Economic sanctions remain a primary tool used by the U.S. government to achieve foreign policy goals. The last several years have seen significant enhancements to the various OFAC lists, particularly those that relate to Venezuela, Iran and Crimea. While historically, sanctions risk for credit unions was low, in the past few decades there has been significant growth in the size of credit unions, the consumer bases they serve and the products they offer. This has introduced new types of risk for credit unions, one of which is that a member or partner could engage in transactions with sanctioned entities.

Most credit unions recognize that the first step to effective sanctions compliance is risk-appropriate screening of members. The effects of and reasons for OFAC designation mean that domestic members are highly unlikely to be an OFAC Specially Designated National, but it can happen and it has resulted in enforcement activity in the past. It is when credit unions provide services to non-natural person entities, particularly money services businesses (MSBs) that risks rise significantly. In particular, it is the risks posed by the "customers' customer' in this circumstance that pose potential risk to the hosting credit union. It is important to note that few risks cannot be offset by the application of proper controls, but that the costs of such controls when providing services to entities that have their own customers engaging in financial activities, may challenge profitability.

While credit unions provide tremendous value to their members, money services firms may seek credit union relationships because they have been pushed out of relationships at banks, where their sanctions and anti-money laundering practices could have been found to be insufficient. And while most credit unions look to maintain or develop the proper controls for their membership composition and service, there are some that have been seduced by the extraordinary amount of revenue that these consumers can bring, without knowing the full risk. Namely, the credit union can be held responsible, in whole or in part, if the MSB's transactions breach sanctions regulations.