Supplier Added to a Sanctions List Mid-Contract: What to Do

On January 10, 2025, OFAC designated 37 individuals, 203 entities, and 184 vessels linked to Russia's energy sector in a single action. Five days later, another 250 parties followed (Treasury.gov). Civil penalties for sanctions violations have already exceeded $254 million in 2025 (Cogency Global analysis, December 2025). When a supplier you're actively doing business with lands on the SDN list mid-contract, the clock starts running immediately. Not next month when you get around to reviewing contracts. Today.

Key Takeaways

• OFAC wind-down general licenses typically provide 30-45 days to complete existing transactions; the October 22, 2025 Rosneft/Lukoil designations allowed only 30 days through November 21, 2025 (Treasury.gov, GL 126)
• Voluntary self-disclosure reduces base penalties by up to 50% for non-egregious cases (31 CFR Part 501, Appendix A, January 2025)
• The statute of limitations for OFAC civil and criminal violations extended from 5 to 10 years in April 2024; record-keeping requirements now match this period effective March 12, 2025 (21st Century Peace through Strength Act)
• GVA Capital paid $215,988,868 in June 2025 for continuing to manage a sanctioned oligarch's investments after designation—the third-largest OFAC penalty since 2019 (Treasury.gov, June 16, 2025)

What Happens the Moment Your Supplier Is Designated?

All transactions with that entity become prohibited immediately. The prohibition isn't limited to future orders; it covers payments on existing invoices, shipments in transit, and services being rendered under current contracts. The SDN designation freezes everything unless OFAC issues a general license authorizing specific activities.

OFAC sometimes issues wind-down authorizations alongside new designations. When Rosneft and Lukoil hit the SDN list on October 22, 2025, OFAC simultaneously released General License 126 authorizing transaction wind-down through November 21, 2025. But wind-down licenses aren't guaranteed. For many designations, particularly individual SDN additions or smaller entities, there's no grace period at all.

The practical problem for compliance teams: you need to catch the designation before your next payment runs. Your accounts payable team probably isn't checking OFAC updates daily. That's exactly how violations happen—not from intentional sanctions evasion, but from batch payments processing on Tuesday when the designation dropped Monday afternoon. I've watched this play out three times in the past year. Same story each time: designation hits Friday, wire goes out Monday, phone call from the bank Tuesday asking why you're sending money to an SDN.

Does Force Majeure Get You Out of the Contract?

Short answer: probably not. Force majeure clauses may excuse non-performance, but sanctions designation rarely qualifies automatically. Most courts require the invoking party to demonstrate the event was unforeseeable at contract formation and that no alternative performance exists. US courts have generally held that foreseeable regulatory risks—including sanctions—don't meet this standard unless the contract specifically lists sanctions as a force majeure event. Chinese courts have been even less forgiving; a 2020 Sichuan Province case rejected a sanctions-based force majeure claim because alternative payment routes existed.

The better contractual protection is a dedicated sanctions clause. A proper clause should include representations that neither party is designated or owned by a designated person, ongoing screening obligations, notification requirements if either party becomes designated, and termination rights triggered by designation. Without these provisions, you're arguing force majeure or impossibility in court rather than exercising a clean termination right. And litigation takes 18 months minimum while your supply chain bleeds.

Here's what most contracts miss: the 50% ownership rule. OFAC's "50 Percent Rule" means any entity owned 50% or more by one or more blocked persons is itself blocked, even if that entity never appears on the SDN list by name. Your supplier's parent company gets designated, and suddenly your supplier is blocked by operation of law. Standard sanctions representations don't always capture this downstream exposure. The October 2025 Rosneft and Lukoil designations caught dozens of subsidiaries this way—entities that had never appeared on any watchlist suddenly became untouchable overnight.

How Do You Handle Existing Inventory and Payments?

Any goods you've received and paid for are yours. The prohibition targets new transactions and transfers, not property already lawfully acquired. Inventory on your shelves from pre-designation purchases can be sold, used, or disposed of normally.

Unpaid invoices are the problem. If goods shipped before designation but payment hasn't cleared, you need authorization to pay.

Absent a wind-down general license, you'll need to apply for a specific license from OFAC explaining the transaction timeline and requesting authorization to complete payment. These applications take 90-120 days on average—longer than most suppliers will wait for payment.

Goods in transit create a messier situation. If your supplier shipped product before designation but it hasn't cleared customs, the shipment may be detained. Customs can and does hold shipments pending OFAC clarification. I've seen medical device shipments sit in bonded warehouses for six weeks while the importer sorted out whether a newly designated shipping company's prior involvement blocked the entire supply chain.

What Should You Do in the First 72 Hours?

Stop all payments and shipments immediately. Don't wait for legal review to confirm the designation—your compliance team can verify within hours using OFAC's Sanctions List Search. Get a payment hold in place while you assess exposure. This sounds obvious, but I've seen companies debate internally for a week while payments continued to process. That week cost one client $340,000 in additional violation value.

Document the timeline obsessively. OFAC enforcement actions always examine when the company knew or should have known about the designation. The Interactive Brokers settlement in July 2025 covered violations spanning July 2016 to January 2024—OFAC had records going back eight years. With the new 10-year statute of limitations and matching record-keeping requirements effective March 12, 2025, your documentation window just doubled.

Screen your entire supplier database, not just the flagged entity. Designations often come in batches targeting affiliated companies, shell entities, and related individuals. The January 10, 2025 Russia sanctions package hit Gazprom Neft and Surgutneftegas simultaneously with over 180 associated vessels and dozens of trading companies. Screening only the named entity misses the broader exposure.

Assess whether voluntary self-disclosure makes sense. If you've already made payments after designation—even unknowingly—consider filing a VSD with OFAC. The 50% penalty reduction for timely voluntary disclosure is substantial. GVA Capital's $215 million penalty reflected the statutory maximum partly because they didn't self-disclose and didn't cooperate. Interactive Brokers self-disclosed 12,367 violations across multiple sanctions programs and settled for $11.8 million—a fraction of the potential $5.2 billion maximum. That's a 99.8% reduction. The math on disclosure is pretty clear.

How Do You Find an Alternative Supplier Under Time Pressure?

The compliance-first instinct is to find a clean replacement immediately. The operational reality is that supplier switching takes 3-6 months for qualified vendors in most manufacturing contexts. That timeline doesn't shrink because sanctions pressure accelerated your need.

Start with your backup supplier list—if you have one. Most mid-market exporters maintain informal "plan B" relationships for their top 10-15 suppliers. For sanctioned suppliers outside that list, you're essentially starting from scratch: identifying candidates, running qualification audits, negotiating terms, establishing credit, and validating quality.

The screening burden doubles during this process. New supplier onboarding requires sanctions screening, but rushed onboarding under pressure is exactly when screening shortcuts happen. The replacement supplier needs the same denied party screening you should have been running on your original supplier—against OFAC, BIS Entity List, EU Consolidated List, and any jurisdiction-specific lists your business requires. Consolidated watchlist platforms reduce this burden from days to minutes, but only if you actually run the screen before signing the contract.

The uncomfortable truth: some supplier relationships can't be replaced quickly. Specialized component manufacturers, sole-source suppliers, or long-lead-time materials may require production line changes that take six months or longer. Factor this into your supply chain risk assessments before designation happens, not after.

FAQ

What's the penalty for unknowingly paying a sanctioned supplier?

OFAC civil penalties reach $377,700 per violation or twice the transaction value, whichever is greater, under the January 2025 inflation-adjusted maximums (31 CFR 501.701). Criminal penalties for willful violations can reach $1 million per violation and 20 years imprisonment. "Unknowing" violations still incur civil liability—intent affects penalty calculation, not whether a violation occurred.

How quickly does OFAC update the SDN list after designation?

OFAC publishes SDN additions in the Federal Register and updates the online Sanctions List Service the same day as designation. Commercial screening providers lag by 4-24 hours for major designations and up to 14 days for routine additions. Running sanctions screening directly against OFAC's Sanctions List Service eliminates that database provider lag, though most commercial tools now update within 4-8 hours for high-profile designations.

Can I get a license to continue business with a sanctioned supplier?

OFAC issues specific licenses for transactions that would otherwise violate sanctions regulations. Applications require demonstrating a legitimate business purpose and are evaluated against U.S. foreign policy objectives. Processing takes 90-120 days on average. Russia-related licenses face heightened scrutiny under current policy; humanitarian licenses for programs like Syria historically have more established pathways. Wind-down licenses issued alongside major designations—like GL 126 for Rosneft/Lukoil—provide faster relief but only for limited periods.

Do I need to screen suppliers against lists beyond OFAC?

Yes, if you have exposure to non-US jurisdictions. EU banking relationships require screening against the EU Consolidated List. UK subsidiaries trigger OFSI screening obligations under the UK Russia Sanctions Regulations. Australian sanctions apply separate DFAT lists. Multi-jurisdictional screening isn't optional for companies with international banking relationships—a supplier clean under OFAC may still be designated under EU or UK programs. The overlap is roughly 60% for Russia-related designations; the remaining 40% creates real exposure.

The operational burden of mid-contract supplier designation falls heaviest on companies running weekly batch screening. Continuous monitoring catches designations before the next transaction processes; batch screening catches them eventually—and "eventually" might mean after you've wired payment or shipped product. The companies that avoid enforcement actions aren't necessarily better at sanctions compliance; they're faster at catching designations. Speed is the differentiator. Platforms that aggregate multiple watchlists—Lenzo, Descartes, Dow Jones Risk & Compliance—reduce screening time from hours to seconds. But the underlying problem isn't technology. It's organizational: your payments team needs to know that no wire goes out without a same-day screen, and your contracts need termination rights that don't depend on a judge's interpretation of force majeure.