliance occurred.

Failure #3: Never Re-Screening

The Mistake: A nonprofit screened a partner in year one but never re-screened. In year three, that partner's founder appeared on an OFAC list. The nonprofit didn't know.

Result: Continued funding to a sanctioned partner. Grant termination and penalties.

Lesson: Re-screen partners at least annually. Set calendar reminders. For high-risk countries, screen quarterly.

Failure #4: Vague Grant Agreements

The Mistake: A nonprofit gave a partner $500,000 with minimal reporting requirements about how funds were used.

Result: Partner used funds for undocumented activities. Auditor flagged it. Nonprofit couldn't prove compliance with program requirements.

Lesson: Grant agreements must specify: compliance certifications, reporting requirements, audit rights, and consequences for non-compliance.

Failure #5: No Risk Assessment

The Mistake: A nonprofit applied identical due diligence to a $1,000 grant and a $500,000 grant to high-risk countries.

Result: Auditor flagged inconsistent risk management. Nonprofit's process appeared arbitrary.

Lesson: Risk-based approach: higher risk (amount, country, transparency) = more due diligence. Document your risk classification.

Failure #6: Ignoring Red Flags

The Mistake: A partner requested wire transfers to a third country, citing "banking issues." The nonprofit proceeded without additional documentation.

Result: Funds diverted. Investigation revealed the third-country account belonged to a designated entity.

Lesson: Red flags exist for a reason. When something seems off, ask more questions. Delayed due diligence is faster than civil penalties.

Free Resources, Tools & Further Learning

You don't need paid consultants or expensive software to start. These free resources will get you 80% of the way there.

Recommended Reading Order

1. Start: OFAC "NGO FAQs" (15 minutes)
2. Then: FinCEN's AML Guidance for Nonprofits (20 minutes)
3. Then: FATF's Know Your Customer Guidelines (30 minutes)
4. Then: Design your own questionnaire (60 minutes)
5. Then: Implement and train staff (ongoing)

Key Takeaways: Your International Compliance Checklist