The month a $49 charge carried a $1,000 penalty at 54K MRR

The screen took four minutes to run and I only ran it because a bank asked me to. We were at $54,000 MRR, applying for a business account with a second institution because the first one had started asking questions about our international mix, and somewhere in their onboarding pack was a line about whether we screened our customers against United States sanctions lists. We did not. I had never once thought about it. I ran the list that evening expecting nothing, got one match, and spent the next eleven days learning that the number I was afraid of was wrong by a factor of three hundred and seventy seven, and that the number that actually applied could be divided by forty depending on what I did in the following three weeks.

Quick answer (2026): This is a composite diary, not one real company, though every regulation, section number, quoted passage and calculation in it is real and sourced below. A long dormant $49 a month account resolved to a comprehensively sanctioned jurisdiction and had billed successfully twenty six times, collecting $1,274. The advisory pages all quote the statutory maximum, which under the International Emergency Economic Powers Act is the greater of $377,700 or twice the transaction, and twenty six of those is $9,820,200. That is not the number that applies to a non-egregious case. The number that applies comes out of OFAC's own penalty matrix, and it depends entirely on one thing: whether OFAC hears about it from you or from somebody else. Without a voluntary self-disclosure the base is a flat $1,000 per charge, because the schedule that sets it does not scale below $1,000. With one, the base is half the transaction value, which on a $49 charge is $24.50. Twenty six charges: $26,000 against $637. The whole decision was worth 40.8 times its own arithmetic, and the window to make it closed on the next rebill date.

The four minute screen

Nothing about our business felt like sanctions exposure. We sold a scheduling tool to small teams. No hardware, no shipping, no wire transfers, no correspondent banking, nothing that appears in a single one of the guides I later read. Every page I found on the subject was written for a bank, a freight forwarder or an exporter. OFAC's own framework document, A Framework for OFAC Compliance Commitments, sets out five elements: management commitment, risk assessment, internal controls, testing and auditing, and training. It is a good document. It is also plainly addressed to an organisation with a compliance function, and reading it as a four person company mostly produces the feeling that none of this is aimed at you.

What is aimed at you is the underlying prohibition, which does not care how small you are and does not have a revenue threshold. There is no exemption for companies under a certain size. There is no exemption for software. I exported the customer table, ran the names and the billing countries against the published list, and got exactly one hit: an account created twenty six months earlier, $49 a month, paid on time every month, last logged in about a year ago, billing address in a jurisdiction under comprehensive sanctions, account holder name matching a listed entry closely enough that I could not talk myself out of it.

The number I was afraid of

I did what everybody does, which is search for the penalty. Every result gives you the statutory maximum. Under IEEPA it is the greater of $377,700 or twice the amount of the underlying transaction, and since twice $49 is $98, the $377,700 governs. Each monthly charge is its own transaction. Twenty six months of a $49 subscription therefore reads, on the arithmetic every advisory page invites you to do, as $9,820,200 of exposure against $1,274 of collected revenue.

I believed that number for about a day and a half. It is not wrong exactly, it is just the ceiling rather than the calculation. OFAC publishes how it actually arrives at a proposed penalty, in Appendix A to Part 501, the Economic Sanctions Enforcement Guidelines, and the guidelines contain a four cell matrix. The two axes are whether the case is egregious, and whether it reached OFAC through a voluntary self-disclosure. The statutory maximum is the base only in the worst cell, an egregious case that OFAC found on its own. A dormant subscription that nobody at the company ever looked at is not the egregious cell. Willfulness is a factor that makes the response stronger, and the guidelines describe it as conduct undertaken with knowledge that it would constitute a violation. Not knowing is not a defence, which is the part that genuinely frightened me, but it does keep you out of the cell where the maximum lives.

The two cells that actually applied

For a non-egregious case the matrix gives two numbers and they are not close.

If the violation is disclosed by voluntary self-disclosure, the base penalty is, quoting the guidelines directly, one half of the transaction value, capped at a maximum base amount of $188,850 per violation. Half of $49 is $24.50. The cap is irrelevant at our scale.

If the violation comes to OFAC's attention by means other than a voluntary self-disclosure, the base is instead the applicable schedule amount. That phrase is doing enormous work and almost nobody quotes it, because you have to go back to the definitions section to find out that the applicable schedule amount means $1,000 with respect to a transaction valued at less than $1,000.

Read those two sentences next to each other and the shape of the thing becomes visible. One basis is proportional to what you actually charged. The other is a flat floor that does not descend below $1,000 no matter how small the transaction is. A $49 charge and a $999 charge carry an identical $1,000 base. The schedule only starts scaling upward at $1,000 and only reaches the statutory maximum at $200,000.

This is why a small ticket subscription business is, per dollar of revenue, the worst positioned business in the entire schedule. A company doing $200,000 transactions has a base penalty roughly equal to two transactions. Mine was twenty and a half times everything the customer had ever paid me. Twenty six charges at the flat floor is $26,000, against $1,274 collected. Twenty six charges at half of transaction value is $637, which is less than half of what the customer paid me. Same conduct, same customer, same twenty six charges, and a 40.8 times difference that turns entirely on who tells OFAC.

What voluntary actually means

At this point the decision looked obvious and I nearly got it wrong for a stupid reason, which is that I assumed I was in a race with my payment processor and assumed I had already lost it.

The guidelines define voluntary self-disclosure as self initiated notification to OFAC prior to or at the same time as OFAC or any other government agency discovers the violation. Then they list what disqualifies it, and one entry stops you cold. A notification is not a voluntary self-disclosure if a third party is required to and does notify OFAC because a transaction was blocked or rejected by that third party, and the text adds, in parentheses, regardless of when OFAC receives such notice from the third party and regardless of whether the Subject Person was aware of the third party's disclosure.

Regardless of when. So it is not a race. If the processor reports, my disclosure is retrospectively not voluntary even if I filed first and even if nobody told me. And two sentences earlier the guidelines define substantially similar apparent violation as one that is part of a series of similar apparent violations or relates to the same pattern of conduct, which means a report about one charge reaches all twenty six.

I read that as: the door is already shut. It was not, and the reason is the condition sitting in the middle of the sentence. The disqualifier requires that a transaction was blocked or rejected by the third party. All twenty six of my charges had succeeded. Nothing had been blocked, nothing had been rejected, so no third party reporting obligation had ever been triggered, so nothing had disqualified anything. The door was open precisely because the screening failure was total. Had my processor caught even one charge, the flat floor would have applied to all of them.

That is also the countdown. The moment a charge is blocked, the obligation attaches and voluntariness dies for the whole series. My subscription rebilled monthly. The window was not eleven days of deliberation, it was however many days remained before the next attempt, which I could see in the dashboard.

The clock I started myself

I cancelled the subscription and stopped the funds moving, which felt like the responsible thing and immediately created an obligation of my own. The reporting rules are not addressed only to banks. Section 501.603 requires reports of blocked property from any United States person, including but not limited to financial institutions, within 10 business days from the date that property becomes blocked. Section 501.604 applies the same 10 business day deadline to rejected transactions. Any United States person is a four person software company as squarely as it is a bank.

So the sequence matters and I had it backwards in my head. Doing the obviously right thing operationally, freezing the money, starts a ten business day statutory clock on a founder who did not know the clock existed. I would rather have known that on day one than on day nine.

What actually happened

Two further reductions sit on top of the base and I did not count on either. The guidelines reduce the base by up to 25 percent for a first violation, defined as no penalty notice or finding of violation in the five preceding years, and by a further 25 to 40 percent for substantial cooperation. They also note that a group of substantially similar violations in a single pre-penalty notice counts as one violation for the first violation test, which helps rather than hurts. The dollar figures throughout are the amounts as codified, and the guidelines state on their face that they are subject to inflation adjustment, so treat the exact digits as of their publication rather than as permanent. I am a founder, not a lawyer, and the only unqualified advice in this piece is to talk to one earlier than I did. OFAC publishes its enforcement actions, and reading a few of them is the fastest correction to the belief that this only happens to banks.

The one thing I would tell you

Run the screen. It takes four minutes and there is no version of the outcome where you would rather not have known, because the value of knowing is not that you avoid the penalty, it is that you keep the ability to choose which penalty applies to you.

The thing I keep turning over is that the entire 40.8 times spread was determined by a fact about my own ignorance. Because I had never screened anybody, nothing had ever been blocked, and because nothing had ever been blocked, no third party had ever been required to report, and because no third party had been required to report, my disclosure was still voluntary. If I had implemented screening thirteen months in, caught the account on charge fourteen and let the processor block it, I would have been a better operated company sitting in the more expensive cell. Being sloppy for twenty six straight months is what kept the cheap option open.

I do not know what to do with that, morally. Operationally I know exactly what to do with it: the cheap option is a wasting asset that expires at the next rebill, and the only thing that converts it into cash is acting before the machine you set up on autopilot catches the thing you should have caught yourself.