Red Card From OFAC: Civil Penalty for Private Secondary School Highlights Sanctions Risks in Education

The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) recently announced a $1.7 million civil penalty against a private secondary school and athletic training institution in Florida. According to OFAC, this institution entered into tuition and enrollment agreements with, and received payments from, two individuals designated on OFAC’s Specially Designated Nationals and Blocked Persons (SDN) List, whose children attended the institution.

This action underscores that any educational institution that enrolls international students, accepts payments from outside the U.S., or otherwise interacts with non‑U.S. persons — whether a K‑12 school, specialized academy, camp, or university — can be exposed to sanctions risk and should develop a “risk-based” OFAC compliance program.

Likely Reasons for the Significant Penalty in This Case

OFAC expects a sanctions compliance program to be commensurate with, and specifically responsive to, the risks presented in each situation. This institution attracted many international student-athletes because of its full-time boarding opportunities, professional training programs, and college sports recruiting resources. The institution likely had a relatively high sanctions risk profile due to its heavy exposure to foreign students and parents. As a result, OFAC would have had relatively high expectations for this institution in terms of compliance.

According to OFAC, the institution entered into six tuition enrollment agreements, three with each SDN, for their children’s participation in its programs. In addition, the institution received payments for these students’ enrollment by credit card as well as wire transfers initiated by nondesignated third‑party individuals and entities in Mexico. Third-party payment is often a red flag, as SDNs typically have significant challenges accessing the international banking system. This institution’s risk profile thus was further elevated as a result of these third-party transactions.

The sanctioned individuals were expressly identified in the enrollment agreements, and their names matched the entries on OFAC’s SDN List. Despite that facial violation, the institution apparently did not conduct any screening and did not identify the sanctions issue.

The significant penalty in this case also likely reflects the fact that this institution did not take even the first step in sanctions compliance — consulting the SDN List, which contained the names of both parents.

Best Practices

Educational institutions with international exposure can manage sanctions risk by implementing a risk-based compliance framework. Some of the key best practices can include:

• Adopting a formal sanctions compliance policy;  
• Identifying specific individuals with responsibility for carrying out the policy, and ensuring proper training;  
• Conducting a basic risk assessment to identify the types of transactions with the greatest potential OFAC exposure (e.g., international students, payments from foreign bank accounts, etc.);  
• Refining the risk assessment to pinpoint the higher-risk cases that warrant closer scrutiny;  
• Having a process for restricted party and sanctioned country/territory screening at appropriate stages, as a function of risk (e.g., onboarding, billing, and payment processing); and  
• Considering whether the screening should be manual or automated, daily/ongoing, or only prior to key transactions, along with other details such as which lists to screen, whether/when to conduct additional due diligence prior to screening, etc.  

This OFAC penalty is an important reminder that sanctions compliance is not confined to banks and multinational corporations. Nor is it an issue only for sophisticated universities. Any institution with international exposure should develop, implement, and periodically refine a risk-based sanctions compliance program.

Troutman Pepper Locke’s Sanctions + Trade Control team regularly advises educational institutions and other nontraditional actors on practical, right‑sized sanctions compliance programs and can assist with risk assessments, policy design, training, and response strategies when potential issues are identified.