An Updated Look at OFAC Enforcement Actions

What this is: A brief update on how OFAC enforcement has intensified in 2025, with larger penalties, expanded recordkeeping rules and a broader focus that now includes cybercrime and human-rights-linked financial activity.

What this means: Companies must treat sanctions compliance as a long-term, multidisciplinary risk area; updating controls, documentation and monitoring to account for older transactions, new exposure types and higher regulatory expectations.

In 2025, thousands of Americans were lured into a virtual currency scam run from Shwe Kokko, Burma. Trafficked workers, forced to operate the scheme under threat, funneled victims’ money to platforms controlled by sanctioned operators like She Zhijiang and Karen National Army-linked entities in the “Yatai New City” compound. The case underscores the real human and financial costs of cross-border crime, and how sanctions now intersect with human rights.

Since we last covered OFAC’s compliance framework in 2019, sanctions enforcement has grown more rigorous. In 2024, OFAC issued 12 actions totaling about $48.8 million (a decline from 2023) but the agency remained focused on foreign companies routing transactions through the U.S. to sanctioned parties. As of this post, 2025 civil penalties have already exceeded $254 million, including a $4.68 million penalty against a U.S. real-estate investor for dealings with property owned by a blocked Russian oligarch. Other multi-million-dollar 2025 cases involve logistics, trading, and manufacturing sectors with ties to Russia, Iran, Cuba, and other high-risk jurisdictions.

Beyond enforcement actions, OFAC has also raised compliance expectations. A major change took effect in March 2025, extending sanctions-related record-keeping requirements from five to ten years, a clear signal that the agency expects companies to maintain long-term, well-documented compliance programs. 

Perhaps the most striking change is the widening scope of sanctions activity. OFAC is now targeting areas far beyond traditional export controls or dealings with sanctioned governments. Recent designations include a China-based hacker involved in compromising U.S. critical-infrastructure networks, as well as networks behind cyber scams and forced-labor operations, such as the one based in Shwe Kokko. These actions highlight a growing intersection between sanctions, cybersecurity, financial crime and human rights risks.

What Companies Should Take Away

• Think long-term. With 10-year record retention and an expanded statute of limitations, older transactions are now firmly within OFAC’s review window.

• Update your risk models. Exposure now includes real-estate deals, cyber activity, data handling and human-trafficking-linked operations; not just classic trade or financial flows.

• Make compliance continuous. Ongoing training, refreshed risk assessments, clear ownership of compliance roles, and proactive diligence are essential as OFAC’s expectations evolve.

The Shwe Kokko case illustrates why these updates matter. Beyond financial penalties, OFAC is actively dismantling transnational criminal networks, protecting U.S. citizens from large-scale fraud and addressing human rights abuses tied to forced labor. 

Overall, the recent enforcement landscape signals a broader, more assertive OFAC. Companies subject to U.S. jurisdiction should be prepared for an environment where sanctions compliance is more complex, multidisciplinary and scrutinized than ever.

This content is provided for informational purposes only and should not be considered, or relied upon, as legal advice.