A Boarding School Just Paid $1.7M to OFAC: Why No Industry Is Safe from Sanctions Enforcement

When compliance professionals talk about sanctions enforcement, the examples are predictable: banks, oil traders, shipping companies. The targets make intuitive sense—they're the industries that move money and goods across borders.

On February 12, 2026, OFAC settled an enforcement action that broke that mold entirely. The target was IMG Academy, an elite boarding school and athletic training facility in Bradenton, Florida. The violation: enrolling the children of two individuals sanctioned under the Foreign Narcotics Kingpin Designation Act and processing their tuition payments for five consecutive years.

The settlement amount was $1,720,000.

What Actually Happened

The facts are straightforward, and that's what makes this case so striking. Starting in January 2018, IMG Academy enrolled the child of an individual designated on OFAC's Specially Designated Nationals (SDN) list for ties to a Mexican drug trafficking organization. In July 2020, a second sanctioned individual enrolled their child at the same school. Both parents signed tuition enrollment agreements directly with IMG Academy, were invoiced by name, and communicated regularly with the school about payments.

Over the next several years, IMG Academy processed 83 separate transactions—wire transfers from third parties in Mexico and credit card payments—to satisfy tuition obligations that ranged from $47,000 for a half-semester to over $102,000 per academic year. When overpayments occurred, IMG Academy rolled the balances forward into the next year's tuition agreement with the same sanctioned individuals.

The relationship continued until one student graduated in Spring 2023 and the other withdrew in June 2022. In total, OFAC identified 89 apparent violations: six tuition enrollment agreements plus 83 financial transactions.

The Damning Detail: The Names Were Right There

OFAC's enforcement release made one point unmistakably clear: this was entirely preventable. The two sanctioned individuals provided their full names during the application process, the enrollment stage, and when signing each annual tuition agreement. Those names matched their entries on the SDN list exactly.

OFAC stated that "minimal due diligence at any point throughout this process would have revealed that these customers were sanctioned." The school had the names. They invoiced the names. They communicated with the individuals by name about payment processing, credits, and refunds. They simply never checked those names against any sanctions list.

This wasn't a fuzzy match scenario. This wasn't a transliteration issue or an alias problem. The names were exact matches on the SDN list. A single screening check at any point during the five-year relationship would have flagged both individuals immediately.

Why This Case Matters Beyond Education

OFAC used unusually direct language in the compliance guidance accompanying this settlement. The agency noted that sanctions risk is "pervasive across a wide variety of sectors and institutions" and that "even for entities operating largely domestically, the presence of international touchpoints creates opportunities for impermissible dealings with sanctioned actors."

Read that again: even for entities operating largely domestically.

IMG Academy is a school in Florida. It's not a bank, not a shipping company, not a commodities trader. But it enrolls international students, accepts payments from abroad, and signs contracts with foreign nationals. That's enough. Those are the "international touchpoints" that create sanctions obligations.

Now think about your own business. Do you invoice foreign customers? Accept wire transfers from overseas? Sign contracts with individuals or entities based outside the United States? If the answer to any of those questions is yes, you have the same sanctions obligations that IMG Academy failed to meet.

The Industries That Should Be Paying Attention

This enforcement action extends the reach of sanctions compliance expectations well beyond the usual suspects. Consider the types of businesses that share IMG Academy's risk profile—domestic operations with international customer bases and payment flows:

• Real estate firms: Accepting deposits and payments from foreign buyers, often through intermediaries or third-party wire transfers
• Private medical practices and hospitals: Treating international patients who pay directly or through foreign insurance arrangements
• Law firms and consultancies: Engaging foreign clients and receiving retainers from overseas accounts
• Luxury goods retailers: Processing high-value purchases from international customers
• Private aviation and yacht services: Chartering to foreign nationals with complex payment structures
• Technology companies: Licensing software or services to foreign entities and individuals
• Property management companies: Leasing to foreign tenants and accepting rent from overseas sources

None of these industries traditionally think of themselves as needing sanctions compliance programs. The IMG Academy case says otherwise.

The Third-Party Payment Problem

One detail in the enforcement release deserves special attention. IMG Academy didn't receive most payments directly from the sanctioned individuals. Instead, payments came as third-party wire transfers from non-designated individuals and entities in Mexico, plus credit cards on file for each student account.

This is a pattern OFAC sees constantly: sanctioned individuals using intermediaries to make payments. The school processed these third-party payments without questioning why tuition for a student enrolled under one name was being paid by different people and entities in Mexico.

For any business accepting international payments, this is a critical lesson. Screening only the person you're invoicing isn't sufficient. You need to understand who is actually sending the money and why the payment structure looks the way it does. Unusual payment arrangements—especially third-party payments from high-risk jurisdictions—are red flags that warrant additional scrutiny.

What OFAC Expects Now

The compliance considerations section of the enforcement release reads like a checklist for any institution with an international customer base. OFAC recommends:

• Screening counterparties: Not just customers, but anyone who signs an agreement, makes a payment, or is otherwise party to a transaction
• Screening payors: The person or entity actually sending the money, not just the person on the invoice
• Checking the SDN list: At minimum, screening against OFAC's SDN list before entering into agreements and processing payments
• Understanding associated parties: Determining whether any connected individuals have ties to sanctioned persons or comprehensively sanctioned jurisdictions
• Regular auditing: Conducting independent testing to ensure screening controls are actually working
• Staff training: Ensuring that customer-facing personnel understand the basics of sanctions compliance

OFAC also emphasized the importance of "strong management commitment and a comprehensive risk assessment" as starting points. This isn't optional guidance—it's OFAC telling every organization with international exposure exactly what they'll be measured against in the next enforcement action.

The Cost of Not Knowing

IMG Academy's case included a notable mitigating factor: after an ownership change in June 2023, new leadership hired a Chief Legal Officer who conducted a comprehensive lookback and implemented a sanctions compliance program. The school also cooperated fully with OFAC's investigation.

But here's what didn't help: IMG Academy did not voluntarily self-disclose the violations. By the time the school realized what had happened, OFAC had already opened an investigation. Under OFAC's enforcement guidelines, voluntary self-disclosure can reduce penalties by up to 50%. IMG Academy missed that window entirely—because they didn't have the screening systems in place to detect the problem on their own.

The aggravating factors tell the rest of the story. OFAC determined that IMG Academy demonstrated "reckless disregard" for sanctions requirements by failing to conduct any screening whatsoever. The agency noted that the school had "actual knowledge of the underlying transactions"—they knew who they were dealing with and processed payments for years. They just never checked whether those individuals were sanctioned.

The Broader Enforcement Trend

This settlement fits a clear pattern in OFAC's recent enforcement strategy: expanding beyond financial institutions to target any entity that touches sanctioned individuals or their money. In 2024, OFAC settled with a logistics company, a technology exporter, and multiple companies in sectors that historically received little sanctions scrutiny. The IMG Academy case pushes that boundary further than ever before.

OFAC is also investing in detection capabilities. The agency's whistleblower program, administered through FinCEN, offers financial incentives for information leading to enforcement actions with penalties exceeding $1 million. This means employees, competitors, or anyone else who becomes aware of potential violations has a direct financial incentive to report them.

For businesses that have never screened before, the risk calculation has fundamentally changed. It's not just about whether OFAC will find you through its own investigation—it's about whether anyone who knows about your business practices might report you.

What You Should Do This Week

If your business has any international customers, accepts any payments from foreign sources, or contracts with any foreign nationals, here's the minimum you should be doing right now:

• Screen your existing customer list: Run every customer, counterparty, and payor name you have through a sanctions screening system. If you have exact matches sitting in your database—like IMG Academy did for five years—you need to find them before OFAC does.
• Implement screening at onboarding: Before signing any new agreement or accepting any new customer, screen their name against the SDN list. This is the single step that would have prevented IMG Academy's entire $1.72 million liability.
• Screen payors, not just customers: If someone other than the invoiced party is making payments, screen the actual payor too. Third-party payment arrangements are a hallmark of sanctions evasion.
• Set up ongoing monitoring: OFAC updates the SDN list regularly. A customer who was clean last year might be designated today. Periodic re-screening of your existing relationships is essential.

The Bottom Line

A Florida boarding school just paid $1.72 million because it never thought to check its students' parents against a publicly available sanctions list. The names were exact matches. The payments were processed for five years. And the entire penalty was avoidable with a single, basic screening step.

If OFAC will pursue an enforcement action against an academic institution for processing tuition payments, they will pursue one against your company for processing invoices, service fees, or any other transaction involving a sanctioned person.

The question isn't whether your industry is "the type" that needs sanctions screening. After IMG Academy, every industry is that type.