Most businesses assume OFAC sanctions compliance is a bank problem. IMG Academy's $1.72 million settlement shows otherwise: a school paid to resolve 89 apparent violations after contracting with, and taking tuition from, two sanctioned individuals tied to a Mexican drug cartel.
IMG Academy agreed to pay $1,720,000 to OFAC on February 12, 2026, for 89 apparent violations of counternarcotics sanctions
Correction, November 4, 2026: An earlier version of this article misdescribed this case, including the settlement amount, the sanctions program, the dates and the conduct. This version is based on OFAC's February 12, 2026 enforcement release.
The counterparties were two SDNs sanctioned under the Kingpin Act for ties to a Mexican drug cartel, and they signed tuition agreements for their children
On February 12, 2026, the Office of Foreign Assets Control (OFAC) announced that IMG Academy, LLC, a school and athletic training facility headquartered in Bradenton, Florida, agreed to pay $1,720,000 to settle its potential civil liability for apparent violations of OFAC counternarcotics sanctions. OFAC said that over five consecutive years the school repeatedly transacted with two individuals sanctioned for their ties to a Mexican drug cartel.
OFAC found reckless disregard, including a failure to screen counterparties whose names matched the SDN List
The case is a useful one for non-banks because of how ordinary the transactions looked. The two individuals were Specially Designated Nationals (SDNs), sanctioned under the Foreign Narcotics Kingpin Designation Act. Between 2018 and 2022 they entered into yearly tuition enrollment agreements with IMG Academy for their two student-athlete children. Each agreement made the parent unconditionally responsible for the child's account, which covered tuition, lodging and related charges.
The case was non-egregious and not voluntarily self-disclosed, and OFAC credited cooperation, remediation and the absence of recent violations
Payment did not come only from the SDNs themselves. According to OFAC, the obligations were primarily satisfied through third-party wire transfers from non-designated individuals and entities, primarily located in Mexico, and through credit cards on file. The school also rolled positive year-end balances into the next academic year.
Sanctions exposure turns on who your counterparty is, so screen the people who pay you as well as the people you serve
OFAC counted 89 apparent violations of 31 C.F.R. § 598.202, the Foreign Narcotics Kingpin Sanctions Regulations, between 2019 and 2025: three agreements with each SDN and 83 transactions to satisfy tuition and related obligations. OFAC found the case non-egregious and not voluntarily self-disclosed. IMG Academy told OFAC about the apparent violations as soon as it became aware of them, but OFAC had already opened an investigation. The base penalty and the settlement amount were both $1,720,000.
Third-party payments can hide the real counterparty, which is a particular risk for schools and similar businesses
OFAC's aggravating factors explain what went wrong. It found reckless disregard for U.S. sanctions requirements, including a failure to conduct sanctions screening on counterparties. The SDNs gave full names that matched their SDN List entries during the application process, at enrollment and on each agreement, and OFAC said minimal due diligence at any point would have revealed they were sanctioned. IMG Academy may not have known the individuals were sanctioned, but it knew of the underlying transactions, because it contracted with, invoiced and communicated with the SDNs by name. OFAC also noted that the conduct gave designated individuals access to U.S. commerce and the U.S. financial system.
OFAC suggests management commitment, a risk assessment, screening of students, counterparties and payors, independent testing and training
OFAC's mitigating factors were that IMG Academy had received no Penalty Notice or Finding of Violation in the five years before the earliest transaction, that it took immediate remedial steps and implemented a risk-based sanctions compliance program, including a comprehensive lookback led by a new Chief Legal Officer, and that it cooperated by responding to requests for information and agreeing to toll the statute of limitations.
What should non-bank businesses take from this? First, sanctions rules apply to U.S. persons generally, not only to financial institutions. OFAC described the case as highlighting the pervasiveness of sanctions risk across sectors and institutions, and said that even entities operating largely domestically can have international touchpoints that create exposure.
Second, the risk turned on who the counterparties were, not on their nationality. A customer's nationality alone does not tell you whether a transaction is prohibited. The people who pay you, sign your contracts or stand behind an account can be the sanctioned party even when the person you serve is not. Screening only the customer, or only by country, would not have addressed this case.
Third, third-party payments deserve attention. OFAC pointed out that academic institutions face unique risks because of the variety of parties who may satisfy a student's financial obligations. The same is true of any business where someone other than the customer can pay the bill.
OFAC suggested practical steps for academic institutions that other businesses can adapt. Start with management commitment and a comprehensive risk assessment. As a starting point, it may be advisable to screen students, counterparties to tuition agreements and payors against the SDN List, and to use available information to understand whether associated parties are located in a comprehensively sanctioned jurisdiction or have ties to a sanctioned person or entity. Then decide whether the activity is exempt or authorized, or whether to apply for a specific license. OFAC also said institutions may wish to conduct regular independent testing and auditing, and to train relevant personnel.
OFAC's civil liability can apply without fault. Under the International Emergency Economic Powers Act the civil maximum is the greater of $377,700 or twice the transaction value, and other programs have their own limits, including the Kingpin Act program in this case. For most non-banks, the right response is a program sized to actual risk: a written policy, screening of customers and payors, a process for escalating possible matches, training for the staff who onboard and bill customers, and periodic review.
Further Reading
FinCEN Proposes Whistleblower Rule: What It Means for Your Business
OFAC violations are a covered category under FinCEN's new whistleblower program - another reason to close compliance gaps proactively.
What Is a FinCEN Gap Analysis?
If your business lacks an OFAC screening program, a gap analysis will identify that deficiency alongside any BSA program gaps.
Questions to Ask Before Hiring an AML Compliance Firm
OFAC compliance program design is a core capability any qualified compliance firm should be able to deliver - here's how to vet them.
Tags
OFAC SanctionsOFAC ComplianceIMG AcademySanctions EnforcementNon-Bank ComplianceSDN ListCounternarcotics SanctionsKingpin ActThird-Party PaymentsAML Compliance
SC
Soflo Consulting Team
AML/BSA Compliance Insights Team · Soflo Consulting
114 more articles
Soflo Consulting
Soflo Consulting Team publishes BSA/AML compliance analysis for regulated businesses across the United States. The team covers regulatory enforcement actions, FinCEN guidance, risk assessment, and emerging compliance obligations for banks, money services businesses, mortgage lenders, fintechs, and other covered institutions.
BSA/AML ProgramsRegulatory Enforcement AnalysisRisk AssessmentCompliance Training
View author profile & all articlesCompliance Strategy
In This Article
7 sections
Key Takeaways
- 1IMG Academy agreed to pay $1,720,000 to OFAC on February 12, 2026, for 89 apparent violations of counternarcotics sanctions
- 2The counterparties were two SDNs sanctioned under the Kingpin Act for ties to a Mexican drug cartel, and they signed tuition agreements for their children
- 3OFAC found reckless disregard, including a failure to screen counterparties whose names matched the SDN List
- 4The case was non-egregious and not voluntarily self-disclosed, and OFAC credited cooperation, remediation and the absence of recent violations
- 5Sanctions exposure turns on who your counterparty is, so screen the people who pay you as well as the people you serve
- 6Third-party payments can hide the real counterparty, which is a particular risk for schools and similar businesses
- 7OFAC suggests management commitment, a risk assessment, screening of students, counterparties and payors, independent testing and training
Need Expert Guidance?
Put these insights into action. Talk to a compliance professional at Soflo Consulting compliance specialist.
Stay Ahead of Compliance
Get FinCEN updates, BSA/AML guidance, and federal compliance news delivered to your inbox - no fluff.
