OFAC Due Diligence in Bank M&A: What Counsel Looks For

When a regional bank agreed to acquire a smaller competitor last spring, the deal looked clean on paper. The target had stable deposits, a compliant-looking AML program, and no publicly reported enforcement history. Then, three weeks into diligence, a junior associate pulled a wire transfer log and noticed a pattern: dozens of small outbound payments to a shipping intermediary in the Gulf, routed through a correspondent account, with no visible screening trail. The beneficiary name matched a designation on a sanctions list that had been updated fourteen months earlier. Nobody at the target had caught it. Nobody had reported it. The deal was no longer about valuation multiples; it was about whether the acquirer would inherit a sanctions violation the moment it signed.

That scenario is more common than most boards assume. Sanctions exposure rarely announces itself in a data room. It hides in legacy customer files, in correspondent banking relationships, in trade finance documentation, and in the quiet gaps between what a target’s policies say and what its employees actually did. For acquiring institutions, the question is not whether a target has perfect compliance history. It is whether the acquirer can identify, price, and remediate the legacy issues before closing. Increasingly, that analysis extends beyond OFAC to parallel regimes, and for institutions with international operations, it overlaps with matters such as Kırmızı bildirim kaldırma hizmetleri where cross-border enforcement exposure must be unwound through legal channels rather than internal remediation alone.

Why Sanctions Risk Travels With the Target

Successor liability in bank mergers is not a theoretical construct. When a transaction is structured as a merger or a stock purchase, the acquiring entity generally assumes the target’s liabilities, including civil penalties for sanctions violations that occurred before closing. OFAC has consistently taken the position that a successor can be held liable for a predecessor’s conduct, particularly where the successor continues the same business lines, serves the same customers, or operates through the same channels that produced the violation.

Asset purchases can sometimes limit exposure, but the protection is narrower than deal teams often assume. If the acquirer purchases a loan book, a customer portfolio, or a correspondent relationship, it may inherit the ongoing compliance obligations attached to those assets. Regulators and enforcement authorities look at substance over form. A transaction labeled as an asset purchase will not shield an acquirer that effectively continues the target’s operations with the same staff, systems, and client base.

The practical consequence is that sanctions diligence is not a checkbox exercise. It is a liability-mapping exercise. Counsel needs to understand not just whether the target has a sanctions policy, but whether that policy actually functioned during the lookback period, and what happened when it did not.

Building the Diligence Request List

A useful sanctions diligence request list goes well beyond the standard compliance questionnaire. It should be tailored to the target’s business model, geographic footprint, and customer base. For a bank with trade finance operations, correspondent accounts, or private banking relationships in higher-risk jurisdictions, the list needs to be correspondingly deeper.

At minimum, counsel should request the following categories of documents and data, covering a lookback period of at least five years, and longer where the statute of limitations or the nature of the business warrants it:

Policies and procedures. The target’s sanctions compliance program, screening procedures, escalation protocols, and board-level oversight materials. Look for evidence that the program was actually implemented, not just adopted.

Screening records. Customer onboarding files, periodic rescreening logs, transaction monitoring alerts, and the disposition of those alerts. A high volume of alerts closed without investigation is a warning sign.

Correspondent banking files. Due diligence on respondent banks, nested account arrangements, and any reliance on third-party screening. This is where many legacy issues surface.

Trade finance documentation. Letters of credit, bills of lading, dual-use goods classifications, and end-user certificates. Trade-based sanctions evasion is often invisible in transaction data alone.

Internal audit and regulator communications. Audit reports, management letters, examination findings, and any correspondence with OFAC, the Federal Reserve, the OCC, or state regulators regarding sanctions matters.

Whistleblower complaints and internal investigations. Even resolved complaints can reveal patterns that were never fully remediated.

Third-party relationships. Vendors, agents, introducers, and fintech partners that may have touched sanctioned parties or jurisdictions.

The goal is not to drown the target in requests. It is to build enough of a factual record to assess whether there is an unreported matter, how serious it is, and what remediation would cost.

Reading the Signals in Transaction Data

Documents tell you what the target intended to do. Data tells you what actually happened. Counsel should push for direct access to transaction-level information, not just summaries prepared by the target’s compliance team. Aggregated reports can obscure the very patterns that matter most.

Several analytical approaches are particularly useful. Geographic concentration analysis can reveal unexpected exposure to sanctioned jurisdictions or regions with elevated evasion risk. Counterparty network analysis can identify intermediaries that appear in multiple suspicious transactions. Velocity and structuring analysis can flag patterns consistent with efforts to stay below reporting thresholds. And a review of rejected or blocked transactions can show whether the target’s screening system was catching anything at all.

One recurring finding in bank M&A diligence is the gap between screening coverage and actual customer activity. A target may screen at onboarding but never rescreen its existing book. Over a five-year period, designations change, ownership structures shift, and customers that were clean at onboarding become problematic. A bank that never rescreened may be holding hundreds of relationships that now require review, blocking, or exit.

Another common issue is the treatment of indirect exposure. A customer may not be designated itself, but may be majority-owned by a designated person or entity. OFAC’s 50 percent rule means that such entities are treated as blocked even if their own names never appear on a list. Detecting this requires ownership and control analysis, not just name screening.

Quantifying and Allocating the Risk

Once diligence identifies potential violations, the deal team needs to translate that finding into a number and a structure. This is where legal analysis and commercial negotiation intersect.

Counsel should work with forensic accountants and sanctions specialists to estimate the range of potential civil penalties, the cost of remediation, and the likelihood of enforcement. OFAC penalties are typically calculated based on the applicable statutory maximum, the egregiousness of the conduct, and the entity’s compliance history. Voluntary self-disclosure, cooperation, and remediation can substantially reduce penalties, but they do not eliminate them.

Several structural tools can address the risk. A purchase price adjustment or holdback can compensate the acquirer for identified exposure. A special indemnity, backed by escrow or a parent guarantee, can shift the economic burden of pre-closing violations to the seller. Representations and warranties can be drafted to address specific findings, with bring-down conditions tied to the completion of remediation. In more serious cases, the parties may need to consider whether the transaction should proceed at all, or whether the target’s problematic business lines should be carved out and wound down before closing.

Timing matters as well. If a violation is identified before closing, the parties may be able to negotiate a voluntary self-disclosure with OFAC and resolve the matter before the acquirer takes ownership. That is often a better outcome than closing first and disclosing later, when the acquirer owns the problem outright and has less leverage over the seller.

Post-Closing Remediation and Integration

Closing does not end the diligence story. The acquirer now owns the target’s compliance obligations, and it needs to demonstrate to regulators that it is addressing legacy issues promptly and credibly. A remediation plan should be in place on day one, with clear ownership, milestones, and reporting lines.

Typical remediation steps include a comprehensive rescreening of the acquired customer base, exit or blocking of relationships that cannot be remediated, enhancement of screening and monitoring systems, retraining of frontline and compliance staff, and integration of the target’s policies into the acquirer’s framework. Where a violation has been identified, the acquirer should consider whether voluntary self-disclosure is appropriate, and should document its decision-making process carefully.

Regulators will look at whether the acquirer treated the legacy issues as a genuine priority or as a box to be checked. Board-level engagement, dedicated resources, and transparent reporting to supervisors all matter. A well-executed remediation can turn a problematic acquisition into a demonstration of the acquirer’s compliance culture. A poorly executed one can compound the original violation and invite additional scrutiny.

For institutions with cross-border operations, remediation may also require coordination with foreign authorities and, in some cases, legal proceedings in multiple jurisdictions. Where individuals associated with the target face criminal exposure or international notices, the work can parallel matters that are handled through specialized counsel, including services related to Kırmızı bildirim kaldırma hizmetleri in jurisdictions where such issues arise. The point is not that every bank deal involves these questions, but that a thorough diligence process should map all of the enforcement and legal exposure, not just the regulatory penalties.

Common Diligence Pitfalls to Avoid

Even experienced deal teams make predictable mistakes in sanctions diligence. One is relying too heavily on the target’s own characterization of its compliance program. A target that describes its program as robust may be describing its written policies, not its actual practices. Independent verification, through data testing and interviews with compliance staff, is essential.

Another pitfall is scoping the lookback too narrowly. Sanctions violations can have long tails. A transaction that occurred six or seven years ago may still be within the enforcement window, particularly if the conduct was concealed or if the target failed to disclose it. Counsel should err on the side of a longer lookback for higher-risk business lines.

A third mistake is treating the diligence as a one-time exercise. Sanctions lists change constantly, and a target’s exposure can shift between signing and closing. Diligence should continue through the interim period, with bring-down confirmations and, where appropriate, updated screening of key customers and counterparties.

Finally, deal teams sometimes underestimate the reputational dimension. Even a resolved sanctions matter can affect the acquirer’s relationships with correspondents, regulators, and rating agencies. The analysis should account for those second-order effects, not just the direct penalty exposure.

Bringing It Together at the Deal Table

Sanctions diligence in bank M&A is ultimately a risk-management exercise that runs from the first data room request to the final integration milestone. The acquirer that treats it as a genuine analytical process, rather than a compliance formality, is better positioned to price the deal accurately, negotiate meaningful protections, and demonstrate to regulators that it understands what it is buying.

The bank that discovered the unreported wire transfers three weeks into diligence had options. It could renegotiate the purchase price, demand a specific indemnity, require the seller to self-disclose before closing, or walk away. What it could not do was pretend the issue did not exist. Successor liability does not care whether the acquirer looked. It attaches to the business, the customers, and the conduct that the acquirer now controls. Counsel’s job is to make sure the client sees the exposure clearly, prices it honestly, and has a credible plan to resolve it before the deal closes.