The OFAC Cautionary Letter is one of five enforcement responses formally enumerated by the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) in its Economic Sanctions Enforcement Guidelines, codified at 31 C.F.R. Part 501, Appendix A. Promulgated in their current form on November 9, 2009, the Guidelines establish a graduated continuum of responses to apparent violations of sanctions administered under statutes including the International Emergency Economic Powers Act (IEEPA, 50 U.S.C. §§ 1701–1708), the Trading with the Enemy Act (50 U.S.C. §§ 4301 et seq.), and program-specific authorities such as the Cuban Liberty and Democratic Solidarity Act of 1996. The Cautionary Letter sits above the issuance of "No Action" determinations but below Findings of Violation and civil monetary penalties, providing OFAC with a calibrated instrument for cases where enforcement action is warranted but punitive measures would be disproportionate.
Procedurally, a Cautionary Letter arises after OFAC's Enforcement Division reviews an apparent violation, whether disclosed voluntarily by the subject under the Voluntary Self-Disclosure framework of the Guidelines, referred from a financial regulator, surfaced through a blocked-property report under 31 C.F.R. § 501.603, or discovered via subpoena under § 501.602. Caseworkers apply the eleven General Factors Affecting Administrative Action — including willfulness, awareness of conduct, harm to sanctions program objectives, individual characteristics, compliance program quality, remedial response, and cooperation with OFAC. When the aggregate factor analysis indicates that the conduct, though violative, does not warrant a Finding of Violation or penalty, the Director's office authorizes issuance of the letter, which is transmitted directly to the subject's compliance officer or counsel.
The letter itself is brief — generally one to three pages — and contains four substantive elements: identification of the transactions or conduct at issue, the specific regulatory citation believed to have been violated (for example, 31 C.F.R. § 560.204 of the Iranian Transactions and Sanctions Regulations), an explicit statement that OFAC will take no further enforcement action at that time, and a cautionary directive to enhance compliance controls. Critically, the letter does not constitute a final agency determination that a violation occurred. It is not published on OFAC's website, does not appear in the Recent Actions enforcement releases, and is not citable as precedent. However, it is retained in OFAC's internal case files and may be referenced as evidence of prior notice should the recipient commit similar violations subsequently — converting what was once first-offense conduct into aggravated repeat behavior under General Factor E.
Contemporary practice illustrates the instrument's reach. Mid-sized U.S. community banks that processed wire transfers benefitting nationals of sanctioned jurisdictions — through correspondent relationships rather than direct customer engagement — have routinely received Cautionary Letters when the dollar amounts were modest, the underlying conduct non-egregious, and remediation prompt. Insurance underwriters in London and Zürich whose policies inadvertently covered cargo touching Cuban or Iranian ports have received them following voluntary disclosure to OFAC's Enforcement Division at the Annex Building on Pennsylvania Avenue. Technology firms that exported software with cryptographic functions to end-users later identified as Specially Designated Nationals have similarly closed matters via Cautionary Letter when the export occurred before SDN designation but shipment continued briefly thereafter.
The Cautionary Letter must be distinguished from adjacent enforcement outputs. A No Action Letter indicates OFAC concluded insufficient evidence exists that a violation occurred, or that the conduct was not violative — it is exculpatory in tone. A Finding of Violation, by contrast, is a formal written determination that a violation did occur; it is published, creates reputational consequences, and constitutes precedent the subject cannot relitigate. A Pre-Penalty Notice under 31 C.F.R. § 501.708 initiates the formal civil penalty process and triggers response rights. The Cautionary Letter occupies the middle band: more serious than No Action, less consequential than a Finding, and procedurally distinct from the penalty track. It is also separate from referral to the Department of Justice for criminal prosecution under 50 U.S.C. § 1705(c).
Several controversies attend the instrument. Because the letter is non-public, civil society organizations including the Washington-based Project on Government Oversight have questioned whether the volume of Cautionary Letters obscures the true incidence of sanctions violations from public view. Defense counsel debate whether receipt of a letter should be disclosed in subsequent merger due diligence or in securities filings under Item 105 risk factors. The 2019 "A Framework for OFAC Compliance Commitments" did not directly address letter treatment, leaving practitioners to negotiate disclosure obligations contractually. Following the Russia sanctions escalation after February 24, 2022, and the expansion of Directives under Executive Order 14024, OFAC's caseload increased substantially, and practitioners report a corresponding rise in Cautionary Letter issuance for transactions in the immediate weeks after new designations when counterparty screening lagged.
For the working compliance officer, general counsel, or sanctions practitioner, the Cautionary Letter is the most consequential non-penalty outcome OFAC can produce. Receipt obligates immediate review of screening systems, recalibration of risk assessments under the Framework's five essential components, and preservation of the letter in compliance files for a minimum of five years under 31 C.F.R. § 501.601 recordkeeping requirements. For diplomatic and policy audiences, understanding the instrument illuminates how the United States calibrates extraterritorial economic coercion: not every apparent violation produces a press release, and the silent architecture of cautionary correspondence shapes the conduct of foreign financial institutions, exporters, and service providers far beyond what the published enforcement docket reveals.
Example
In 2019, a U.S. regional bank received an OFAC Cautionary Letter after self-disclosing that it had processed several wire transfers referencing a Sudanese counterparty during the wind-down period of the Sudanese Sanctions Regulations.