Licences, Guidance and Comfort Letters: What a Non-U.S. Counterparty Can Actually Rely On

01Introduction

A trading company in the Gulf is offered a cargo. A contractor is asked to service a plant. A bank is asked to clear a payment. Somewhere in the chain there sits a person designated by the United States, or a company such a person owns or controls, and the counterparty is told that the transaction is covered by a U.S. licence – or by a letter, or by guidance, or by an assurance given to a government by the U.S. Department of the Treasury’s Office of Foreign Assets Control (“OFAC”).

For a business that is not a U.S. person, the instinctive question, “Is this a prohibited transaction for me?” is usually the wrong one, and a reassuring answer to it is not worth much. Most U.S. sanctions prohibitions are addressed to U.S. persons and to property within U.S. jurisdiction. A company incorporated in the Emirates and not owned or controlled by a U.S. person, trading in dirhams with a Gulf bank, is generally outside the prohibitions. But that is merely the starting point of the analysis.

Three different questions decide whether a transaction is safe and whether it will actually complete. What exposure does a non-U.S. person have in the absence of on a prohibition? Which of the documents supposedly protecting you is addressed to you at all? And will the bank, insurer or freight forwarder who are instrumental to the transaction agree to act, whatever the documents say?

This article explains how to tell different instruments apart, where a non-U.S. counterparty’s exposure really comes from, and why formal relief and commercial access are two different things that have to be secured separately. It is written for potential counterparties to sanctioned persons, and examples are drawn from several sanctions programmes, because they use similar architecture and generate similar errors of understanding and application.

02Four Types of Instruments: Which of Them Is Addressed to You?

2.1. General Licences

A general licence authorises categories of transactions that would otherwise be prohibited. Authorisation is given on stated terms. It is self-executing: a person whose transaction meets the terms may proceed without applying for any permission.^[1] General licences are published by OFAC, and it is the stated policy of OFAC not to grant a specific licence for a transaction already covered by a general licence.^[2]

A distinction is commonly missed here, which matters. A non-U.S. person does not, strictly speaking, “rely on” a general licence. A licence authorises conduct that U.S. sanctions would otherwise prohibit, and those prohibitions are addressed to U.S. persons (and, under some programmes, to entities they own or control: see section 3). Where the prohibitions do not reach you, nothing you do can be or needs to be authorised. That changes once the transaction acquires a U.S. nexus: a U.S. person somewhere in the chain, goods exported from the United States, a dollar payment cleared through a U.S. bank. The licence then authorises what those U.S. participants do. Keeping within its terms is what stops the non-U.S. party from causing a U.S. person to violate U.S. sanctions.

That does not mean a non-U.S. counterparty has nothing to worry about. It faces a different kind of exposure: the risk of being designated itself. Designation is not a penalty for breaching a prohibition but a discretionary listing decision, taken on the basis of criteria set by the relevant executive order or statute, and available against persons which the prohibitions never bound (section 3 below).

OFAC’s guidance puts it this way: “[s]ubject to sanctions program-specific considerations, non-U.S. persons do not generally risk being sanctioned for engaging in or facilitating transactions for which a U.S. person would not require a specific license.”^[3] Each qualifier in that sentence does its own work. The comfort is generally available, it is subject to programme-specific considerations, and the benchmark is conduct for which a U.S. person would need no specific licence. For a non-U.S. person outside the prohibitions, the licence is therefore a yardstick, not an authorisation. In practice, the benchmark is met by conduct that falls within an exemption or within a general licence including every condition, reporting obligation and expiry date in it. A transaction that drifts outside those conditions fails the benchmark and loses the benefit of the statement.

2.2. Specific Licences

A specific licence is issued to a named applicant to permit a particular transaction. OFAC describes it as “a non-public document issued by OFAC to a particular individual or entity, authorizing a particular transaction in response to a license application.”^[4]

Two consequences follow for a counterparty. First, you may be asked to transact in reliance on a licence you cannot read. When Chevron was authorised to resume limited operations in Venezuela in July 2025, the authorisation was a specific licence that OFAC did not publish, and press coverage at the time noted that the document was not put on OFAC’s website.^[5] A counterparty cannot verify what it cannot see, and should ask for the document, together with its conditions and its expiry, rather than accept a description of it.

Second, because such documents are not posted, their absence from the website is not evidence that none was issued. OFAC maintains a route for verifying documents that are not publicly posted,^[6] and a counterparty should use it to verify claims that a licence has been issued.

Eligibility to apply is not limited by nationality: “[a]ny person having an interest in a transaction or proposed transaction may file an application for a specific license authorizing such a transaction.”^[7] Non-U.S. applicants have obtained specific licences – the Government of Trinidad and Tobago obtained one for a cross-border gas field, and the 2016 Iranian conversion licence discussed in section 5 was issued to an Omani bank.^[8] We are aware of no published OFAC data on applications by nationality, so nothing can be said about relative success rates by that metric. The more useful point is that a specific licence only does work where there is something to authorise: OFAC lifts a prohibition, which requires a U.S. nexus somewhere in the transaction. Where there is none, what a counterparty needs is usually interpretive guidance, applied for through the same portal. OFAC describes that service as guidance “about how authorizations issued by OFAC apply to your situation”;^[9] it will not commit itself in advance on how it will exercise its designation powers.

Timing is always open-ended. Neither the governing statutes nor the licensing regulations impose any deadline on OFAC to decide an application, and no service standard or target time is published; OFAC’s position is only that applications are reviewed in the order they are received.^[10] An application must be taken early or not at all.

2.3. Guidance and FAQs

OFAC publishes extensive guidance and FAQs explaining how its authorisations work. In practice this is often the material that will persuade a compliance officer, so it is genuinely useful. Its status should nonetheless be properly understood.

Each OFAC advisory states in terms that “[t]his advisory is explanatory only and does not have the force of law”, and does not modify the underlying statutory authorities, executive orders or regulations.^[11] The FAQs are framed as material to assist “persons subject to United States jurisdiction” in complying with the law; OFAC’s standing note on them stresses that the legal requirements are those “set forth in the applicable statutes, Executive Orders, and implementing regulations”, and cautions that “a particular answer will not always be applicable to all programs or at all times.”^[12] OFAC has said since 2002 that “[g]reat care should be taken when placing reliance on such materials” and that they may be superseded.^[13] Guidance is evidence of OFAC’s interpretation of the law at the time of the guidance. It is not a permission, and it can change.

2.4. Comfort Letters and Assurances

The fourth category of instrument does not appear in OFAC’s own description of what it issues. It is an individually written assurance, for example, to a foreign government, about how OFAC expects to exercise its designation powers in a particular situation. These letters are not published, so no information about their contents or their frequency can be gained from the public record.

Classification should follow the text rather than the label. A statement about designation risk, an interpretation of an existing licence and an authorisation of prohibited conduct answer three different questions, and calling a document a “letter” or a “derogation” does not settle what it is. The right questions to ask are, whose risk it addresses, which activities and counterparties it names, what assumptions it recites, and when it lapses.

Such assurances are not always forthcoming. After the 2015 nuclear agreement with Iran took effect in January 2016, European banks asked the U.S. Treasury for written assurances before re-entering Iranian business and, according to contemporaneous reporting, did not get them: the U.S. Secretary of State met European bank executives to offer public reassurance,^[14] and the Treasury issued detailed guidance, but that guidance contained no mechanism for case-by-case clearance of individual companies, although that is what the banks had sought.^[15] The Treasury’s position was that it had “issued clear and specific guidance” and its policy objectives were met since “some are still hesitant in dealing with Iran. That was to be expected.”^[16] A counterparty holding out for a written assurance should be ready that it may never arrive.

03Where Your Exposure Actually Comes From

Being outside the primary prohibitions is the starting point of the analysis. Four separate exposures arise, and none of them is peculiar to any one programme.

1. Prohibitions that do bind non-U.S. persons. OFAC states plainly that “[n]on-U.S. persons are also subject to certain sanctions prohibitions”: they “are prohibited from causing or conspiring to cause U.S. persons to violate U.S. sanctions, as well as engaging in conduct that evades U.S. sanctions”, and certain programmes reach foreign persons re-exporting certain goods, technology or services from the United States.^[17] Routing a payment through a U.S. correspondent, or structuring around a restriction can put a non-U.S. company in breach of a prohibition. Civil and criminal penalties are available for such conduct.^[18] Separately, the Iran and Cuba programmes bind non-U.S. entities owned or controlled by U.S. persons, and the North Korea programme binds those owned or controlled by U.S. financial institutions. The Russia programme does not bind foreign subsidiaries as such, although some of its prohibitions reach a U.S. parent that approves or facilitates their subsidiaries’ transactions. Under every programme, U.S. citizens and permanent residents remain bound wherever they work, including those on the board or staff of a Gulf company.^[19]

2. Designation risk. Most modern OFAC programmes provide for designating a person who has materially assisted, sponsored or provided financial, material or technological support for, or goods or services to or in support of, a person already blocked under that programme – the formula recurs almost word for word across programmes as different as Global Magnitsky, Venezuela, North Korea, Iran and Russia.^[20] This is the exposure that actually concerns most commercial counterparties: listing, more often than prosecution.

3. Correspondent-account risk for financial institutions. If the counterparty is a bank, a further authority applies. Correspondent-account sanctions on foreign financial institutions recur across the architecture, appearing in the Iran, North Korea and Russia programmes by executive order, and in the Iran programme by statute.^[21] Available measures run from putting conditions on U.S. correspondent accounts to full blocking of accounts, and at least in the Russia programme the authority applies “with respect to any currency”.^[22] This is why a bank’s risk calculation is not the same as its customer’s.

4. Ownership. An entity owned 50 per cent or more, in the aggregate, directly or indirectly, by one or more blocked persons is itself blocked, whether or not it is separately listed. This is a universal OFAC position, and OFAC aggregates interests held under different programmes.^[23] It is a floor rather than a ceiling: the rule addresses ownership and not control, and several programmes set additional blocking criteria of their own.^[24]

04Relief Does Not Travel Between Programmes

A point that can catch out even sophisticated counterparties is that comfort granted under one sanctions programme does not address exposure under any other.

OFAC has made the point directly and explicitly. It was asked whether non-U.S. persons risked secondary sanctions under the Caesar Act for Syria-related activity that would have been authorised under the Syria regulations. The answer was that it would not consider such transactions “significant” for the purposes of the Caesar Act where a U.S. person would not have needed a specific licence. But it added a carve-out: that comfort did not extend to transactions implicating other OFAC authorities, such as counter-terrorism designations, unless those were separately authorised or exempt.^[25] The Syria programme has since been revoked and the Caesar Act repealed, so the guidance is cited for its reasoning rather than as a current authority. The same carve-out is commonly put into the terms of general licences that remain in force.^[26]

The clearest illustration is a single counterparty carrying more than one listing. VTB Bank has been designated three times over: in February 2022 under the Russia programme, in January 2025 under the Ukraine-related order, and in September 2026 under an Iran authority, the stated basis for the last being that it operates in the financial sector of the Iranian economy.^[27] The entry for the bank on the SDN List now carries all three programme tags.^[28] A counterparty that has worked carefully through the Russia general licences has addressed only one of the three. Any comfort gained from the exercise is limited to the Russia programme only.

So a counterparty can be entirely comfortable on the analysis it has done and still be exposed, because the analysis addressed the wrong programme. Where a chain involves more than one designated person, or one person carrying several listings, each authority has to be worked through separately. The same applies to regimes running in parallel: European Union and United Kingdom measures have their own ownership and control tests, which can capture structures that the U.S. measures leave alone.

05Why Authorisation Does Not Produce Access

The final gap is the one that most transactions fall through. It is the gap between formal permission and commercial appetite for a transaction. OFAC controls the first but not the second.

The sharpest illustration is a specific, not general licence. A U.S. Senate subcommittee found in 2018 that OFAC had issued a specific licence in February 2016 permitting the conversion of some $5.7 billion of Iranian funds through the U.S. financial system, and that OFAC officials then encouraged two American banks to execute the conversion. According to the subcommittee, “[b]oth U.S. banks eventually declined, primarily due to the unwillingness to take on the legal and compliance risk posed by the complex conversion, but also reputational concerns in doing business with a comprehensively sanction[ed] country like Iran.”^[29] The transaction was not merely permitted; it was actively encouraged by the agency that had licensed it, and the banks still said no.

No OFAC licence compels anyone to act. The banks refused to participate in the face of an express licence permission and the licensing agency’s encouragement. A counterparty that is several steps removed from the permission will be more reluctant still. Being told that someone else in the chain holds a licence invites reliance on a document you have not read, held by a party whose bank may take a dim commercial view of the deal.

Three further examples make the same point from different angles.

Sanctions relief and financial-crime classification are different levers. The United States revoked the Syria sanctions programme by executive order with effect from 1 July 2025,^[30] the Caesar Syria Civilian Protection Act of 2019, which had provided for sanctions on non-U.S. persons dealing with the Syrian government, was repealed in December 2025,^[31] and Syria’s designation as a state sponsor of terrorism was rescinded with effect from 24 August 2026.^[32] Syria nonetheless remains on the Financial Action Task Force list of jurisdictions under increased monitoring, updated most recently in June 2026. That listing reflects the Task Force’s continuing inability to verify implementation on the ground rather than a fresh finding of deficiency. Yet, compliance systems read the listing, not the reason for it.^[33] A research report quoted in the financial press in early 2026 recorded that major global banks still classified Syria as high risk and maintained de-risking measures.^[34]

This does not mean that transactions with Syria are impossible; it means the sanctions question and the banking question were answered by different institutions, and clearing the first does not clear the second. Removing a sanctions programme does not remove a grey-listing, an export control, or a bank’s internal country rating, and a counterparty should expect enhanced diligence, longer timelines and some institutions refusing their participation outright even where the transaction itself is lawful.

Carve-outs do not create channels. OFAC issued general licences authorising humanitarian activity in Afghanistan, and in December 2022 the UN Security Council adopted a standing humanitarian exception to its asset freezes,^[35] implemented by OFAC across multiple programmes.^[36] The World Bank nonetheless recorded that de-risking had left Afghanistan “all but cut off from formal international payment channels”, with over US$2 billion in physical cash shipped in between August 2021 and mid-2023 because the banking route did not function.^[37] A study of the Syrian humanitarian response found as much as 35 per cent of donor funds held up at any one time between correspondent and recipient banks for four to six months, and identical payments treated differently from one month to the next.^[38]

Licences can be withdrawn mid-term. In 2023 OFAC licensed the Government of Trinidad and Tobago, its national gas company and an international major to develop a cross-border gas field, on terms amended that October to permit payments to the Government of Venezuela in fiat currency, including U.S. dollars, which lifted a prohibition on cash payments in the original licence.^[39] The licence was revoked in April 2025, some six months before its stated expiry of 31 October 2025, with a wind-down period ending on 27 May 2025.^[40] A replacement licence was granted in October 2025 on a staggered basis, its commercial terms undisclosed.^[41] A counterparty planning around a licence should also plan around its abrupt withdrawal.

An example from the Russia programme points the same way. Blocked Romanian refinery did not restart after a letter was received from the U.S. authorities and Romanian officials stated that the company should be able to operate on its basis;^[42] the company took the view that its banks and other operating counterparties needed an explicit permission, and continued to seek a specific licence, entering insolvency proceedings at its own request with the refinery still closed.^[43] The letter itself has not been published, and the episode does not establish that the assurance was legally ineffective – only that it did not settle the question for those who were to act on it.

06Practical Steps

1. Establish your own position first. Identify whether any part of the chain creates a U.S. nexus – U.S. persons, U.S.-origin goods or technology, dollar clearing through a U.S. correspondent – before considering what anyone else’s licence does. Denomination in dollars and settlement through the United States are not the same thing. In practice, however, most dollar payments clear through a U.S. bank, and that is what should be assumed unless a different settlement route has been confirmed.

2. Ask for the instrument itself and do not accept merely a description: you need the exact text of the licence or assurance, its conditions, reporting obligations and expiry. If the document cannot be produced, treat the assurance as unverified.

3. Identify which programmes are engaged and determine the position under each separately. Comfort under one authority does not carry across to others. EU and UK ownership and control tests differ from the U.S. 50 per cent rule and, through their control limbs, can reach structures it does not.

4. Separate the legal question from the access question, and raise the second with your bank, insurer and carriers by advising them of a payment-specific note of parties, purpose, route and authority. Do this well in advance rather than risk discovering a negative answer at settlement.

5. Address the risk in the terms of your contract. Where relief may be withdrawn or lapse, provide for suspension and termination rights, state who bears the cost of a blocked or returned payment, allow for alternative routing and currencies, and set out evidence obligations.

6. Diarise expiry and renewal for each instrument separately, and record the version relied on and the facts assumed. Keep those records for at least ten years: that is now the limitation period for enforcement under the International Emergency Economic Powers Act, on which most U.S. sanctions programmes rest, and the recordkeeping period OFAC imposes.^[44] Do not assume a letter and a licence share the same duration, or that either will be renewed.

7. Where the position is unclear and the exposure material, consider applying to OFAC in your own name for interpretive guidance or a licence. That route is open to any person with an interest in the transaction, and starting it late is the same as not starting it.

07Conclusion

For a non-U.S. counterparty, the reassuring answer that a transaction is not prohibited is usually true but rarely sufficient. The exposures that matter – causing a violation, evasion, designation for material support, and, for a bank, the blocking of US correspondent accounts – do not depend on being bound by the prohibitions in the first place. And none of them is addressed by a document written for somebody else.

The work is to classify each instrument by what it does and whom it addresses, to obtain the documents rather than accept accounts of them, to run the analysis separately for each regime in play, and to get an indication of readiness from the institutions that will execute the transaction . Formal permission and commercial readiness are secured in different places, and a transaction needs both.

The law is stated as at the date of publication. Sanctions regimes are subject to rapid change without prior consultation; always take care to consult up-to-date legislation or take up-to-date professional advice. The information contained in this document is provided for general informational purposes only, does not constitute legal advice, and does not purport to be an exhaustive analysis of the issues addressed herein. Neither AKTA nor any of its partners or employees accept any responsibility for any actions (or lack thereof) taken as a result of relying on or in any way using information contained in this document, and in no event shall they be liable for any losses resulting from reliance on or use of this information. For tailored, considered advice on your specific circumstances, please contact AKTA.