Primary and secondary sanctions: two architectures, one word.

Two entirely different legal machines share one word. One tells you what you may not do. The other tells you what the United States may do to you.

Foundations · 28 Apr 2026

“We are not a U.S. company” is a starting point, not a sanctions conclusion. A foreign company may face a direct U.S. prohibition because of its ownership, conduct or transaction connections. It may also face designation or other secondary measures for activity outside the scope of a direct prohibition. Keeping those questions apart helps avoid both missed restrictions and unnecessarily blocked business.

This piece sets out the structural difference between direct prohibitions and sanctions imposed on foreign persons, what actually follows from each, and where the distinction stops mattering in practice.

Primary sanctions: a prohibition addressed to you

Many U.S. sanctions programs rest on emergency powers, executive orders and implementing regulations. Executive Order 13846’s preamble, for example, identifies IEEPA, the National Emergencies Act and additional Iran-specific statutes; the applicable operative provisions then determine who and what is restricted. This is an example, not a complete list of sanctions authorities. Exec. Order No. 13846, preamble, 83 Fed. Reg. 38939 (Aug. 7, 2018).

A common formulation of the U.S.-person definition appears in the Ukraine-/Russia-related regulations:

“The term United States person or U.S. person means any United States citizen, permanent resident alien, entity organized under the laws of the United States or any jurisdiction within the United States (including foreign branches), or any person in the United States.” 31 C.F.R. § 589.339.

A foreign branch of a U.S. entity is included. A separately incorporated foreign subsidiary is not automatically a U.S. person, but the Iran program separately reaches foreign entities owned or controlled by U.S. persons, and “control” includes specified equity, board and other control criteria. Check the program; do not assume the subsidiary is outside it. 31 C.F.R. § 560.215(a)–(b).

Three more hooks catch companies that are confident they are outside.

Territorial and dollar nexus

Physical presence in the United States and participation by U.S. persons can matter. Payment routing through a U.S. bank can introduce a prohibited U.S. transaction — the Iran program, for example, prohibits the exportation of services from the United States, and IEEPA reaches anyone who causes a violation — but dollar denomination alone is not a conclusive jurisdiction test. U.S.-origin goods may engage program-specific sanctions or separate export controls; there is no universal OFAC goods rule. Map the actual conduct and the applicable restriction. 31 C.F.R. § 589.339; 31 C.F.R. § 560.204; 50 U.S.C. § 1705(a).

Facilitation

This is the provision that surprises people most. Under the Iran program:

“Except as otherwise authorized pursuant to this part, and notwithstanding any contract entered into or any license or permit granted prior to May 7, 1995, no United States person, wherever located, may approve, finance, facilitate, or guarantee any transaction by a foreign person where the transaction by that foreign person would be prohibited by this part if performed by a United States person or within the United States.” 31 C.F.R. § 560.208.

A U.S. person’s participation can be prohibited even where a foreign entity’s transaction is otherwise permissible. But do not infer that only the individual can face exposure: separate prohibitions, ownership rules and causing liability must also be considered. 31 C.F.R. § 560.208; 31 C.F.R. § 560.215; 50 U.S.C. § 1705(a).

Ownership

OFAC’s long-standing guidance is that

“any entity owned in the aggregate, directly or indirectly, 50 percent or more by one or more blocked persons is itself considered to be a blocked person.” OFAC, Revised Guidance on Entities Owned by Persons Whose Property and Interests in Property Are Blocked (Aug. 13, 2014), p. 1.

The rule applies without an SDN entry for the entity and aggregates blocked ownership across programs. Control below 50 percent does not automatically block an entity under this rule, but other blocking grounds and dealings with a blocked representative still matter. The rule is also codified in program regulations. OFAC FAQ 398; OFAC FAQ 399; OFAC FAQ 400; 31 C.F.R. § 587.406.

OFAC’s March 31, 2026 advisory adds that a purported transfer which only conceals a blocked person’s continuing interest does not end that interest, so an ownership chart showing less than 50 percent is not always the end of the inquiry. OFAC, Sanctions Advisory: Guidance on Sham Transactions and Sanctions Evasion (Mar. 31, 2026), p. 1.

What follows from breach is legal liability

IEEPA makes it unlawful to violate, attempt to violate, conspire to violate or cause a violation of a license, order, regulation or prohibition issued under it. Civil penalties can reach the greater of the inflation-adjusted statutory amount or twice the transaction amount. The statute’s unadjusted base is $250,000; OFAC’s regulations currently state the adjusted maximum as $377,700 per violation, and there was no 2026 inflation adjustment because the Office of Management and Budget canceled it for lack of October 2025 price data. The criminal provision provides for fines of up to $1 million and, for natural persons, imprisonment of up to twenty years for willful violations and the other conduct it specifies. Section 1705(d), added on April 24, 2024, sets ten-year limitation periods for civil enforcement and for prosecution, running from the latest date of the violation; for civil purposes, a pre-penalty notice or finding of violation counts as commencing a proceeding. How the ten-year period applies to older conduct requires separate analysis. 50 U.S.C. § 1705(a)–(d); 31 C.F.R. § 560.105(a) and § 505.401(a)(2); OMB Memorandum M-26-11 (Apr. 17, 2026).

Secondary sanctions can reach activity outside a direct prohibition

Secondary sanctions can expose a non-U.S. person to U.S. measures even when its underlying conduct does not violate an applicable U.S. transaction prohibition. It is too broad to say that the United States “cannot” regulate any German company’s trade, or that every affected company has acted lawfully. Primary and secondary exposure can coexist; analyze each legal basis separately. Exec. Order No. 13846, §§ 1–5, 8, 15.

Executive Order 13846 contains examples of account restrictions, menu-based measures and direct prohibitions. The applicable trigger, official determination, exceptions and selected sanctions all matter. Exec. Order No. 13846, §§ 2–5, 8.

Correspondent account sanctions

Section 2 authorizes restrictions on a foreign financial institution’s U.S. correspondent or payable-through accounts after the required determination about covered knowing, significant financial transactions. It contains exceptions and qualifications, including for transactions providing agricultural commodities, food, medicine or medical devices to Iran. Account restrictions can severely disrupt payment access; they are a sanctions measure, not necessarily a civil penalty for the foreign bank’s underlying activity. Exec. Order No. 13846, § 2(a)–(f).

Menu-based sanctions

Sections 3–5 provide a menu for covered conduct, including specified Iran automotive, petroleum and petrochemical activity. Depending on the determination and selection, measures can include: Exec. Order No. 13846, §§ 3–5.

denial of Export-Import Bank credit, guarantees and insurance;
denial of U.S. export licenses for goods or technology to the sanctioned person;
for a financial institution, loss of primary dealer status or of the ability to serve as a U.S. government agent or repository of U.S. government funds;
exclusion from U.S. government procurement;
visa denial and exclusion from the United States for corporate officers, principals and controlling shareholders;
a prohibition on U.S. financial institution loans or credits totaling more than $10 million in any twelve-month period, with the stated exception for activities to relieve human suffering;
prohibition of foreign exchange transactions subject to U.S. jurisdiction, and of transfers of credit or payments through U.S. financial institutions, in which the person has an interest;
full blocking of the person’s property within U.S. reach;
a ban on U.S. persons investing in or purchasing significant amounts of the person’s equity or debt; and
restriction or prohibition of imports from the person into the United States.

Sections 4 and 5 also provide for selected measures against principal executive officers or persons performing similar functions. The list above describes available measures, not a package automatically imposed on every affected company. Exec. Order No. 13846, §§ 3–5.

Read the particular knowledge standard

For this order, “knowledge” and “knowingly” mean actual knowledge or that the person should have known. Other authorities may use different triggers; do not import this standard into every secondary-sanctions rule. Exec. Order No. 13846, § 16(i).

Russia-related secondary sanctions on foreign financial institutions

Executive Order 14114 added section 11 to Executive Order 14024, authorizing blocking or correspondent-account measures against foreign financial institutions for covered significant transactions, or services, involving Russia’s military-industrial base. OFAC’s June 12, 2024 guidance explains the expanded scope, which includes all persons blocked under E.O. 14024. The operative section does not use the Iran order’s “knowingly” formula. OFAC also states that foreign persons do not risk sanctions for transactions authorized for U.S. persons under the program’s general licenses or that are exempt; confirm the actual authorization on the transaction date rather than assuming an entire sector is exempt. Exec. Order No. 14114, § 1, 88 Fed. Reg. 89271 (Dec. 26, 2023); OFAC, Updated Guidance for Foreign Financial Institutions (June 12, 2024), pp. 1–2, 7–8.

OFAC uses the notation “Additional Sanctions Information – Subject to Secondary Sanctions” in relevant SDN entries, and some entries carry a separate “Secondary sanctions risk” field naming the authority. Preserve such fields in screening data, but do not treat the absence of a notation as a safe harbor: the governing authority determines exposure. OFAC FAQ 636; OFAC FAQ 638; OFAC, Recent Actions (Sept. 10, 2026).

The differences that change what you do

	Primary	Secondary
Who is addressed	U.S. persons and other persons or conduct reached by the specific prohibition	Foreign persons meeting the particular sanctions criterion; may overlap with primary exposure
Legal character	A prohibition	An authorization for U.S. officials to impose consequences
Trigger	Conduct prohibited by the applicable authority; civil exposure may not require willfulness	Authority-specific; some use knowledge and significance, others differ
Consequence	Civil penalty; criminal exposure for willful conduct	Loss of access — correspondent accounts, U.S. market, export licenses, visas, credit — or designation
Where it is resolved	Applicable licensing, enforcement and judicial processes	Designation or sanctions processes, with applicable administrative and judicial review
Who feels it first	Any person whose conduct or property is reached	The sanctioned person and affected financial or commercial relationships

The distinction concerns legal mechanisms; it is not a guarantee of harmlessness. Secondary measures can become direct prohibitions for U.S. persons dealing with the sanctioned person, and one transaction can implicate both systems.

Where the distinction collapses

Commercial parties may respond before any enforcement or designation decision occurs.

Banks, insurers and trading partners may apply risk policies or contractual requirements more restrictive than the legal minimum. Their willingness to transact depends on their own exposure, operations and risk appetite. A documented compliance process can support that discussion, but it cannot guarantee access or override a prohibition.

So “we are not subject to U.S. primary sanctions” can be entirely accurate and still lose you the payment channel. The right question is not “am I bound?” but “what does each party in this chain believe about its own exposure, and what will it do about it?”

The European counter-layer

For EU-based groups, the EU blocking regulation adds a separate question. In Bank Melli, the Court of Justice (Grand Chamber) held that Article 5’s prohibition on complying with the foreign laws listed in the regulation’s Annex applies even without an order from a foreign administrative or judicial authority directing compliance. Case C-124/20, Bank Melli Iran v. Telekom Deutschland GmbH, ECLI:EU:C:2021:1035, paras. 42–51 (Dec. 21, 2021).

A party without an authorization is not precluded from terminating a contract with a person on the SDN List without giving reasons. But where all the evidence before the national court suggests prima facie that it complied with the listed laws without an authorization, “it is for that same person to establish to the requisite legal standard that his or her conduct was not intended to comply with those laws.” Annulling a termination made to comply with the listed laws is not precluded, provided annulment is not disproportionate; the national court weighs the regulation’s objectives against the probability and extent of the economic loss the company would suffer. Bank Melli, paras. 62–68, 90–95 and operative part, points 2–3.

Authorization and local advice matter

The Court also describes the route to a Commission authorization where noncompliance would seriously harm the protected interests, and treated as relevant to proportionality that the terminating party had not applied for one. These holdings do not require every sanctioned-party contract to continue. They show why qualified EU counsel should examine scope, evidence, authorization and proportionality alongside U.S. advice. Bank Melli, paras. 84–85, 93.

Two points of scope are worth knowing before that conversation. The regulation’s Annex lists specified U.S. statutes and regulations, chiefly Iran- and Cuba-related; it lists no executive orders, including the Russia-related orders discussed above. Whether a particular U.S. measure falls within the regulation is a question of EU law. Council Regulation (EC) No 2271/96, Art. 5 and Annex (consolidated text of Aug. 7, 2018). And the 2021 facts predate the EU’s own reimposition, on September 29, 2025, of nuclear-related restrictive measures on Iran, including asset freezes on the Central Bank of Iran and major Iranian commercial banks. Where EU restrictive measures themselves apply, the analysis differs — again a question for EU counsel. Council of the EU, press release (Sept. 29, 2025).

What to check in your own group

None of this is legal advice, and none of it substitutes for an analysis of your facts. As a structure for that analysis:

List which of your entities are U.S. persons, on the actual definition. Include foreign branches. Then check, program by program, whether the programs you touch also reach entities owned or controlled by U.S. persons.
Identify U.S. persons in approval chains and assess facilitation under the relevant program before changing decision rights. 31 C.F.R. § 560.417.
Map actual payment routes, including U.S. clearing, rather than treating the currency label alone as the answer.
Screen for ownership in the aggregate, and keep the secondary-sanctions fields.
Document the factual basis for the applicable secondary-sanctions test, including knowledge and significance where that authority uses them.
Read your contracts for the clause you did not negotiate — the sanctions representation that lets a counterparty walk.

A word on currency

On August 24, 2026, OFAC indefinitely stayed three general licenses in the Iranian Transactions and Sanctions Regulations and Iran General Licenses F and G. On September 8, 2026, it stayed two more regulatory general licenses, one regulatory statement of licensing policy and General License J-1. On September 10, 2026, it announced that Iran-related specific license applications will be considered with a presumption of denial, except as required by law or in exceptional and urgent circumstances such as risk to life, limb or environmental safety. The sequence illustrates why an old authorization cannot be assumed still available. A transaction previously covered may now need another valid authorization, and for Iran a specific license is presumptively unavailable. The stays do not mean that every transaction in those broad categories is necessarily prohibited; an exemption or another authorization may still apply. Iranian Transactions and Sanctions Regulations, 91 Fed. Reg. 54957–58 (Aug. 26, 2026); Iranian Transactions and Sanctions Regulations, 91 Fed. Reg. 57511–12 (Sept. 10, 2026); OFAC, Statement of Licensing Policy on Iran-Related Requests (Sept. 10, 2026).

Before relying on any program-specific statement in this piece, check the current text of the regulation, the executive order, the general licenses and OFAC’s licensing policy as of your own date.

Contact Zimmermann Law

The distinction matters most before a bank forces it. We help non-U.S. groups work out which machine is actually pointed at them, and what to do about each. Contact Zimmermann Law to talk it through.

Sources: October 2, 2026 currency update: FR Doc. 2026-20007 (Sept. 30, 2026), amendatory instructions 118 and 123 replaced the former ITSR penalty provisions with § 560.105 and the part 505 cross-reference. Mandatory U.S. federal authority; the $377,700 amount is unchanged. Checked September 25, 2026. U.S. statutes, regulations and executive orders are mandatory within their scope. OFAC FAQs, advisories and licensing statements, and the OMB memorandum, are agency guidance, not law. Bank Melli is an authoritative EU-law judgment discussed for context; it is not a U.S. holding or a transaction-specific EU opinion. Mandatory — U.S. federal 50 U.S.C. § 1705(a)–(d) — unlawful acts, penalties and limitations. 31 C.F.R. § 560.105(a) and § 505.401(a)(2) — inflation-adjusted civil maximum. 31 C.F.R. § 560.204 — exportation of services from the United States to Iran. 31 C.F.R. § 560.215 — foreign entities owned or controlled by U.S. persons. 31 C.F.R. § 560.208; 31 C.F.R. § 560.417 — Iran facilitation. 31 C.F.R. § 589.339 — U.S.-person definition; 31 C.F.R. § 587.406 — codified ownership rule. Exec. Order No. 13846, 83 Fed. Reg. 38939 (Aug. 7, 2018), preamble, §§ 1–5, 8, 15, 16(i). Exec. Order No. 14024, 86 Fed. Reg. 20249 (Apr. 19, 2021); Exec. Order No. 14114, § 1, 88 Fed. Reg. 89271 (Dec. 26, 2023). Iranian Transactions and Sanctions Regulations, 91 Fed. Reg. 54957–58 (Aug. 26, 2026); Iranian Transactions and Sanctions Regulations, 91 Fed. Reg. 57511–12 (Sept. 10, 2026). Persuasive — U.S. Treasury, OFAC and OMB guidance OFAC, Revised Guidance on Entities Owned by Persons Whose Property and Interests in Property Are Blocked (Aug. 13, 2014). OFAC, Sanctions Advisory: Guidance on Sham Transactions and Sanctions Evasion (Mar. 31, 2026). OFAC, Updated Guidance for Foreign Financial Institutions (June 12, 2024). OFAC, Statement of Licensing Policy on Iran-Related Requests (Sept. 10, 2026). OFAC FAQ 398; OFAC FAQ 399; OFAC FAQ 400; OFAC FAQ 636; OFAC FAQ 638; OFAC, Recent Actions (Sept. 10, 2026). OMB Memorandum M-26-11, Cancellation of Penalty Inflation Adjustments for 2026 (Apr. 17, 2026). European Union — context only Case C-124/20, Bank Melli Iran v. Telekom Deutschland GmbH, ECLI:EU:C:2021:1035 (Dec. 21, 2021) — judgment of the Grand Chamber, read in the official EUR-Lex text. Council Regulation (EC) No 2271/96, consolidated text of Aug. 7, 2018 — Articles 5 and 11 and the Annex. The consolidated text is a documentation tool; the Official Journal text is authentic. No comprehensive present-day scope conclusion is stated. Council of the EU, “Iran sanctions snapback: Council reimposes restrictive measures” (Sept. 29, 2025) — official press release; the underlying Council acts were not reviewed for this piece.

This post is for general information and is not legal advice.

Attorney Advertising. Zimmermann Law PLLC · New York · +1 (917) 426-4625 · contact@zimmermann-law.com