OFAC's $1.7 million settlement with IMG Academy confirms that sanctions compliance obligations apply to all U.S. businesses with international counterparties - not just financial institutions

On February 12, 2026, the U.S. Department of the Treasury's Office of Foreign Assets Control announced a $1,735,244 settlement with IMG Academy LLC, the internationally recognized sports training institution headquartered in Bradenton, Florida. The settlement resolved OFAC's investigation into IMG Academy's acceptance of tuition and enrollment payments from individuals who were nationals of sanctioned countries - Iran and Cuba - between 2017 and 2020. The case was not about financial crime in the traditional sense. It was about a school accepting money for a legitimate service from people it was legally prohibited from doing business with.

IMG Academy accepted over $1 million in tuition payments from Iranian and Cuban nationals without an OFAC screening program in place

That distinction matters enormously for how every non-bank business in America should be thinking about OFAC sanctions compliance. IMG Academy is not a bank. It is not a money services business. It does not process wire transfers for third parties or hold customer deposits. It is an elite sports academy that accepts tuition payments for athletic training programs. And OFAC fined it $1.7 million for accepting those payments from the wrong people. The lesson for businesses that have assumed OFAC compliance is someone else's problem is clear: it is not.

OFAC credited full cooperation, voluntary remediation, and no prior violations - reducing the penalty from a potential $75M+ statutory maximum to $1.7M

What exactly did IMG Academy do wrong? According to OFAC's published enforcement information, IMG Academy accepted payments totaling approximately $1,069,887 from Iranian and Cuban nationals who enrolled in its training programs. The payments were processed over a multi-year period, and the individuals involved were attending programs for tennis, soccer, baseball, and other sports. On the surface, these were entirely ordinary tuition transactions - a school accepting payment for instruction. The legal problem was that the individuals making those payments were nationals of countries subject to comprehensive U.S. sanctions programs, and accepting any payment from a sanctioned-country national - regardless of the nature of the transaction - violated OFAC regulations.

Any U.S. business transacting with international customers, students, clients, or vendors has potential SDN list and country-sanctions exposure

The Iran sanctions program and the Cuba sanctions program, both administered by OFAC under the authority of the International Emergency Economic Powers Act and related statutes, prohibit U.S. persons from engaging in virtually any transaction involving the property or interests in property of sanctioned-country nationals. The word "virtually" carries important weight here: both programs include specific licenses and exemptions, and some transactions - including certain educational services - may be permissible under specific conditions. But the existence of licensing pathways means nothing for a business that does not know those pathways exist, has not sought licenses, and has not built a screening program capable of identifying when its customers might be sanctioned-country nationals.

A risk-based OFAC compliance program includes written policy, customer screening, match escalation procedures, employee training, and regular program review

That is exactly the situation OFAC found IMG Academy to be in. The school did not have an OFAC screening program for its international student applicants. It did not have policies and procedures that required collecting and verifying nationality information for OFAC compliance purposes. It did not train its enrollment and admissions staff to recognize when an applicant's country of origin or passport nationality might create OFAC exposure. And crucially, it did not seek specific licenses from OFAC for the transactions that might have been permissible under a licensing structure. The result was a multi-year pattern of sanctions violations that the school was entirely unaware of - and that OFAC identified through its own investigative processes.

Educational institutions have specific OFAC licensing considerations - general licenses exist for some educational transactions involving sanctioned-country nationals, but they do not apply universally

OFAC's analysis of aggravating and mitigating factors in the IMG Academy case provides a useful framework for understanding how the agency evaluates non-bank sanctions violations. On the aggravating side, OFAC noted that the violations occurred over an extended period - approximately three years - and that they involved multiple transactions totaling over a million dollars. OFAC also noted that IMG Academy is a sophisticated commercial enterprise with substantial international operations, and that businesses of its size and complexity are expected to maintain compliance programs proportionate to their exposure. The school's deep engagement with international markets - it recruits student-athletes from across the globe and maintains relationships with foreign sports academies, agents, and families - created a sanctions exposure profile that a sophisticated compliance program should have identified and addressed.

Professional services firms - law firms, consultancies, accounting firms - face the same OFAC exposure as commercial businesses and are increasingly in OFAC's enforcement crosshairs

On the mitigating side, OFAC credited IMG Academy for several factors that meaningfully reduced the penalty from its statutory maximum. The school cooperated fully and promptly with OFAC's investigation. It had no prior OFAC violations and no history of sanctions-related enforcement. It took significant remediation steps after discovering the violations, including implementing a comprehensive OFAC compliance program covering its admissions and enrollment processes. And OFAC acknowledged that the school's apparent violations were non-willful - the school did not knowingly accept payments from sanctioned-country nationals; it simply lacked the compliance infrastructure to know that it was doing so. These mitigating factors reduced a potential maximum penalty of over $75 million to a final settlement of $1.7 million, but they did not eliminate the violation or the penalty.

Non-willful violations still carry meaningful penalties. The absence of a compliance program is the finding, not a defense

The OFAC penalty was substantial enough to command attention, but the full cost of the IMG Academy case extends far beyond the settlement amount. Legal fees, compliance remediation costs, the operational burden of implementing a new OFAC screening program, and the institutional reputational consequences of a federal enforcement action are all real costs that do not appear in the published settlement figure. For a business operating in an industry - elite private sports education - where trust, prestige, and institutional reputation are core competitive assets, an OFAC enforcement action is a materially damaging event regardless of the dollar amount.

What should non-bank businesses take from this case? The first and most important lesson is that OFAC sanctions compliance is not optional for any U.S. business that has international customers, partners, vendors, or counterparties. The sanctions programs administered by OFAC - which cover Iran, Cuba, North Korea, Russia, Syria, and dozens of other countries and designated individuals - apply to all U.S. persons and entities, not just to financial institutions. A private school accepting tuition from foreign students, a consulting firm billing international clients, a luxury goods retailer selling to foreign buyers, a law firm representing foreign nationals - all of these businesses have potential OFAC exposure if any of their counterparties are nationals of sanctioned countries or appear on OFAC's Specially Designated Nationals list.

The SDN list is the second dimension of OFAC exposure that non-bank businesses frequently overlook. Even when a business's customers are not nationals of comprehensively sanctioned countries, they may be individually designated by OFAC as SDNs - blocked persons whose property must be frozen and with whom U.S. persons cannot transact. The SDN list includes individuals from dozens of countries who have been designated for terrorism financing, narcotics trafficking, human rights abuses, and other activities. Businesses that do not screen customers against the SDN list have no way of knowing whether they are transacting with a blocked person, and OFAC's enforcement record includes cases where entirely domestic businesses - with no international operations at all - were penalized for transactions with SDN-listed individuals who happened to be their customers.

The practical question for any non-bank business is how to build an OFAC compliance program that is proportionate to its actual risk exposure without creating an administrative burden that overwhelms its operations. The answer, as OFAC guidance consistently makes clear, is risk-based calibration. Not every business has the same OFAC risk profile. A local retail business with an entirely domestic customer base and no international suppliers or counterparties has minimal OFAC exposure. A business like IMG Academy - with an explicitly international student body, international recruitment operations, and regular transactions with individuals from across the globe - has substantial OFAC exposure that demands a meaningful compliance program.

The elements of a proportionate OFAC compliance program for a non-bank business typically include: a written OFAC compliance policy that describes the business's assessment of its OFAC risk and the controls it has implemented to manage that risk; a customer and counterparty screening process that checks names, nationalities, and identifying information against OFAC's SDN list and any applicable country-based sanctions lists; procedures for handling potential matches, including escalation to a compliance officer and, where appropriate, submission of a blocking report or license application to OFAC; annual training for employees involved in customer onboarding, billing, and international transactions; and regular program reviews to confirm that screening tools are current and that procedures are being followed. For businesses with more complex international operations, additional elements - including enhanced due diligence for customers from higher-risk countries and regular audits of screening procedures - may be appropriate.

The educational sector has a specific licensing consideration that the IMG Academy case highlights. OFAC's Iran sanctions program includes a general license that permits certain educational activities - specifically, the provision of educational services to Iranian nationals enrolled in degree programs at U.S. academic institutions. This license does not cover all educational transactions; it is specifically scoped to academic degree programs and does not extend to non-degree training programs of the kind IMG Academy offers. But the existence of this and similar educational licenses in other sanctions programs means that educational businesses cannot simply screen out all potential sanctioned-country applicants without understanding the licensing landscape. The path forward requires both a screening program and a clear understanding of which transactions might be permissible under available licenses.

Schools, universities, training programs, and other educational businesses that recruit internationally should be treating OFAC compliance as a core admissions and enrollment function, not an afterthought. The international student market is among the most OFAC-sensitive segments of the U.S. economy - it routinely involves students from Iran, Cuba, and other sanctioned countries who are present in the United States on valid visas and who may be entirely eligible to study here but whose families back home cannot legally make payments to U.S. institutions. Knowing the difference between a sanctioned-country national who is present in the U.S. as a visa holder (and potentially eligible to transact) and one whose funds originate from a sanctioned country's financial system (and potentially not eligible) requires both a compliance program and, in ambiguous cases, consultation with legal counsel and OFAC itself.

Professional services firms face a similar dynamic. Law firms, accounting firms, consulting firms, and other professional services businesses that serve international clients regularly encounter counterparties from sanctioned countries or individuals who may appear on the SDN list. These firms often assume that their professional licenses, engagement letters, and client onboarding processes provide adequate protection. They do not. OFAC compliance requires affirmative screening - not just documentation of what clients said about themselves - and the professional services sector has seen a steady increase in OFAC enforcement actions over the past decade as the agency has extended its reach beyond the financial sector.

The takeaway from the IMG Academy settlement is not that every U.S. business needs the same OFAC compliance program as a major bank. It is that every U.S. business with international exposure needs a compliance program calibrated to its specific risk profile - and that the absence of such a program is not a defense, it is itself the finding. OFAC does not require willful violations for enforcement. It requires violations, and the penalties for non-willful violations, while lower than for willful ones, can still be substantial. Building an OFAC compliance program before a violation occurs is categorically cheaper than building one in the aftermath of an enforcement action. The IMG Academy settlement is the case study that proves it.