If your sanctions program is still the 2019 version, it’s missing the last seven years of enforcement.

OFAC’s 2019 framework is still your foundation: management commitment, risk assessment, internal controls, testing, and training. But DOJ, Commerce, and Treasury have layered new expectations on top of that through joint Tri-Seal Notes.

Four of them should be on your list today.

One, U.S. nexus now reaches foreign companies that touch U.S. clearing, U.S. servers, or U.S.-origin components, and parent companies answer for their foreign subsidiaries. Centralize your program.

Two, voluntary self-disclosure under BIS rules. Staying silent about a significant violation is now an aggravating factor. Silence is no longer neutral.

Three, know your cargo. Watch transshipment through hubs like Hong Kong, Turkey, and the UAE, last-minute shipping changes, and shell companies.

And fold export controls into your sanctions risk assessment rather than running them as separate work streams.

Four, OFAC’s statute of limitations is now 10 years, not five. If your records retention stops at five, your program has a gap.

Don’t replace the 2019 framework. Build on it.

The Ethics and Compliance Q and A show is produced by One Stone Creative.