OFAC replaced a reporting duty with a recordkeeping duty on legal-services payments

On 27 July 2026 OFAC adopted a final rule that updates website and contact details across several parts of the Code of Federal Regulations, and — the part worth reading — amends a general license so that payments for legal services from funds originating outside the United States carry a recordkeeping requirement instead of a reporting requirement.

Swapping reporting for recordkeeping sounds like a lightening of the load, and in the short term it is: one fewer filing. The trade is that the burden of proof moves onto you and stays there. A report filed on time is evidence that exists in someone else's system. A record you kept is evidence that exists only in yours, and only if the process that creates it actually runs.

If your team treats this as a task removed rather than a task changed, the failure mode is quiet. Nobody notices a missing record on the day. It surfaces years later, when the payment is questioned and the file has to reconstruct who was paid, from which funds, under which authorisation.

The rest of the rule is administrative — updated URLs and contact points, plus corrections to two parts and an erroneous cross-reference. Administrative, but worth a pass if your internal procedures quote OFAC contact details or CFR cross-references verbatim, because those citations are now stale in a document an examiner may read alongside yours.

This is a US rule and it applies to persons subject to US jurisdiction. It does not change obligations under UK, EU or any other regime, and it should not be filed as though it did.