Case In Point: Lessons for the Proactive Manager
Volume 18 Issue 09 | September 2026
This week, I’m attending ACUA’s annual AuditCon in New Orleans with members of our Internal Audit department. I’ll share insights from this conference in coming months, but for this issue of Case in Point, I asked Kristin Roberts, Assistant Vice President for Institutional Compliance & Privacy, to give us some insight into the implications of the U.S. Department of Treasury’s Office of Foreign Assets Control (OFAC)’s recent enforcement action.
Typically, in higher education we think of OFAC (Office of Foreign Assets Control) as an export control requirement limited to the research enterprise. Contracts, grants, and collaborations with foreign institutions and individuals are likely screened by your research security offices and tightly controlled. However, OFAC is much broader and can present additional compliance requirements and risks for your institution.
This spring, IMG Academy was fined $1.72 million for accepting tuition payments from two people on the Sanctioned Entity List. U.S. persons are prohibited from transacting with Specially Designated Nationals (SDNs) under the U.S. Department of the Treasury’s sanctions. The rule applies to individuals and organizations on a strict liability basis, meaning that if a transaction occurs, it is a violation.
To prevent an incident, we must conduct proper due diligence. First, conduct a risk assessment to identify where international transactions are occurring. You likely already track these transactions to comply with the Higher Education Act Section 117 reporting requirements. Next, develop a policy or guidelines and procedures to put employees on notice of legal requirements and document your controls and screening activities. Lastly, conduct training with targeted employees to socialize the policy, reinforce procedures, and require voluntary self-disclosure if a violation is detected.
Additionally, on August 24, 2026, OFAC launched "Operation Economic Outcast," a major campaign to expand sanctions, suspend general licenses, and designate nearly 60 new Iran-related individuals and entities. OFAC suspended several general licenses that previously authorized certain payments to Iran and Iranian access to the U.S. academic system. This included suspending Iran’s General License G thereby prohibiting providing educational services (online classes, admissions, and standardized testing) to students physically located in Iran or located in another country outside the U.S. but ordinarily resident in Iran.
Institutions should evaluate whether any of its programs and services are impacted by this updated OFAC restriction and take any necessary action to avoid a violation.
Establishing a sanctions compliance program can significantly reduce your potential exposure and mitigate any resulting civil monetary penalties. For additional guidance, review the DOT’s A Framework for OFAC Compliance Commitments.
Thank you for that explanation and your suggestions, Kristin. Higher education risk professionals certainly need OFAC policies on their radar, but it is just one of many risks we assess and mitigate each day. We invite you to review the news stories from this month with an eye toward proactively managing risk at your institution.
Kevin Robinson
Vice President
Institutional Compliance & Security
