What the IMG Academy Enforcement Action Means for Schools: A Risk-Based Approach to OFAC Sanctions Compliance

The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) recently announced a $1.7 million settlement agreement with IMG Academy (a Florida boarding school) to settle the school’s potential liability for apparent violations of OFAC sanctions. This substantial penalty warrants the attention of colleges, universities, and independent schools that receive tuition payments or donations originating from third parties outside the United States. Although K-12 schools are not the traditional target of sanctions enforcement, this settlement is a clear signal to schools to exercise due diligence when vetting transactions with foreign individuals or entities.  

Some prudent steps now can head off most of the riskiest sanctions areas for schools.  OFAC preaches a risk-based approach to sanctions compliance. In other words, it doesn’t expect your school to have the same caliber of compliance system that a major multinational bank or defense contractor does. What OFAC does expect is that your institution understands its unique risks and takes prudent steps to minimize the chances of non-compliance.

What Happened at IMG Academy?

IMG Academy enrolled the children of two individuals listed on OFAC’s Specially Designated Nationals and Blocked Persons List (SDN List). The two individuals were restricted due to their financial support and services to a sanctioned foreign drug trafficking organization. Although the children themselves were not on the SDN List, tuition payments were made by or on behalf of the SDN parents through unrestricted third parties in Mexico, presumably to avoid detection by U.S. financial institutions that are required to block funds involving SDNs.  

Here’s the critical point of OFAC’s case: even though the SDN parents did not make the payments directly, IMG Academy entered into enrollment agreements directly with the SDN parents. OFAC’s position was that basic screening of parents and payors against the SDN List, or conducting routine due diligence, would likely have identified the sanctions risk. As OFAC noted in its press release, the SDN parents provided their full names at each stage of the enrollment process, and those names matched their entries on the SDN List. 

International Touchpoints at Schools

As OFAC stated in its enforcement release, “Even for entities operating largely domestically, the presence of international touchpoints creates opportunities for impermissible dealings with sanctioned actors, inadvertently or otherwise.” Schools often have more international touchpoints than they realize. These may include:

• Enrollment of international students 
• Hosting visiting faculty from other countries 
• International exchange programs
• Funding student research trips or projects in international jurisdictions 
• Collaboration with foreign institutions 
• Student trips abroad 
• Investments in companies located abroad 
• Operating global campuses 
• Donations from non-U.S. persons or entities 
• Charitable contributions to non-U.S. non-governmental organizations

According to OFAC, any of these touchpoints could expose your school to sanctions risk if proper screening isn’t in place.

A Risk-Based Compliance Framework

OFAC expects all U.S. entities to implement and maintain a sanctions compliance program, calibrated to their individual risk profile. The below categories are examples of representative risks for schools, recognizing that any “miss” could lead to an OFAC violation like IMG Academy experienced. On balance, implementing a screening approach that is well documented, communicated, followed, and periodically reevaluated would likely be seen as reasonable by OFAC for many schools. If OFAC determines that a civil monetary penalty is warranted for apparent violations, the existence of an effective sanctions compliance program typically serves as a mitigating factor that reduces the amount of the monetary penalty.

Highest Risk – Recommended Screening For All Involved Parties

• Any enrolled family (including student, agreement counterparty, and payor) based outside of the United States 
• Any student whose tuition payment comes from a non-U.S. financial institution 
• Any student or family with unusual payment structures involving third parties or complex routing arrangements (even domestically)
• Foreign exchange and study abroad programs, particularly when the school is sending money to a foreign party 
• Collaborations with entities in or trips to high-risk or comprehensively sanctioned jurisdictions (e.g., Cuba, Iran, North Korea, and certain regions of Ukraine) 

Moderate Risk – Recommended Screening Above Certain Financial Thresholds

• Larger gifts that warrant a more formal gift agreement provide the school an opportunity to get more information about the counterparty before any financial exchange occurs
• Repeat donors whose cumulative giving adds up to significant amounts, even if individual donations are modest
• International vendors, visiting scholars, or research partners

For smaller, one-time online donations, say, a student’s grandparent making a modest gift through your public donation link, you can likely document your position that these don’t require screening. However, OFAC could technically find a violation for any single “dealing” with a sanctioned party at any dollar amount. Where to draw that threshold line is a risk-based judgment call based on your institution’s specific circumstances and donation platforms and historical data.

Lower Risk – Random Screening Likely Reasonable

• Enrolled families that live in the United States and pay via a U.S. financial institution
• Consider periodic spot-checks: there is no magic number, but if feasible, screening a percentage of domestic families annually as a “spot check” demonstrates good faith as part of your compliance culture

Practical Steps to Get Started

For schools looking to build or strengthen their sanctions compliance program, consider these key components: 

• Risk Assessment: Conduct a tailored sanctions risk assessment to identify your international touchpoints and the risk associated with each. 
• Screening Protocols: Implement screening protocols to screen students, parents, guardians, tuition counterparties, donors, vendors, and payors against the SDN List and other applicable restricted party lists and whether they are located in, or have ties to, comprehensively sanctioned jurisdictions or sanctioned persons. IMG Academy could have saved a major issue with this step.
• Payment Review: Review payment structures that involve third parties or complex routing arrangements. This was another red flag missed in the IMG Academy case. 
• Escalation Procedures: Establish procedures to escalate and review potential sanctions issues before accepting funds or entering into agreements with an internal point of contact and outside resources as needed.
• Training: Provide targeted training to relevant admissions, finance, development, and senior leadership personnel.
• Testing: Conduct periodic independent testing or audits of sanctions compliance controls.
• Documentation: Create records that document your compliance program, your decisions regarding potential issues, your training efforts, and your audits.

The Bottom Line

All educational institutions should take note of the IMG Academy enforcement action as a cautionary tale and review existing policies and practices that could make them at risk for similar enforcement actions. U.S. sanctions laws apply to all U.S. “persons,” a term that includes nonprofit educational institutions organized under U.S. law. The good news is that OFAC’s risk-based approach means you don’t need to build an elaborate compliance infrastructure overnight. What you do need is a thoughtful, documented approach that matches your institution’s actual risk profile, one that your team understands, follows, and periodically reevaluates. Instituting relatively simple screening protocols could save your school from a seven-figure penalty and potential reputational harm. We also encourage you to work with legal counsel to design a compliance program, train staff, and conduct audits.